@cursor/july 0.1.96 → 0.1.99

package/dist/internal/mcp-oauth-persist.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Deployment-secret upsert for host MCP OAuth (`mcp oauth --store` and
+ * hosted Connect). File writes stay on FileMcpOAuthStore / the OAuth
+ * provider. Resolve the `--store` client at persist time so v2 freeze
+ * bind can drop the key after listen.
+ */
+import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+export type McpOauthSecretsClient = {
+    setSecrets(args: {
+        teamId: number;
+        slug: string;
+        secrets: Array<{
+            name: string;
+            value: string;
+        }>;
+    }): Promise<string[]>;
+};
+export type McpOauthSecretsTarget = {
+    client: McpOauthSecretsClient;
+    teamId: number;
+    slug: string;
+};
+export declare function upsertHostMcpOauthSecrets(args: {
+    connection: string;
+    tokens: OAuthTokens;
+    clientId?: string;
+    target: McpOauthSecretsTarget;
+}): Promise<string[]>;
+export type ResolveHostedMcpOauthSecretsArgs = {
+    slug?: string;
+    team?: string;
+    apiKey?: string;
+    cloudToolsUrl?: string;
+    env?: NodeJS.ProcessEnv;
+};
+/**
+ * Bind the CLI `--store` client when this process is a hosted engine
+ * (`AGENT_SERVE_DEPLOYMENT_ID`) and a live API key is present.
+ * Self-hosted / no deployment / unsigned: undefined.
+ */
+export declare function resolveHostedMcpOauthSecretsTarget(args?: ResolveHostedMcpOauthSecretsArgs): McpOauthSecretsTarget | undefined;
+//# sourceMappingURL=mcp-oauth-persist.d.ts.map

package/dist/internal/mcp-oauth-persist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-oauth-persist.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth-persist.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAY5E,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,CAAC,IAAI,EAAE;QACf,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAsBF,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,qBAAqB,CAAC;CAC/B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAUpB;AAED,MAAM,MAAM,gCAAgC,GAAG;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,GAAE,gCAAqC,GAC1C,qBAAqB,GAAG,SAAS,CA8BnC"}

package/dist/internal/mcp-oauth-persist.js

@@ -0,0 +1,92 @@
+/**
+ * Deployment-secret upsert for host MCP OAuth (`mcp oauth --store` and
+ * hosted Connect). File writes stay on FileMcpOAuthStore / the OAuth
+ * provider. Resolve the `--store` client at persist time so v2 freeze
+ * bind can drop the key after listen.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { AGENT_SERVE_DEPLOYMENT_ID_ENV_VAR } from "../storage-backends/cursor-hosted.js";
+import { cursorExternalApiUrl, resolveApiKeySync, } from "./cursor/credentials.js";
+import { AgentServeDeployClient, parseAgentServeMcpGatewayUrl, } from "./deploy-client.js";
+import { mcpOauthSecretNames } from "./mcp-oauth.js";
+function mcpOauthSecretsPayload(args) {
+    var _a, _b;
+    const names = mcpOauthSecretNames(args.connection);
+    const secrets = [
+        { name: names.accessToken, value: args.tokens.access_token },
+    ];
+    const refresh = (_a = args.tokens.refresh_token) === null || _a === void 0 ? void 0 : _a.trim();
+    if (refresh !== undefined && refresh !== "") {
+        secrets.push({ name: names.refreshToken, value: refresh });
+    }
+    const clientId = (_b = args.clientId) === null || _b === void 0 ? void 0 : _b.trim();
+    if (clientId !== undefined && clientId !== "") {
+        secrets.push({ name: names.clientId, value: clientId });
+    }
+    return secrets;
+}
+export function upsertHostMcpOauthSecrets(args) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const payload = mcpOauthSecretsPayload(args);
+        if (payload.length === 0) {
+            return [];
+        }
+        return yield args.target.client.setSecrets({
+            teamId: args.target.teamId,
+            slug: args.target.slug,
+            secrets: payload,
+        });
+    });
+}
+/**
+ * Bind the CLI `--store` client when this process is a hosted engine
+ * (`AGENT_SERVE_DEPLOYMENT_ID`) and a live API key is present.
+ * Self-hosted / no deployment / unsigned: undefined.
+ */
+export function resolveHostedMcpOauthSecretsTarget(args = {}) {
+    var _a;
+    var _b, _c;
+    const env = (_b = args.env) !== null && _b !== void 0 ? _b : process.env;
+    const deploymentId = (_a = env[AGENT_SERVE_DEPLOYMENT_ID_ENV_VAR]) === null || _a === void 0 ? void 0 : _a.trim();
+    if (deploymentId === undefined || deploymentId === "") {
+        return undefined;
+    }
+    const resolved = resolveApiKeySync(args.apiKey === undefined ? undefined : { apiKey: args.apiKey });
+    if (resolved === undefined) {
+        return undefined;
+    }
+    const fromUrl = args.cloudToolsUrl === undefined
+        ? undefined
+        : parseAgentServeMcpGatewayUrl(args.cloudToolsUrl);
+    const slug = args.slug !== undefined && args.slug !== "" ? args.slug : fromUrl === null || fromUrl === void 0 ? void 0 : fromUrl.slug;
+    const teamId = (_c = parseTeamId(args.team)) !== null && _c !== void 0 ? _c : fromUrl === null || fromUrl === void 0 ? void 0 : fromUrl.teamId;
+    if (slug === undefined || teamId === undefined) {
+        return undefined;
+    }
+    return {
+        client: new AgentServeDeployClient({
+            backendUrl: cursorExternalApiUrl(),
+            apiKey: resolved.apiKey,
+        }),
+        teamId,
+        slug,
+    };
+}
+function parseTeamId(team) {
+    if (team === undefined || team === "") {
+        return undefined;
+    }
+    const teamId = Number.parseInt(team, 10);
+    if (!Number.isInteger(teamId) || teamId <= 0) {
+        return undefined;
+    }
+    return teamId;
+}

package/dist/internal/mcp-oauth.d.ts

@@ -95,6 +95,7 @@ export declare function createHostMcpOAuthProvider(args: {
     resourceUrl: string;
     store?: FileMcpOAuthStore;
     onRedirect?: (url: URL) => void;
+    redirectUrl?: string;
 }): Promise<HostMcpOAuthProvider>;
 export type OAuthCallbackResult = {
     code: string;

package/dist/internal/mcp-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAE3E,YAAY,IAAI,EAAE,YAAY,EAc7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAED,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgBhC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}
+{"version":3,"file":"mcp-oauth.d.ts","sourceRoot":"","sources":["../../src/internal/mcp-oauth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACZ,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,uBAAuB,cAAc,CAAC;AACnD,eAAO,MAAM,sBAAsB,EAAE,MAAgF,CAAC;AAEtH,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAO3E;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,WAAW,GAAG,SAAS,CAazB;AAED,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,GAAG,SAAS,CASxC;AAaD,oEAAoE;AACpE,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,4EAA4E;AAC5E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgB3D;AAED,qBAAa,iBAAiB;IAIhB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHjC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,OAAO,CAAgC;IAE/C,YAAqB,IAAI,GAAE,MAA6B,EAAI;IAEtD,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAElC;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAEjD;IAEK,UAAU,CACd,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,qBAAqB,CACzB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC,CAIf;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;YAEa,QAAQ;YAeR,MAAM;YAkBN,IAAI;YAWJ,QAAQ;YAoBR,KAAK;YASL,QAAQ;CAgBvB;AAED,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED,qBAAa,oBAAqB,YAAW,mBAAmB;IAC9D,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,UAAU,CAAyC;IAC3D,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAsB;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAe;IACpC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;IAE3E,YAAY,IAAI,EAAE,YAAY,EAc7B;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,cAAc,IAAI,mBAAmB,CAExC;IAED,IAAI,eAAe,IAAI,GAAG,GAAG,SAAS,CAErC;IAED,KAAK,IAAI,MAAM,CAEd;IAED,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE1D;IAEK,qBAAqB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;IAED,MAAM,IAAI,WAAW,GAAG,SAAS,CAEhC;IAEK,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAOnD;IAED,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAGtC;IAEK,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAED,YAAY,IAAI,MAAM,CAKrB;IAEK,qBAAqB,CACzB,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAC9C,OAAO,CAAC,IAAI,CAAC,CAcf;CACF;AAYD,wBAAsB,0BAA0B,CAAC,IAAI,EAAE;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqBhC;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA8F/B;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAsB7C"}

package/dist/internal/mcp-oauth.js

@@ -326,10 +326,17 @@ export class HostMcpOAuthProvider {
         });
     }
 }
+function clientForRedirect(info, redirectUrl) {
+    if (info === undefined || !info.redirect_uris.includes(redirectUrl)) {
+        return undefined;
+    }
+    return info;
+}
 export function createHostMcpOAuthProvider(args) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const store = (_a = args.store) !== null && _a !== void 0 ? _a : new FileMcpOAuthStore();
+        const redirectUrl = (_b = args.redirectUrl) !== null && _b !== void 0 ? _b : MCP_OAUTH_CALLBACK_URL;
         const [fileTokens, fileClient, omitResourceIndicator] = yield Promise.all([
             store.loadTokens(args.identifier, args.resourceUrl),
             store.loadClientInformation(args.identifier, args.resourceUrl),
@@ -339,8 +346,9 @@ export function createHostMcpOAuthProvider(args) {
             identifier: args.identifier,
             resourceUrl: args.resourceUrl,
             store,
+            redirectUrl,
             tokens: fileTokens !== null && fileTokens !== void 0 ? fileTokens : tokensFromEnv(args.identifier),
-            clientInformation: fileClient !== null && fileClient !== void 0 ? fileClient : clientIdFromEnv(args.identifier),
+            clientInformation: clientForRedirect(fileClient !== null && fileClient !== void 0 ? fileClient : clientIdFromEnv(args.identifier), redirectUrl),
             onRedirect: args.onRedirect,
             omitResourceIndicator,
         });

package/dist/internal/null-kv-storage.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The inert KV half of hosted v2 storage.
+ *
+ * The control-plane KV proxy (`/internal/agent-serve/storage/*`) authorizes a
+ * request by mapping the caller's pod service account to a row in the v1
+ * deployment table. Architecture v2 registers its deployments in the factory
+ * control plane instead, so every proxy call from a v2 pod answers
+ * `403 No Agent Serve deployment is bound to this service account`. The
+ * lazy-restore path deliberately propagates read failures (a store outage must
+ * not read as "unknown continuation token"), so those 403s fail follow-up
+ * deliveries outright.
+ *
+ * This backend stands in for the proxy until it can resolve v2 deployments:
+ * writes are dropped, reads are definitive misses, and lists are empty. It is
+ * paired with the framework file store (see framework-file-storage.ts), which
+ * authorizes by store source id rather than by deployment row and therefore
+ * still carries session records, event transcripts, and the continuation
+ * index — the state sessions are restored from.
+ *
+ * Author KV is the one thing that must not silently accept writes here, since
+ * handlers read their own writes back. {@link AUTHOR_KV_UNSUPPORTED} marks the
+ * definition so `ctx.host.kv` falls back to `--state-root` disk instead, the
+ * same fallback a deployment with no configured backend gets.
+ */
+import type { StorageConfig } from "../storage.js";
+/**
+ * Marker stamped on a definition whose KV core cannot serve `ctx.host.kv`,
+ * even though `get` is present for framework session state. Explicit
+ * `unique symbol` annotation required for `--isolatedDeclarations` (TS9010).
+ */
+export declare const AUTHOR_KV_UNSUPPORTED: unique symbol;
+/** True when `value` was built from {@link nullKvStorage}. */
+export declare function isAuthorKvUnsupported(value: unknown): boolean;
+type NullKvStorageMethods = Required<Pick<StorageConfig, "put" | "get" | "delete" | "list">> & {
+    readonly [AUTHOR_KV_UNSUPPORTED]: true;
+};
+/**
+ * A KV core that stores nothing. `get` resolving `undefined` is honest here
+ * rather than dangerous: nothing was ever written, so a miss cannot shadow a
+ * session that exists elsewhere.
+ *
+ * No `cas` group and no `listNewest`: conditional writes over a store that
+ * forgets would report a lock acquired, and write-time ordering means nothing
+ * without writes.
+ */
+export declare function nullKvStorage(): NullKvStorageMethods;
+export {};
+//# sourceMappingURL=null-kv-storage.d.ts.map

package/dist/internal/null-kv-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"null-kv-storage.d.ts","sourceRoot":"","sources":["../../src/internal/null-kv-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,OAAO,MAE1C,CAAC;AAEF,8DAA8D;AAC9D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM7D;AAED,KAAK,oBAAoB,GAAG,QAAQ,CAClC,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC,CACvD,GAAG;IACF,QAAQ,CAAC,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,IAAI,oBAAoB,CAYpD"}

package/dist/internal/null-kv-storage.js

@@ -0,0 +1,58 @@
+/**
+ * The inert KV half of hosted v2 storage.
+ *
+ * The control-plane KV proxy (`/internal/agent-serve/storage/*`) authorizes a
+ * request by mapping the caller's pod service account to a row in the v1
+ * deployment table. Architecture v2 registers its deployments in the factory
+ * control plane instead, so every proxy call from a v2 pod answers
+ * `403 No Agent Serve deployment is bound to this service account`. The
+ * lazy-restore path deliberately propagates read failures (a store outage must
+ * not read as "unknown continuation token"), so those 403s fail follow-up
+ * deliveries outright.
+ *
+ * This backend stands in for the proxy until it can resolve v2 deployments:
+ * writes are dropped, reads are definitive misses, and lists are empty. It is
+ * paired with the framework file store (see framework-file-storage.ts), which
+ * authorizes by store source id rather than by deployment row and therefore
+ * still carries session records, event transcripts, and the continuation
+ * index — the state sessions are restored from.
+ *
+ * Author KV is the one thing that must not silently accept writes here, since
+ * handlers read their own writes back. {@link AUTHOR_KV_UNSUPPORTED} marks the
+ * definition so `ctx.host.kv` falls back to `--state-root` disk instead, the
+ * same fallback a deployment with no configured backend gets.
+ */
+/**
+ * Marker stamped on a definition whose KV core cannot serve `ctx.host.kv`,
+ * even though `get` is present for framework session state. Explicit
+ * `unique symbol` annotation required for `--isolatedDeclarations` (TS9010).
+ */
+export const AUTHOR_KV_UNSUPPORTED = Symbol.for("@cursor/july.storage.author-kv-unsupported");
+/** True when `value` was built from {@link nullKvStorage}. */
+export function isAuthorKvUnsupported(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value[AUTHOR_KV_UNSUPPORTED] === true);
+}
+/**
+ * A KV core that stores nothing. `get` resolving `undefined` is honest here
+ * rather than dangerous: nothing was ever written, so a miss cannot shadow a
+ * session that exists elsewhere.
+ *
+ * No `cas` group and no `listNewest`: conditional writes over a store that
+ * forgets would report a lock acquired, and write-time ordering means nothing
+ * without writes.
+ */
+export function nullKvStorage() {
+    return {
+        [AUTHOR_KV_UNSUPPORTED]: true,
+        put() { },
+        get() {
+            return undefined;
+        },
+        delete() { },
+        list() {
+            return [];
+        },
+    };
+}

package/dist/internal/otel/collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/collector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,yEAAyE;IACzE,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACpC,IAAI,CAAC;IACR,mEAAmE;IACnE,oBAAoB,CAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CAC1C;AAgBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,aAAa,CAgwBf"}
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../../src/internal/otel/collector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,SAAS,EAAS,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIhD,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,yEAAyE;IACzE,oBAAoB,CAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACpC,IAAI,CAAC;IACR,mEAAmE;IACnE,oBAAoB,CAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAAC;CAC1C;AAgBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,WAAW,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,aAAa,CA8xBf"}

package/dist/internal/otel/collector.js

@@ -45,8 +45,8 @@ export function createOtelCollector(runtime, agentName, log) {
         },
     };
     function handle(event, session) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-        var _p, _q;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s;
+        var _t, _u;
         const at = Date.parse(event.at);
         const startTime = Number.isFinite(at) ? at : undefined;
         switch (event.type) {
@@ -144,7 +144,7 @@ export function createOtelCollector(runtime, agentName, log) {
                     return;
                 }
                 for (const call of event.data.calls) {
-                    const parentCtx = parentCtxFor(turn, (_p = event.data.parentCallId) !== null && _p !== void 0 ? _p : call.parentCallId);
+                    const parentCtx = parentCtxFor(turn, (_t = event.data.parentCallId) !== null && _t !== void 0 ? _t : call.parentCallId);
                     const span = runtime.tracer.startSpan("agent_sdk.tool", {
                         kind: SpanKind.INTERNAL,
                         startTime,
@@ -177,6 +177,19 @@ export function createOtelCollector(runtime, agentName, log) {
                 }), startTime);
                 return;
             }
+            case "action.auth_requested": {
+                (_k = (_j = ensureTurn(event, session, startTime)) === null || _j === void 0 ? void 0 : _j.tools.get(event.data.callId)) === null || _k === void 0 ? void 0 : _k.addEvent("auth_requested", undefined, startTime);
+                emitLog("action.auth_requested", SeverityNumber.INFO, attrs(Object.assign(Object.assign({}, baseLog(event, session)), { "cursor.tool.name": event.data.toolName, "agent_sdk.call_id": event.data.callId, "agent_sdk.mcp_connection": event.data.connection })));
+                return;
+            }
+            case "action.auth_resolved": {
+                (_m = (_l = ensureTurn(event, session, startTime)) === null || _l === void 0 ? void 0 : _l.tools.get(event.data.callId)) === null || _m === void 0 ? void 0 : _m.addEvent("auth_resolved", attrs({
+                    "agent_sdk.decision": event.data.decision,
+                    "agent_sdk.decision_by": event.data.by,
+                    "agent_sdk.mcp_connection": event.data.connection,
+                }), startTime);
+                return;
+            }
             case "action.result": {
                 const turn = ensureTurn(event, session, startTime);
                 const span = turn === null || turn === void 0 ? void 0 : turn.tools.get(event.data.callId);
@@ -211,7 +224,7 @@ export function createOtelCollector(runtime, agentName, log) {
                     event.turnId !== undefined) {
                     turn.span.setStatus({ code: SpanStatusCode.OK });
                     turn.span.end(startTime);
-                    (_j = sessions.get(event.sessionId)) === null || _j === void 0 ? void 0 : _j.turns.delete(event.turnId);
+                    (_o = sessions.get(event.sessionId)) === null || _o === void 0 ? void 0 : _o.turns.delete(event.turnId);
                 }
                 return;
             }
@@ -238,7 +251,7 @@ export function createOtelCollector(runtime, agentName, log) {
                 turn.subagents.set(event.data.callId, span);
                 metrics === null || metrics === void 0 ? void 0 : metrics.subagents.add(1, join(event.sessionId, {
                     "agent_sdk.agent": agentName,
-                    "agent_sdk.subagent_name": (_q = event.data.name) !== null && _q !== void 0 ? _q : "unknown",
+                    "agent_sdk.subagent_name": (_u = event.data.name) !== null && _u !== void 0 ? _u : "unknown",
                 }));
                 return;
             }
@@ -252,7 +265,7 @@ export function createOtelCollector(runtime, agentName, log) {
                 return;
             }
             case "artifact.tagged": {
-                (_k = ensureSession(event, session, startTime)) === null || _k === void 0 ? void 0 : _k.span.addEvent("artifact.tagged", attrs({
+                (_p = ensureSession(event, session, startTime)) === null || _p === void 0 ? void 0 : _p.span.addEvent("artifact.tagged", attrs({
                     "agent_sdk.artifact_id": event.data.id,
                     "agent_sdk.artifact_kind": event.data.kind,
                     "agent_sdk.artifact_key": event.data.key,
@@ -291,7 +304,7 @@ export function createOtelCollector(runtime, agentName, log) {
                 }
                 turn.span.setStatus({ code: SpanStatusCode.OK });
                 turn.span.end(startTime);
-                (_l = sessions.get(event.sessionId)) === null || _l === void 0 ? void 0 : _l.turns.delete(event.turnId);
+                (_q = sessions.get(event.sessionId)) === null || _q === void 0 ? void 0 : _q.turns.delete(event.turnId);
                 metrics === null || metrics === void 0 ? void 0 : metrics.turns.add(1, join(event.sessionId, {
                     "agent_sdk.agent": agentName,
                     "agent_sdk.turn_status": "completed",
@@ -315,7 +328,7 @@ export function createOtelCollector(runtime, agentName, log) {
                     turn.span.recordException(new Error(failureText));
                 }
                 turn.span.end(startTime);
-                (_m = sessions.get(event.sessionId)) === null || _m === void 0 ? void 0 : _m.turns.delete(event.turnId);
+                (_r = sessions.get(event.sessionId)) === null || _r === void 0 ? void 0 : _r.turns.delete(event.turnId);
                 metrics === null || metrics === void 0 ? void 0 : metrics.turns.add(1, join(event.sessionId, {
                     "agent_sdk.agent": agentName,
                     "agent_sdk.turn_status": "failed",
@@ -324,7 +337,7 @@ export function createOtelCollector(runtime, agentName, log) {
                 return;
             }
             case "session.waiting": {
-                (_o = ensureSession(event, session, startTime)) === null || _o === void 0 ? void 0 : _o.span.addEvent("session.waiting", undefined, startTime);
+                (_s = ensureSession(event, session, startTime)) === null || _s === void 0 ? void 0 : _s.span.addEvent("session.waiting", undefined, startTime);
                 return;
             }
             case "session.completed": {

package/dist/internal/server.d.ts

@@ -5,7 +5,9 @@
  * server-level health / info / dev-dispatch routes.
  */
 import type { AgentProject, AgentServeHandle, ServeOptions } from "../types.js";
+import type { McpOauthSecretsTarget } from "./mcp-oauth-persist.js";
 import { type AgentRunner } from "./sdk-runner.js";
+import { selectSessionRunLogStore } from "./session-run-log.js";
 /** One agent to serve: its slug (empty for single-agent mode) and project. */
 export interface AgentMount {
     slug: string;
@@ -15,6 +17,10 @@ export interface AgentMount {
 export interface StartServerInternalOptions {
     /** Test seam: replace the Cursor SDK runner (integration tests). */
     runner?: AgentRunner;
+    /** Test seam: bind the `--store` secrets client for on-demand MCP OAuth. */
+    mcpOauthSecrets?: McpOauthSecretsTarget;
+    /** Test seam: persist hosted-execution run logs without a live store. */
+    sessionRunLog?: ReturnType<typeof selectSessionRunLogStore>;
 }
 /**
  * Start an HTTP server hosting one or more agents. A single agent with an

package/dist/internal/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAyHrB,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AA2BpE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAmCD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAg8B3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/internal/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoCH,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAOhB,YAAY,EACb,MAAM,aAAa,CAAC;AAuFrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAyCpE,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,iBAAiB,CAAC;AAWpE,OAAO,EAEL,wBAAwB,EAEzB,MAAM,sBAAsB,CAAC;AAiB9B,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,CAAC;CACvB;AAmCD,6EAA6E;AAC7E,MAAM,WAAW,0BAA0B;IACzC,oEAAoE;IACpE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,yEAAyE;IACzE,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC;CAC7D;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,UAAU,EAAE,EACpB,OAAO,GAAE,YAAY,GAAG,0BAA+B,GACtD,OAAO,CAAC,gBAAgB,CAAC,CA2+B3B"}