@cursor/july 0.1.96 → 0.1.99

package/dist/internal/approval-gate.js

@@ -1,13 +1,12 @@
 /**
- * In-memory gate for human-in-the-loop tool approvals. The session
- * engine parks inside a server-tool `execute` by awaiting
- * {@link ApprovalGate.wait}; HTTP (or the playground) unblocks via
- * {@link ApprovalGate.resolve}.
+ * In-memory gate for human-in-the-loop parks. The session engine parks
+ * inside a server-tool `execute` by awaiting {@link ApprovalGate.wait};
+ * HTTP (or the playground) unblocks via {@link ApprovalGate.resolve}.
  *
- * Pending approvals are also mirrored onto {@link SessionRecord} for
- * durability of the *list* across reloads. After a process restart the
- * in-flight SDK tool callback is gone, so resolve returns false and
- * the host treats the approval as interrupted.
+ * Used for `needsApproval` and MCP on-demand auth. Pending rows are also
+ * mirrored onto {@link SessionRecord} for durability of the *list* across
+ * reloads. After a process restart the in-flight SDK tool callback is gone,
+ * so resolve returns false and the host treats the park as interrupted.
  */
 function approvalKey(sessionId, callId) {
     return `${sessionId}\0${callId}`;
@@ -16,21 +15,15 @@ export class ApprovalGate {
     constructor() {
         this.waiters = new Map();
     }
-    wait(meta) {
-        const key = approvalKey(meta.sessionId, meta.callId);
+    wait(sessionId, meta) {
+        const key = approvalKey(sessionId, meta.callId);
         const existing = this.waiters.get(key);
         if (existing !== undefined) {
-            throw new Error(`Approval already pending for session ${meta.sessionId} call ${meta.callId}`);
+            throw new Error(`Approval already pending for session ${sessionId} call ${meta.callId}`);
         }
         return new Promise((resolveDecision) => {
             this.waiters.set(key, {
-                meta: {
-                    callId: meta.callId,
-                    turnId: meta.turnId,
-                    toolName: meta.toolName,
-                    args: meta.args,
-                    requestedAt: meta.requestedAt,
-                },
+                meta,
                 resolve: resolveDecision,
             });
         });
@@ -46,9 +39,11 @@ export class ApprovalGate {
             return false;
         }
         this.waiters.delete(key);
-        waiter.resolve(Object.assign({ decision }, (resolvedBy === undefined || resolvedBy === ""
-            ? {}
-            : { by: resolvedBy })));
+        const by = resolvedBy === undefined || resolvedBy === "" ? undefined : resolvedBy;
+        waiter.resolve({
+            decision,
+            by,
+        });
         return true;
     }
     has(sessionId, callId) {

package/dist/internal/as-of.d.ts

@@ -0,0 +1,19 @@
+export declare class InvalidAsOfError extends Error {
+    constructor(value: string);
+}
+export declare function normalizeAsOf(value: string | undefined): string | undefined;
+export declare function sessionClock(asOf: string | undefined): () => Date;
+export declare class VacuousTimeArgsError extends Error {
+    constructor(toolName: string, missing: readonly string[]);
+}
+export declare function assertTimeArgs(tools: readonly {
+    name: string;
+    definition: {
+        timeArgs?: readonly string[];
+    };
+    inputSchema?: {
+        properties?: Record<string, unknown>;
+    };
+}[], asOf: string | undefined): void;
+export declare function timeArgViolation(input: unknown, timeArgs: readonly string[], asOf: string): string | undefined;
+//# sourceMappingURL=as-of.d.ts.map

package/dist/internal/as-of.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"as-of.d.ts","sourceRoot":"","sources":["../../src/internal/as-of.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,KAAK,EAAE,MAAM,EAMxB;CACF;AAWD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS3E;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,IAAI,CAMjE;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAQvD;CACF;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CACxD,EAAE,EACH,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,IAAI,CAeN;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CA0BpB"}

package/dist/internal/as-of.js

@@ -0,0 +1,82 @@
+const TIMEZONE_SUFFIX = /(?:Z|[+-]\d{2}:?\d{2})$/i;
+export class InvalidAsOfError extends Error {
+    constructor(value) {
+        super(`asOf must be an ISO-8601 instant with a timezone (e.g. ` +
+            `2026-08-31T12:00:00Z); received ${JSON.stringify(value)}.`);
+        this.name = "InvalidAsOfError";
+    }
+}
+function parseInstant(value) {
+    const trimmed = value.trim();
+    if (trimmed === "" || !TIMEZONE_SUFFIX.test(trimmed)) {
+        return undefined;
+    }
+    const instant = new Date(trimmed);
+    return Number.isNaN(instant.getTime()) ? undefined : instant;
+}
+export function normalizeAsOf(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const instant = parseInstant(value);
+    if (instant === undefined) {
+        throw new InvalidAsOfError(value);
+    }
+    return instant.toISOString();
+}
+export function sessionClock(asOf) {
+    if (asOf === undefined) {
+        return () => new Date();
+    }
+    const frozen = new Date(asOf).getTime();
+    return () => new Date(frozen);
+}
+export class VacuousTimeArgsError extends Error {
+    constructor(toolName, missing) {
+        super(`Tool "${toolName}" declares timeArgs ` +
+            `${JSON.stringify(missing)} that its input schema does not define, ` +
+            `so bounding would silently check nothing. Make the declaration ` +
+            `match the schema's property names.`);
+        this.name = "VacuousTimeArgsError";
+    }
+}
+export function assertTimeArgs(tools, asOf) {
+    var _a;
+    var _b;
+    if (asOf === undefined) {
+        return;
+    }
+    for (const tool of tools) {
+        const declared = tool.definition.timeArgs;
+        if (declared === undefined || declared.length === 0) {
+            continue;
+        }
+        const properties = (_b = (_a = tool.inputSchema) === null || _a === void 0 ? void 0 : _a.properties) !== null && _b !== void 0 ? _b : {};
+        const missing = declared.filter((name) => !(name in properties));
+        if (missing.length > 0) {
+            throw new VacuousTimeArgsError(tool.name, missing);
+        }
+    }
+}
+export function timeArgViolation(input, timeArgs, asOf) {
+    const record = typeof input === "object" && input !== null
+        ? input
+        : {};
+    const frozen = new Date(asOf).getTime();
+    for (const name of timeArgs) {
+        const value = record[name];
+        const instant = typeof value === "string" ? parseInstant(value) : undefined;
+        if (instant === undefined) {
+            return (`Time argument "${name}" must be an absolute ISO-8601 instant with ` +
+                `a timezone (e.g. ${asOf}); received ${JSON.stringify(value)}. This ` +
+                `session reads the world as of ${asOf} — supply absolute bounds at ` +
+                `or before that instant and retry.`);
+        }
+        if (instant.getTime() > frozen) {
+            return (`Time argument "${name}" (${JSON.stringify(value)}) is later than ` +
+                `the instant this session reads the world as of (${asOf}). Supply ` +
+                `bounds at or before that instant and retry.`);
+        }
+    }
+    return undefined;
+}

package/dist/internal/chat-client.js

@@ -364,6 +364,16 @@ function streamTurn(args) {
                     write(`    ${mark} ${c.bold(event.data.toolName)} ${c.dim(event.data.decision === "approve" ? "approved" : "denied")}\n`);
                     continue;
                 }
+                if (event.type === "action.auth_requested") {
+                    closeAssistant();
+                    write(`    ${c.yellow("⏸")} ${c.bold(event.data.connection)} ${c.dim("awaiting MCP authorization")}\n`);
+                    continue;
+                }
+                if (event.type === "action.auth_resolved") {
+                    const mark = event.data.decision === "approve" ? c.green("✓") : c.red("✗");
+                    write(`    ${mark} ${c.bold(event.data.connection)} ${c.dim(event.data.decision === "approve" ? "connected" : "denied")}\n`);
+                    continue;
+                }
                 if (event.type === "action.result") {
                     if (event.data.toolName === "task" &&
                         event.data.parentCallId === undefined) {

package/dist/internal/cli-deploy.d.ts

@@ -53,6 +53,12 @@ export interface DeployCliOptions {
     cursorEventsRepos?: string[];
     /** deploy `--allow-domain <domain>` (repeatable; unioned with the manifest). */
     allowDomains?: string[];
+    /**
+     * deploy `--multi-tenant`: add a release to an existing Cursor-managed
+     * (multi-tenant) product. Hidden Anysphere-only flag. Cannot create a
+     * new multi-tenant application.
+     */
+    multiTenant?: boolean;
     /** Test seams. */
     fetchImpl?: typeof fetch;
     /** Inject the connector-auth browser opener (tests; also forces interactive). */

package/dist/internal/cli-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAaxB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4E1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAwkBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAqGjB;AAMD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}
+{"version":3,"file":"cli-deploy.d.ts","sourceRoot":"","sources":["../../src/internal/cli-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,OAAO,EAKL,sBAAsB,EAevB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,SAAS,EAAwB,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,gBAAgB,CAAC;AAexB,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,MAAM,EAAE,SAAS,YAAY,EAAE,KAC5B,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kBAAkB;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,iFAAiF;IACjF,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,GAAG;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CACtC,CAAC;AAeF,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,gEAAgE;IAChE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,sBAAsB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,CAiEtC;AA0CD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF1E;AA4MD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,YAAY,EAAE,EAC/B,OAAO,EAAE;IACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,CAqChC;AAmnBD,wBAAsB,cAAc,CAClC,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAMD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAoHjB;AAwCD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAMD,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAMD,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAMD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAMD,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4EjB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CAkCjB;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAoED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuCnC"}

package/dist/internal/cli-deploy.js

@@ -34,6 +34,8 @@ import { deployProgressLabel, sanitizeCustomerError } from "./logs-client.js";
 import { stderrPalette } from "./terminal-style.js";
 const DEFAULT_POLL_INTERVAL_MS = 3000;
 const DEFAULT_DEPLOY_TIMEOUT_MS = 10 * 60 * 1000;
+/** `--multi-tenant` HTTP deploy is Anysphere-only (team id 1). */
+const MULTI_TENANT_HTTP_DEPLOY_TEAM_ID = 1;
 /**
  * Credentials → deploy client → team id. Shared by deploy commands and
  * `--prod` AX routing. Returns an exit code (error already rendered) on
@@ -135,6 +137,11 @@ export function cmdDeploy(options) {
         if (typeof ctx === "number") {
             return ctx;
         }
+        if (options.multiTenant === true &&
+            ctx.teamId !== MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+            ctx.err("--multi-tenant is not available for this team.\n");
+            return 1;
+        }
         const targets = yield resolveDeployTargets(options, ctx);
         if (typeof targets === "number") {
             return targets;
@@ -152,7 +159,9 @@ export function cmdDeploy(options) {
             manifests.push(yield readDeployManifest(target.dir));
         }
         if (manifests.every((manifest) => manifest.architecture === "v2")) {
-            return deployAgentsdkApplication(ctx, options, targets);
+            return deployAgentsdkApplication(ctx, options, targets, {
+                hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+            });
         }
         if (!ctx.json &&
             manifests.some((manifest) => manifest.architecture === "v2")) {
@@ -488,8 +497,14 @@ function deployOne(ctx, options, target, extras) {
                 gitRef,
                 agentPath,
                 repositories: options.cursorEventsRepos,
+                hasScmChannels: manifest.hasScmChannels,
+                multiTenant: options.multiTenant === true,
             });
         }
+        if (options.multiTenant === true) {
+            ctx.err("--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n");
+            return 1;
+        }
         // Today's only source shape: the control plane builds from a git ref.
         // See DeploySource for the artifact seam.
         const source = Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ kind: "git-ref", gitRepoUrl }, (gitRef === undefined ? {} : { gitRef })), (agentPath === undefined ? {} : { agentPath })), (options.cursorEventsRepos === undefined ||
@@ -546,10 +561,7 @@ function deployOne(ctx, options, target, extras) {
             return detail.status === "running" ? 0 : 1;
         }
         if (detail.status !== "running") {
-            const errorDetail = detail.lastError === null || detail.lastError === undefined
-                ? ""
-                : `: ${sanitizeCustomerError(detail.lastError)}`;
-            ctx.err(`Deployment ${slug} ended ${detail.status}${errorDetail}\n`);
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
         const deployedPublicRoutes = (_h = detail.publicRoutePaths) !== null && _h !== void 0 ? _h : [];
@@ -580,7 +592,7 @@ function deployOne(ctx, options, target, extras) {
  * key is the child's slug and its path is the child directory relative to
  * the repo root (a shared --path names the parent's directory in the repo).
  */
-function deployAgentsdkApplication(ctx, options, targets) {
+function deployAgentsdkApplication(ctx, options, targets, declarations) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d, _e;
         const parentDir = resolve((_a = options.dir) !== null && _a !== void 0 ? _a : ".");
@@ -640,6 +652,8 @@ function deployAgentsdkApplication(ctx, options, targets) {
             agentPath: undefined,
             components,
             repositories: options.cursorEventsRepos,
+            hasScmChannels: declarations.hasScmChannels,
+            multiTenant: options.multiTenant === true,
         });
     });
 }
@@ -650,26 +664,25 @@ function deployAgentsdkApplication(ctx, options, targets) {
  */
 function deployOneAgentsdk(ctx, extras, args) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const { slug } = args;
         const componentsLine = args.components === undefined
             ? ""
             : `  components:  ${args.components
                 .map((component) => component.componentKey)
                 .join(", ")}\n`;
+        if (args.multiTenant && !ctx.json) {
+            ctx.err("  multi-tenant: existing product\n");
+        }
         let accepted;
         try {
-            accepted = yield ctx.client.deployAgentkit({
-                teamId: ctx.teamId,
-                slug,
-                gitRepoUrl: args.gitRepoUrl,
-                gitRef: args.gitRef,
-                agentPath: args.agentPath,
-                components: args.components,
-                repositories: args.repositories,
-            });
+            accepted = yield ctx.client.deployAgentkit(Object.assign({ teamId: ctx.teamId, slug, gitRepoUrl: args.gitRepoUrl, gitRef: args.gitRef, agentPath: args.agentPath, components: args.components, repositories: args.repositories }, (args.multiTenant ? { multiTenant: true } : {})));
         }
         catch (error) {
-            return renderApiError(error, ctx.err);
+            return renderApiError(error, ctx.err, {
+                multiTenant: args.multiTenant,
+                teamId: ctx.teamId,
+            });
         }
         if (ctx.noWait) {
             if ((extras === null || extras === void 0 ? void 0 : extras.jsonCollect) !== undefined) {
@@ -702,7 +715,7 @@ function deployOneAgentsdk(ctx, extras, args) {
             return detail.status === "running" ? 0 : 1;
         }
         if (detail.status !== "running") {
-            ctx.err(`Deployment ${slug} ended ${detail.status}\n`);
+            ctx.err(`Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`);
             return 1;
         }
         ctx.out(`Deployed ${slug} (team ${ctx.teamId})\n` +
@@ -714,7 +727,16 @@ function deployOneAgentsdk(ctx, extras, args) {
                 ? ""
                 : `  components:   ${args.components
                     .map((component) => component.componentKey)
-                    .join(", ")}\n`));
+                    .join(", ")}\n`) +
+            (detail.repositories === undefined || !args.hasScmChannels
+                ? ""
+                : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`));
+        // An agent with GitHub/Origin channels bound to no repository scope gets
+        // no deliveries at all, which is otherwise invisible in this output.
+        if (args.hasScmChannels && ((_a = detail.repositories) === null || _a === void 0 ? void 0 : _a.length) === 0) {
+            ctx.err(`warning: ${slug} watches no repositories, so its GitHub/Origin channels receive no events.\n` +
+                `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`);
+        }
         return 0;
     });
 }
@@ -806,6 +828,11 @@ function readDeployManifest(dir) {
                 .filter((channel) => { var _a; return ((_a = channel.definition.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy); })
                 .map((channel) => channel.id),
             httpChannelPublicEndpoint: ((_a = project.httpChannel.auth) !== null && _a !== void 0 ? _a : []).some(isPublicEndpointPolicy),
+            hasScmChannels: project.channels.some((channel) => {
+                var _a;
+                const kind = (_a = channel.definition.meta) === null || _a === void 0 ? void 0 : _a.kind;
+                return kind === "github" || kind === "origin";
+            }),
         };
     });
 }
@@ -875,6 +902,22 @@ export function cmdDeploymentStatus(slug, options) {
         if (typeof ctx === "number") {
             return ctx;
         }
+        // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+        // GET goes first. A v2 404 (missing slug, or an older backend) falls
+        // through to the v1 agent-serve detail.
+        try {
+            const detail = yield ctx.client.getAgentkitDeploy({
+                teamId: ctx.teamId,
+                slug,
+            });
+            renderAgentkitDeploymentStatus(ctx, detail);
+            return 0;
+        }
+        catch (error) {
+            if (!(error instanceof DeployApiError) || error.status !== 404) {
+                return renderApiError(error, ctx.err);
+            }
+        }
         let detail;
         try {
             detail = yield ctx.client.getDeployment({ teamId: ctx.teamId, slug });
@@ -949,6 +992,32 @@ export function cmdDeploymentStatus(slug, options) {
         return 0;
     });
 }
+function renderAgentkitDeploymentStatus(ctx, detail) {
+    if (ctx.json) {
+        ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+        return;
+    }
+    const lines = [
+        `${detail.slug} (team ${detail.teamId})`,
+        `  status:       ${detail.status}`,
+        `  architecture: v2`,
+        `  application:  ${detail.applicationId}`,
+        `  release:      ${detail.releaseId}`,
+        `  progress:     ${detail.progress}`,
+    ];
+    if (detail.statusMessage !== null && detail.statusMessage.trim() !== "") {
+        lines.push(`  step:         ${detail.statusMessage}`);
+    }
+    if (detail.repositories !== undefined) {
+        lines.push(`  watching:     ${detail.repositories.length === 0
+            ? "(nothing)"
+            : detail.repositories.join(", ")}`);
+    }
+    if (detail.lastError !== null && detail.lastError !== undefined) {
+        lines.push(`  last error:   ${sanitizeCustomerError(detail.lastError)}`);
+    }
+    ctx.out(`${lines.join("\n")}\n`);
+}
 // ============================================================================
 // stop <slug>
 // ============================================================================
@@ -1389,10 +1458,35 @@ function pollUntil(ctx, slug, terminal, fetchDetail) {
             }
         };
         for (;;) {
-            const detail = yield fetchDetail().catch((error) => {
+            let detail;
+            try {
+                detail = yield fetchDetail();
+            }
+            catch (error) {
+                // Capacity / rate-limit on GET is not a bake failure. The v2 accept
+                // already started freeze; keep polling until the wait budget expires.
+                if (isTransientDeployStatusError(error) &&
+                    Date.now() - startedAt < ctx.timeoutMs) {
+                    if (!ctx.json) {
+                        const elapsed = Math.round((Date.now() - startedAt) / 1000);
+                        const label = "Waiting for status (server busy)";
+                        if (tty) {
+                            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+                            sawProgress = true;
+                        }
+                        else if (label !== lastLabel) {
+                            ctx.err(`${slug}: ${label}\n`);
+                        }
+                        lastLabel = label;
+                    }
+                    const waitMs = transientDeployStatusWaitMs(error, ctx.pollIntervalMs);
+                    const remaining = ctx.timeoutMs - (Date.now() - startedAt);
+                    yield sleep(Math.max(0, Math.min(waitMs, remaining)));
+                    continue;
+                }
                 finishProgressLine();
                 throw error;
-            });
+            }
             report(detail);
             if (terminal.has(detail.status)) {
                 finishProgressLine();
@@ -1407,6 +1501,19 @@ function pollUntil(ctx, slug, terminal, fetchDetail) {
         }
     });
 }
+/** Load-shed / rate-limit on status GET — the deploy itself may still be baking. */
+function isTransientDeployStatusError(error) {
+    return (error instanceof DeployApiError &&
+        (error.status === 503 || error.status === 429));
+}
+function transientDeployStatusWaitMs(error, pollIntervalMs) {
+    if (error.status === 429 &&
+        error.retryAfterSeconds !== undefined &&
+        error.retryAfterSeconds > 0) {
+        return Math.max(pollIntervalMs, error.retryAfterSeconds * 1000);
+    }
+    return pollIntervalMs;
+}
 /**
  * Wait until GET 404s (the delete reconciler purged the record). Treats
  * other errors as failures. Throws DeployApiError on timeout.
@@ -1462,9 +1569,30 @@ function aliasTokenBlock(aliasToken) {
         `  or paste it into the hosted playground (<alias>/playground) sign-in gate.\n` +
         `  Lost tokens: \`${CLI} rotate-token <slug>\` mints a replacement.\n\n`);
 }
-function renderApiError(error, err) {
+/**
+ * `: <reason>` suffix for a deploy that ended in a non-running state, or
+ * empty when the control plane recorded no reason.
+ */
+function deployFailureDetail(lastError) {
+    if (lastError === null ||
+        lastError === undefined ||
+        lastError.trim() === "") {
+        return "";
+    }
+    return `: ${sanitizeCustomerError(lastError.trim())}`;
+}
+function renderApiError(error, err, context) {
     if (error instanceof DeployApiError) {
         err(`${error.message}\n`);
+        if (error.status === 409 &&
+            error.message.includes("application multiTenant does not match")) {
+            if ((context === null || context === void 0 ? void 0 : context.multiTenant) === true) {
+                err("This slug is a single-tenant application. Redeploy it without --multi-tenant.\n");
+            }
+            else if ((context === null || context === void 0 ? void 0 : context.teamId) === MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+                err("This slug is a Cursor-managed (multi-tenant) product. Redeploy it with --multi-tenant.\n");
+            }
+        }
         return 1;
     }
     throw error;

package/dist/internal/cli-mcp-oauth.js

@@ -27,7 +27,8 @@ import { authorizeCursorAccountConnectors } from "./cursor-account-mcp-auth.js";
 import { deploymentServiceAccountId } from "./deploy-client.js";
 import { loadAgentProject } from "./discovery.js";
 import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
-import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, mcpOauthSecretNames, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
+import { createHostMcpOAuthProvider, MCP_OAUTH_CALLBACK_URL, openBrowser, waitForMcpOAuthCallback, } from "./mcp-oauth.js";
+import { upsertHostMcpOauthSecrets } from "./mcp-oauth-persist.js";
 import { resolveProdSlug } from "./resolve-prod-target.js";
 function describe(error) {
     if (!(error instanceof Error)) {
@@ -287,25 +288,14 @@ function storeOauthSecrets(args) {
         if (typeof auth === "number") {
             return auth;
         }
-        const names = mcpOauthSecretNames(args.connection);
-        const secrets = [
-            { name: names.accessToken, value: tokens.access_token },
-        ];
-        if (tokens.refresh_token !== undefined &&
-            tokens.refresh_token.trim() !== "") {
-            secrets.push({ name: names.refreshToken, value: tokens.refresh_token });
-        }
-        if (args.clientId !== undefined && args.clientId.trim() !== "") {
-            secrets.push({ name: names.clientId, value: args.clientId });
-        }
         try {
-            const secretNames = yield auth.client.setSecrets({
-                teamId: auth.teamId,
-                slug,
-                secrets,
+            const secretNames = yield upsertHostMcpOauthSecrets({
+                connection: args.connection,
+                tokens,
+                clientId: args.clientId,
+                target: { client: auth.client, teamId: auth.teamId, slug },
             });
-            args.out(`${LOG_PREFIX} Stored on ${slug}: ${secrets.map((s) => s.name).join(", ")}.\n` +
-                `${LOG_PREFIX} Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
+            args.out(`${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`);
             return 0;
         }
         catch (error) {

package/dist/internal/cli-slack-manual.d.ts

@@ -1,6 +1,8 @@
 /**
- * `slack init --manual` and `slack manifest` — DIY paste-at-api.slack.com.
- * Create/destroy/icon stay in `cli-slack.ts`.
+ * `slack init --manual` and `slack manifest` — unmanaged Slack app.
+ * Slack CLI create+install when `~/.slack/bin/slack` is present;
+ * paste-at-api.slack.com is the fallback. Create/destroy/icon stay
+ * in `cli-slack.ts`.
  */
 export interface SlackManualCliOptions {
     dir: string;
@@ -12,9 +14,29 @@ export interface SlackManualCliOptions {
     channelPosts?: boolean;
     /** Gate for `slack init`; ignored by `slack manifest`. */
     manual?: boolean;
+    /** Require Slack CLI install (fail if missing or install fails). */
+    install?: boolean;
+    /** Skip Slack CLI install even when the CLI is present. */
+    noInstall?: boolean;
+    slackTeam?: string;
+    prod?: boolean;
+    detectSlackCli?: () => string | undefined;
+    runSlackCli?: SlackCliExec;
     out?: (text: string) => void;
     err?: (text: string) => void;
 }
+export interface SlackCliExecRequest {
+    bin: string;
+    argv: string[];
+    cwd: string;
+    env?: NodeJS.ProcessEnv;
+}
+export interface SlackCliExecResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type SlackCliExec = (request: SlackCliExecRequest) => Promise<SlackCliExecResult>;
 export declare function cmdSlackInit(options: SlackManualCliOptions): Promise<number>;
 export declare function runSlackManifest(options: SlackManualCliOptions): Promise<number>;
 //# sourceMappingURL=cli-slack-manual.d.ts.map

package/dist/internal/cli-slack-manual.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-slack-manual.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack-manual.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAMD,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAuDjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAgCjB"}
+{"version":3,"file":"cli-slack-manual.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack-manual.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oEAAoE;IACpE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAC1C,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,mBAAmB,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAoGjC,wBAAsB,YAAY,CAChC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAgCjB"}