@cursor/july 0.1.96 → 0.1.99

package/dist/internal/init-project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAkBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAkCrC"}
+{"version":3,"file":"init-project.d.ts","sourceRoot":"","sources":["../../src/internal/init-project.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,qBAAqB,CAAC;AAQ7B,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qDAAqD;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAmBD,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAyBhE;AAWD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,eAAe,CAgCjB;AAUD,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA6E5B;AAwDD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAWD,MAAM,WAAW,kCAAkC;IACjD;;;OAGG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,yDAAyD;IACzD,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,iCAAiC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,iCAAiC,CAAC,CAW5C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,gEAAgE;IAChE,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAwHD,MAAM,WAAW,0BAA0B;IACzC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAAG,0BAA0B,GACzD,oBAAoB,CAAC;AAMvB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,0BAA0B,GAClC,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAgBzE;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAQpB;AA8BD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB,GAAG,MAAM,EAAE,CAEX;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,IAAI,CAmCrC"}

package/dist/internal/init-project.js

@@ -22,6 +22,7 @@ import { agentsMd, GITIGNORE, writeDefaultScaffold } from "./init-scaffold.js";
 import { makePalette, stdoutPalette, } from "./terminal-style.js";
 const TEMPLATES = {
     "agentic-owners": { dir: "agentic-owners" },
+    "agents-md": { dir: "agents-md" },
     "code-wiki": { dir: "code-wiki" },
     demo: { dir: "demo" },
     "pr-autofixer": { dir: "pr-autofixer" },
@@ -499,6 +500,7 @@ Scaffold a project, then open the playground:
   npx ${PACKAGE_NAME} init ./my-agent   # installs deps + links agent-sdk onto PATH
   npx ${PACKAGE_NAME} init ./my-demo --template demo              # record a PR walkthrough
   npx ${PACKAGE_NAME} init ./code-wiki --template code-wiki       # keep wiki pages current after merge
+  npx ${PACKAGE_NAME} init ./agents-md --template agents-md       # keep AGENTS.md current from last week's PRs and Slack
   npx ${PACKAGE_NAME} init ./my-reviewer --template security-reviewer   # review PRs for security bugs
   npx ${PACKAGE_NAME} init ./security-help --template security-help   # answer security questions in Slack
   npx ${PACKAGE_NAME} init ./my-triage --template triage-linear   # comment on Linear issues

package/dist/internal/logs-client.d.ts

@@ -26,6 +26,11 @@ export declare function sanitizeCustomerError(message: string): string;
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export declare function deployProgressLabel(detail: {
     status: string;

package/dist/internal/logs-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}
+{"version":3,"file":"logs-client.d.ts","sourceRoot":"","sources":["../../src/internal/logs-client.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAW7E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,YAAY,GACpB,kBAAkB,GAClB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,UAAU,GACV,UAAU,GACV,YAAY,GACZ,SAAS,GACT,QAAQ,GACR,UAAU,GACV,SAAS,GACT,UAAU,GACV,UAAU,CAAC;AAiBf;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,YAAY,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,MAAM,CAuBR;AAED,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B,GAAG,MAAM,CAiBT;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CA0BxB;AAED,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,iCAAiC;IACjC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChD,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoC5E"}

package/dist/internal/logs-client.js

@@ -78,6 +78,11 @@ export function sanitizeCustomerError(message) {
 /**
  * One-line label for `agent-sdk deploy` polling (TTY spinner / non-TTY
  * transitions). Uses statusMessage → progress → raw status.
+ *
+ * Deliberately does NOT include `lastError`. The spinner redraws with
+ * `\r\x1b[2K`, which clears one physical row, so a reason long enough to
+ * soft-wrap would leave the earlier rows on screen. Callers print the
+ * reason once on the final line instead.
  */
 export function deployProgressLabel(detail) {
     if (detail.statusMessage !== null &&

package/dist/internal/mcp-endpoint.js

@@ -200,7 +200,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         if (reason !== undefined) {
             throw new Error(reason);
         }
-        const tools = yield engine.host.mcp.listTools(connectionName);
+        const tools = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", "tools/list", () => engine.host.mcp.listTools(connectionName));
         return {
             tools: tools.map((tool) => { var _a; return (Object.assign(Object.assign(Object.assign(Object.assign({ name: tool.name }, (tool.description === undefined
                 ? {}
@@ -212,7 +212,6 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
         };
     }));
     server.setRequestHandler(CallToolRequestSchema, (request) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
         const reason = rejected();
         if (reason !== undefined) {
             return errorResult(reason);
@@ -228,7 +227,7 @@ function buildConnectionBridgeMcpServer(engine, sessionId, connectionName) {
             return sdkResultToMcpResult(answer.result);
         }
         try {
-            const result = yield engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {});
+            const result = yield engine.runWithMcpPark(sessionId !== null && sessionId !== void 0 ? sessionId : "", request.params.name, () => { var _a; return engine.host.mcp.callTool(connectionName, request.params.name, (_a = request.params.arguments) !== null && _a !== void 0 ? _a : {}); });
             return Object.assign(Object.assign({ 
                 // The host client already speaks MCP, so the content array is valid
                 // CallToolResult content; HostMcpCallResult just types the tail of

package/dist/internal/mcp-host.d.ts

@@ -10,6 +10,12 @@
  * and stay on `host.mcp` plus `mcp oauth`.
  */
 import type { DiscoveredConnection, HostMcpCallResult, HostMcpRegistry, HostMcpToolInfo, McpToolAnnotations } from "../types.js";
+export declare class McpNeedsAuthError extends Error {
+    readonly connection: string;
+    constructor(connection: string, cause?: unknown);
+}
+export declare function isMcpNeedsAuthError(error: unknown): error is McpNeedsAuthError;
+export declare function hostMcpCallNeedsAuth(result: HostMcpCallResult): boolean;
 /**
  * A non-caching view of one connection: every operation opens a fresh
  * client and closes it afterwards. See {@link McpHost.oneOff}.
@@ -21,7 +27,10 @@ export interface HostMcpOneOff {
 export declare class McpHost implements HostMcpRegistry {
     private readonly byName;
     private readonly clients;
+    private oauthRedirectUrl;
     constructor(connections: DiscoveredConnection[]);
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url: string): void;
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -40,6 +49,7 @@ export declare class McpHost implements HostMcpRegistry {
      */
     oneOff(connection: DiscoveredConnection): HostMcpOneOff;
     callTool(connectionName: string, toolName: string, args?: Record<string, unknown>): Promise<HostMcpCallResult>;
+    dropClient(name: string): Promise<void>;
     close(): Promise<void>;
     /**
      * Run against a cached host MCP client, reconnecting once when the remote

package/dist/internal/mcp-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AASrB;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IAExE,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA0BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}
+{"version":3,"file":"mcp-host.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,eAAe,EAEf,kBAAkB,EACnB,MAAM,aAAa,CAAC;AAIrB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAS9C;CACF;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iBAAiB,CAE5B;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAQvE;AAiBD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IACxC,QAAQ,CACN,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,qBAAa,OAAQ,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgD;IACxE,OAAO,CAAC,gBAAgB,CAAqB;IAE7C,YAAY,WAAW,EAAE,oBAAoB,EAAE,EAI9C;IAED,gFAAgF;IAChF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAErC;IAED;;;OAGG;IACH,aAAa,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI,CAEpD;IAED,KAAK,IAAI,MAAM,EAAE,CAEhB;IAEK,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAKlE;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,UAAU,EAAE,oBAAoB,GAAG,aAAa,CA8BtD;IAEK,QAAQ,CACZ,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B;IAEK,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5C;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;IAED;;;;;;;;OAQG;YACW,UAAU;IAiBxB,OAAO,CAAC,SAAS;YAYH,gBAAgB;YAiBhB,OAAO;CAUtB;AAED,+BAA+B;AAC/B,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU9D;AAKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,GACnB,kBAAkB,GAAG,SAAS,CAyBhC"}

package/dist/internal/mcp-host.js

@@ -25,6 +25,34 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { CLI_COMMAND_NAME as CLI } from "./distribution.js";
 import { createHostMcpOAuthProvider } from "./mcp-oauth.js";
+export class McpNeedsAuthError extends Error {
+    constructor(connection, cause) {
+        super(`MCP connection "${connection}" needs authorization. Run \`${CLI} mcp oauth ${connection}\`.`);
+        this.name = "McpNeedsAuthError";
+        this.connection = connection;
+        if (cause !== undefined) {
+            this.cause = cause;
+        }
+    }
+}
+export function isMcpNeedsAuthError(error) {
+    return error instanceof McpNeedsAuthError;
+}
+export function hostMcpCallNeedsAuth(result) {
+    if (result.isError !== true) {
+        return false;
+    }
+    const text = result.content
+        .map((part) => (part.type === "text" ? part.text : ""))
+        .join("\n");
+    return text.includes("needsAuth") || text.includes("needs authorization");
+}
+function throwIfCallNeedsAuth(connection, result) {
+    if (hostMcpCallNeedsAuth(result)) {
+        throw new McpNeedsAuthError(connection);
+    }
+    return result;
+}
 export class McpHost {
     constructor(connections) {
         this.byName = new Map();
@@ -33,6 +61,10 @@ export class McpHost {
             this.byName.set(connection.name, connection);
         }
     }
+    /** Public serve callback for host OAuth (not the CLI loopback port on pods). */
+    setOAuthRedirectUrl(url) {
+        this.oauthRedirectUrl = url;
+    }
     /**
      * Register a connection after construction (serve-time resolved peers).
      * Clients open lazily on first use, so adding before first call is safe.
@@ -61,8 +93,9 @@ export class McpHost {
      * mapping as registry calls.
      */
     oneOff(connection) {
+        const redirectUrl = this.oauthRedirectUrl;
         const withFreshClient = (run) => __awaiter(this, void 0, void 0, function* () {
-            const opened = yield openConnection(connection);
+            const opened = yield openConnection(connection, redirectUrl);
             try {
                 return yield run(opened.client);
             }
@@ -80,7 +113,7 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connection.name, normalizeCallResult(result));
             })),
         };
     }
@@ -91,10 +124,25 @@ export class McpHost {
                     name: toolName,
                     arguments: args,
                 });
-                return normalizeCallResult(result);
+                return throwIfCallNeedsAuth(connectionName, normalizeCallResult(result));
             }));
         });
     }
+    dropClient(name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const pending = this.clients.get(name);
+            this.clients.delete(name);
+            if (pending === undefined) {
+                return;
+            }
+            try {
+                yield (yield pending).close();
+            }
+            catch (_a) {
+                // Best-effort teardown.
+            }
+        });
+    }
     close() {
         return __awaiter(this, void 0, void 0, function* () {
             const opened = yield Promise.allSettled([...this.clients.values()]);
@@ -165,7 +213,7 @@ export class McpHost {
                 const known = this.names().join(", ") || "(none)";
                 throw new Error(`Unknown MCP connection "${name}". Authored MCP connections: ${known}.`);
             }
-            return openConnection(connection);
+            return openConnection(connection, this.oauthRedirectUrl);
         });
     }
 }
@@ -229,20 +277,20 @@ function toToolInfo(tool) {
         ? {}
         : { outputSchema: tool.outputSchema })), (annotations === undefined ? {} : { annotations }));
 }
-function openConnection(connection) {
+function openConnection(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         const client = new Client({
             name: "agent-serve",
             version: "0.1.0",
         });
-        const transport = yield createTransport(connection);
+        const transport = yield createTransport(connection, oauthRedirectUrl);
         try {
             yield client.connect(transport);
         }
         catch (error) {
             if (error instanceof UnauthorizedError &&
                 isOauthHttpTransport(connection.transport)) {
-                throw new Error(`MCP connection "${connection.name}" needs authorization. Run \`${CLI} mcp oauth ${connection.name}\`.`, { cause: error });
+                throw new McpNeedsAuthError(connection.name, error);
             }
             throw error;
         }
@@ -266,7 +314,7 @@ function openConnection(connection) {
         };
     });
 }
-function createTransport(connection) {
+function createTransport(connection, oauthRedirectUrl) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const transport = connection.transport;
@@ -292,6 +340,7 @@ function createTransport(connection) {
             ? yield createHostMcpOAuthProvider({
                 identifier: connection.name,
                 resourceUrl: transport.url,
+                redirectUrl: oauthRedirectUrl,
             })
             : undefined;
         if (transport.type === "sse") {

package/dist/internal/mcp-oauth-on-demand.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Mid-run host MCP OAuth: mint an authUrl, finish on the public serve
+ * callback (file tokens). Deployment secrets persist from the
+ * authenticated park, not from that callback.
+ *
+ * CLI `mcp oauth` still uses the loopback callback. This path is recovery
+ * and first-use without a separate `--store` step.
+ */
+import { FileMcpOAuthStore } from "./mcp-oauth.js";
+import { type McpOauthSecretsTarget, type ResolveHostedMcpOauthSecretsArgs } from "./mcp-oauth-persist.js";
+export declare function mcpOauthServeCallbackPath(basePath?: string): string;
+export declare function mcpOauthServeCallbackUrl(origin: string, basePath?: string): string;
+export type BeginHostMcpOauthResult = {
+    status: "authorized";
+} | {
+    status: "needs_auth";
+    authUrl: string;
+    state: string;
+    finish: (code: string) => Promise<void>;
+    abort: () => Promise<void>;
+};
+export declare function beginHostMcpOauth(args: {
+    connection: string;
+    url: string;
+    type?: "http" | "sse";
+    headers?: Record<string, string>;
+    redirectUrl: string;
+    store?: FileMcpOAuthStore;
+}): Promise<BeginHostMcpOauthResult>;
+export type McpOauthCompleteResult = {
+    connection: string;
+    sessionId?: string;
+    callId?: string;
+};
+export declare class McpOauthOnDemandHub {
+    private readonly attempts;
+    private readonly completed;
+    private readonly finishing;
+    private readonly aborted;
+    callbackUrl: string | undefined;
+    secrets?: McpOauthSecretsTarget;
+    secretsBind?: ResolveHostedMcpOauthSecretsArgs;
+    logger?: (line: string) => void;
+    private store?;
+    mint(args: {
+        connection: string;
+        url: string;
+        type?: "http" | "sse";
+        headers?: Record<string, string>;
+        sessionId?: string;
+    }): Promise<{
+        authUrl: string;
+        state: string;
+    } | {
+        authorized: true;
+    }>;
+    abortCall(sessionId: string, callId: string): Promise<void>;
+    abortSession(sessionId: string): Promise<void>;
+    close(): Promise<void>;
+    private dropWhere;
+    bind(state: string, sessionId: string, callId: string): "pending" | "already_done" | "unknown";
+    complete(state: string, code: string): Promise<McpOauthCompleteResult>;
+    private finishAttempt;
+    private fileStore;
+    persistFor(connection: string, resourceUrl: string): Promise<void>;
+    handleCallback(request: Request): Promise<Response>;
+}
+//# sourceMappingURL=mcp-oauth-on-demand.d.ts.map

package/dist/internal/mcp-oauth-on-demand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-on-demand.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth-on-demand.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EAEL,iBAAiB,EAElB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,EAGtC,MAAM,wBAAwB,CAAC;AAEhC,wBAAgB,yBAAyB,CAAC,QAAQ,SAAK,GAAG,MAAM,CAE/D;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,SAAK,GACZ,MAAM,CAER;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEN,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoEnC;AAWD,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmC;IAC7D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAGtB;IACJ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAEhC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IAC/C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAoB;IAE5B,IAAI,CAAC,IAAI,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,UAAU,EAAE,IAAI,CAAA;KAAE,CAAC,CAsBrE;IAEK,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAEK,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnD;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAE3B;YAEa,SAAS;IAyBvB,IAAI,CACF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,cAAc,GAAG,SAAS,CAcxC;IAEK,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAe3E;YAEa,aAAa;IAqB3B,OAAO,CAAC,SAAS;IAKX,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BvE;IAEK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyBxD;CACF"}

package/dist/internal/mcp-oauth-on-demand.js

@@ -0,0 +1,287 @@
+/**
+ * Mid-run host MCP OAuth: mint an authUrl, finish on the public serve
+ * callback (file tokens). Deployment secrets persist from the
+ * authenticated park, not from that callback.
+ *
+ * CLI `mcp oauth` still uses the loopback callback. This path is recovery
+ * and first-use without a separate `--store` step.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { describeError } from "./describe-error.js";
+import { LOG_PREFIX } from "./distribution.js";
+import { createHostMcpOAuthProvider, FileMcpOAuthStore, MCP_OAUTH_CALLBACK_URL, } from "./mcp-oauth.js";
+import { resolveHostedMcpOauthSecretsTarget, upsertHostMcpOauthSecrets, } from "./mcp-oauth-persist.js";
+export function mcpOauthServeCallbackPath(basePath = "") {
+    return `${basePath}/v1/mcp-oauth/callback`;
+}
+export function mcpOauthServeCallbackUrl(origin, basePath = "") {
+    return `${origin.replace(/\/$/, "")}${mcpOauthServeCallbackPath(basePath)}`;
+}
+export function beginHostMcpOauth(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        let authorizationUrl;
+        const provider = yield createHostMcpOAuthProvider({
+            identifier: args.connection,
+            resourceUrl: args.url,
+            store: args.store,
+            redirectUrl: args.redirectUrl,
+            onRedirect: (url) => {
+                authorizationUrl = url;
+            },
+        });
+        const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
+        const url = new URL(args.url);
+        const requestInit = args.headers === undefined ? undefined : { headers: args.headers };
+        const makeTransport = () => {
+            if (args.type === "sse") {
+                return new SSEClientTransport(url, {
+                    authProvider: provider,
+                    requestInit,
+                });
+            }
+            return new StreamableHTTPClientTransport(url, {
+                authProvider: provider,
+                requestInit,
+            });
+        };
+        const transport = makeTransport();
+        try {
+            yield client.connect(transport);
+            yield client.close().catch(() => undefined);
+            return { status: "authorized" };
+        }
+        catch (error) {
+            if (!(error instanceof UnauthorizedError)) {
+                throw error;
+            }
+        }
+        const redirect = authorizationUrl !== null && authorizationUrl !== void 0 ? authorizationUrl : provider.lastRedirectUrl;
+        if (redirect === undefined) {
+            throw new Error(`Auth required for "${args.connection}" but no authorization URL was provided.`);
+        }
+        const state = (_a = redirect.searchParams.get("state")) !== null && _a !== void 0 ? _a : "";
+        if (state === "") {
+            throw new Error(`Auth required for "${args.connection}" but the authorization URL had no state.`);
+        }
+        return {
+            status: "needs_auth",
+            authUrl: redirect.toString(),
+            state,
+            finish: (code) => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                yield transport.finishAuth(code);
+                yield (_a = transport.close) === null || _a === void 0 ? void 0 : _a.call(transport).catch(() => undefined);
+            }),
+            abort: () => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                yield (_a = transport.close) === null || _a === void 0 ? void 0 : _a.call(transport).catch(() => undefined);
+            }),
+        };
+    });
+}
+export class McpOauthOnDemandHub {
+    constructor() {
+        this.attempts = new Map();
+        this.completed = new Map();
+        this.finishing = new Map();
+        this.aborted = new Set();
+    }
+    mint(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const redirectUrl = (_a = this.callbackUrl) !== null && _a !== void 0 ? _a : MCP_OAUTH_CALLBACK_URL;
+            const store = this.fileStore();
+            const started = yield beginHostMcpOauth({
+                connection: args.connection,
+                url: args.url,
+                type: args.type,
+                headers: args.headers,
+                redirectUrl,
+                store,
+            });
+            if (started.status === "authorized") {
+                return { authorized: true };
+            }
+            this.attempts.set(started.state, {
+                connection: args.connection,
+                resourceUrl: args.url,
+                finish: started.finish,
+                abort: started.abort,
+                sessionId: args.sessionId,
+            });
+            return { authUrl: started.authUrl, state: started.state };
+        });
+    }
+    abortCall(sessionId, callId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere((attempt) => attempt.sessionId === sessionId && attempt.callId === callId, true);
+        });
+    }
+    abortSession(sessionId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere((attempt) => attempt.sessionId === sessionId, false);
+        });
+    }
+    close() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.dropWhere(() => true, true);
+        });
+    }
+    dropWhere(match, includeCompleted) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const jobs = [];
+            for (const [state, attempt] of this.attempts) {
+                if (!match(attempt)) {
+                    continue;
+                }
+                this.aborted.add(state);
+                this.attempts.delete(state);
+                jobs.push(attempt.abort().catch(() => undefined));
+            }
+            if (includeCompleted) {
+                for (const [state, attempt] of this.completed) {
+                    if (!match(attempt)) {
+                        continue;
+                    }
+                    this.aborted.add(state);
+                    this.completed.delete(state);
+                }
+            }
+            yield Promise.all(jobs);
+        });
+    }
+    bind(state, sessionId, callId) {
+        const live = this.attempts.get(state);
+        if (live !== undefined) {
+            live.sessionId = sessionId;
+            live.callId = callId;
+            return "pending";
+        }
+        const done = this.completed.get(state);
+        if (done !== undefined) {
+            done.sessionId = sessionId;
+            done.callId = callId;
+            return "already_done";
+        }
+        return "unknown";
+    }
+    complete(state, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.aborted.has(state)) {
+                throw new Error("Unknown OAuth state.");
+            }
+            const pending = this.finishing.get(state);
+            if (pending !== undefined) {
+                return yield pending;
+            }
+            const attempt = this.attempts.get(state);
+            if (attempt === undefined) {
+                throw new Error("Unknown OAuth state.");
+            }
+            const run = this.finishAttempt(state, attempt, code);
+            this.finishing.set(state, run);
+            return yield run;
+        });
+    }
+    finishAttempt(state, attempt, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield attempt.finish(code);
+                this.attempts.delete(state);
+                if (!this.aborted.has(state)) {
+                    this.completed.set(state, attempt);
+                }
+                return {
+                    connection: attempt.connection,
+                    sessionId: attempt.sessionId,
+                    callId: attempt.callId,
+                };
+            }
+            finally {
+                this.finishing.delete(state);
+            }
+        });
+    }
+    fileStore() {
+        var _a;
+        (_a = this.store) !== null && _a !== void 0 ? _a : (this.store = new FileMcpOAuthStore());
+        return this.store;
+    }
+    persistFor(connection, resourceUrl) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            var _c, _d;
+            const target = (_c = this.secrets) !== null && _c !== void 0 ? _c : resolveHostedMcpOauthSecretsTarget((_d = this.secretsBind) !== null && _d !== void 0 ? _d : {});
+            if (target === undefined) {
+                return;
+            }
+            const store = this.fileStore();
+            const tokens = yield store.loadTokens(connection, resourceUrl);
+            if (tokens === undefined || tokens.access_token.trim() === "") {
+                return;
+            }
+            const client = yield store.loadClientInformation(connection, resourceUrl);
+            try {
+                const names = yield upsertHostMcpOauthSecrets({
+                    connection,
+                    tokens,
+                    clientId: client === null || client === void 0 ? void 0 : client.client_id,
+                    target,
+                });
+                (_a = this.logger) === null || _a === void 0 ? void 0 : _a.call(this, `${LOG_PREFIX} MCP OAuth tokens stored on the deployment (${names.join(", ")}).`);
+            }
+            catch (error) {
+                (_b = this.logger) === null || _b === void 0 ? void 0 : _b.call(this, `${LOG_PREFIX} MCP OAuth persist failed for "${connection}": ${describeError(error)}`);
+            }
+        });
+    }
+    handleCallback(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const url = new URL(request.url);
+            const code = url.searchParams.get("code");
+            const state = (_a = url.searchParams.get("state")) !== null && _a !== void 0 ? _a : "";
+            if (this.aborted.has(state)) {
+                return oauthHtml(404, "<h1>Not found</h1>");
+            }
+            if (this.completed.has(state)) {
+                return oauthHtml(200, "<h1>Authorized</h1><p>Return to the agent.</p>");
+            }
+            if (!this.attempts.has(state)) {
+                return oauthHtml(404, "<h1>Not found</h1>");
+            }
+            if (code !== null && code !== "") {
+                try {
+                    yield this.complete(state, code);
+                }
+                catch (_b) {
+                    return oauthHtml(400, "<h1>Authorization failed</h1>");
+                }
+                if (this.aborted.has(state)) {
+                    return oauthHtml(404, "<h1>Not found</h1>");
+                }
+                return oauthHtml(200, "<h1>Authorized</h1><p>Return to the agent.</p>");
+            }
+            return oauthHtml(400, "<h1>Authorization failed</h1>");
+        });
+    }
+}
+function oauthHtml(status, body) {
+    return new Response(`<!doctype html><html><body>${body}</body></html>`, {
+        status,
+        headers: { "content-type": "text/html; charset=utf-8" },
+    });
+}