@cursor/july 0.1.96 → 0.1.99

package/src/internal/cli-deploy.ts

@@ -66,6 +66,8 @@ import { stderrPalette } from "./terminal-style.js";
 
 const DEFAULT_POLL_INTERVAL_MS = 3_000;
 const DEFAULT_DEPLOY_TIMEOUT_MS = 10 * 60 * 1000;
+/** `--multi-tenant` HTTP deploy is Anysphere-only (team id 1). */
+const MULTI_TENANT_HTTP_DEPLOY_TEAM_ID = 1;
 
 /** One agent directory selected for deploy (single or multi-agent parent). */
 export type DeployTarget = ChildAgentDir;
@@ -112,6 +114,12 @@ export interface DeployCliOptions {
   cursorEventsRepos?: string[];
   /** deploy `--allow-domain <domain>` (repeatable; unioned with the manifest). */
   allowDomains?: string[];
+  /**
+   * deploy `--multi-tenant`: add a release to an existing Cursor-managed
+   * (multi-tenant) product. Hidden Anysphere-only flag. Cannot create a
+   * new multi-tenant application.
+   */
+  multiTenant?: boolean;
   /** Test seams. */
   fetchImpl?: typeof fetch;
   /** Inject the connector-auth browser opener (tests; also forces interactive). */
@@ -292,6 +300,14 @@ export async function cmdDeploy(options: DeployCliOptions): Promise<number> {
     return ctx;
   }
 
+  if (
+    options.multiTenant === true &&
+    ctx.teamId !== MULTI_TENANT_HTTP_DEPLOY_TEAM_ID
+  ) {
+    ctx.err("--multi-tenant is not available for this team.\n");
+    return 1;
+  }
+
   const targets = await resolveDeployTargets(options, ctx);
   if (typeof targets === "number") {
     return targets;
@@ -311,7 +327,9 @@ export async function cmdDeploy(options: DeployCliOptions): Promise<number> {
     manifests.push(await readDeployManifest(target.dir));
   }
   if (manifests.every((manifest) => manifest.architecture === "v2")) {
-    return deployAgentsdkApplication(ctx, options, targets);
+    return deployAgentsdkApplication(ctx, options, targets, {
+      hasScmChannels: manifests.some((manifest) => manifest.hasScmChannels),
+    });
   }
   if (
     !ctx.json &&
@@ -722,9 +740,18 @@ async function deployOne(
       gitRef,
       agentPath,
       repositories: options.cursorEventsRepos,
+      hasScmChannels: manifest.hasScmChannels,
+      multiTenant: options.multiTenant === true,
     });
   }
 
+  if (options.multiTenant === true) {
+    ctx.err(
+      "--multi-tenant is only valid for architecture: v2 deploys (Cursor-managed products).\n"
+    );
+    return 1;
+  }
+
   // Today's only source shape: the control plane builds from a git ref.
   // See DeploySource for the artifact seam.
   const source: DeploySource = {
@@ -804,11 +831,9 @@ async function deployOne(
   }
 
   if (detail.status !== "running") {
-    const errorDetail =
-      detail.lastError === null || detail.lastError === undefined
-        ? ""
-        : `: ${sanitizeCustomerError(detail.lastError)}`;
-    ctx.err(`Deployment ${slug} ended ${detail.status}${errorDetail}\n`);
+    ctx.err(
+      `Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`
+    );
     return 1;
   }
   const deployedPublicRoutes = detail.publicRoutePaths ?? [];
@@ -845,7 +870,8 @@ async function deployOne(
 async function deployAgentsdkApplication(
   ctx: DeployCliContext,
   options: DeployCliOptions,
-  targets: readonly DeployTarget[]
+  targets: readonly DeployTarget[],
+  declarations: { hasScmChannels: boolean }
 ): Promise<number> {
   const parentDir = resolve(options.dir ?? ".");
   const slug = slugFromDirectoryName(basename(parentDir));
@@ -926,6 +952,8 @@ async function deployAgentsdkApplication(
     agentPath: undefined,
     components,
     repositories: options.cursorEventsRepos,
+    hasScmChannels: declarations.hasScmChannels,
+    multiTenant: options.multiTenant === true,
   });
 }
 
@@ -944,6 +972,10 @@ async function deployOneAgentsdk(
     agentPath: string | undefined;
     components?: AgentkitDeployComponent[];
     repositories: string[] | undefined;
+    /** Any component declares a GitHub/Origin channel. */
+    hasScmChannels: boolean;
+    /** Redeploy an existing Cursor-managed product. */
+    multiTenant: boolean;
   }
 ): Promise<number> {
   const { slug } = args;
@@ -953,6 +985,9 @@ async function deployOneAgentsdk(
       : `  components:  ${args.components
           .map((component) => component.componentKey)
           .join(", ")}\n`;
+  if (args.multiTenant && !ctx.json) {
+    ctx.err("  multi-tenant: existing product\n");
+  }
   let accepted: AgentkitDeployAccepted;
   try {
     accepted = await ctx.client.deployAgentkit({
@@ -963,9 +998,13 @@ async function deployOneAgentsdk(
       agentPath: args.agentPath,
       components: args.components,
       repositories: args.repositories,
+      ...(args.multiTenant ? { multiTenant: true } : {}),
     });
   } catch (error) {
-    return renderApiError(error, ctx.err);
+    return renderApiError(error, ctx.err, {
+      multiTenant: args.multiTenant,
+      teamId: ctx.teamId,
+    });
   }
 
   if (ctx.noWait) {
@@ -1004,7 +1043,9 @@ async function deployOneAgentsdk(
   }
 
   if (detail.status !== "running") {
-    ctx.err(`Deployment ${slug} ended ${detail.status}\n`);
+    ctx.err(
+      `Deployment ${slug} ended ${detail.status}${deployFailureDetail(detail.lastError)}\n`
+    );
     return 1;
   }
   ctx.out(
@@ -1017,8 +1058,19 @@ async function deployOneAgentsdk(
         ? ""
         : `  components:   ${args.components
             .map((component) => component.componentKey)
-            .join(", ")}\n`)
+            .join(", ")}\n`) +
+      (detail.repositories === undefined || !args.hasScmChannels
+        ? ""
+        : `  watching:     ${detail.repositories.length === 0 ? "(nothing)" : detail.repositories.join(", ")}\n`)
   );
+  // An agent with GitHub/Origin channels bound to no repository scope gets
+  // no deliveries at all, which is otherwise invisible in this output.
+  if (args.hasScmChannels && detail.repositories?.length === 0) {
+    ctx.err(
+      `warning: ${slug} watches no repositories, so its GitHub/Origin channels receive no events.\n` +
+        `  Redeploy with --cursor-events-repo <owner>/<name> to set the scope.\n`
+    );
+  }
   return 0;
 }
 
@@ -1128,6 +1180,11 @@ interface DeployManifest {
    * (only `/v1/channels/…` subtrees can be public); surfaced as a warning.
    */
   httpChannelPublicEndpoint: boolean;
+  /**
+   * The agent has GitHub/Origin channels, so it only receives deliveries
+   * while the deployment is bound to at least one `owner/name` scope.
+   */
+  hasScmChannels: boolean;
 }
 
 /**
@@ -1163,6 +1220,10 @@ async function readDeployManifest(dir: string): Promise<DeployManifest> {
     httpChannelPublicEndpoint: (project.httpChannel.auth ?? []).some(
       isPublicEndpointPolicy
     ),
+    hasScmChannels: project.channels.some((channel) => {
+      const kind = channel.definition.meta?.kind;
+      return kind === "github" || kind === "origin";
+    }),
   };
 }
 
@@ -1254,6 +1315,21 @@ export async function cmdDeploymentStatus(
   if (typeof ctx === "number") {
     return ctx;
   }
+  // Same dispatch as `stop`: v1 409s architecture-v2 slugs, so the v2
+  // GET goes first. A v2 404 (missing slug, or an older backend) falls
+  // through to the v1 agent-serve detail.
+  try {
+    const detail = await ctx.client.getAgentkitDeploy({
+      teamId: ctx.teamId,
+      slug,
+    });
+    renderAgentkitDeploymentStatus(ctx, detail);
+    return 0;
+  } catch (error) {
+    if (!(error instanceof DeployApiError) || error.status !== 404) {
+      return renderApiError(error, ctx.err);
+    }
+  }
   let detail: DeploymentDetail;
   try {
     detail = await ctx.client.getDeployment({ teamId: ctx.teamId, slug });
@@ -1346,6 +1422,40 @@ export async function cmdDeploymentStatus(
   return 0;
 }
 
+function renderAgentkitDeploymentStatus(
+  ctx: DeployCliContext,
+  detail: AgentkitDeployStatus
+): void {
+  if (ctx.json) {
+    ctx.out(`${JSON.stringify(detail, null, 2)}\n`);
+    return;
+  }
+  const lines = [
+    `${detail.slug} (team ${detail.teamId})`,
+    `  status:       ${detail.status}`,
+    `  architecture: v2`,
+    `  application:  ${detail.applicationId}`,
+    `  release:      ${detail.releaseId}`,
+    `  progress:     ${detail.progress}`,
+  ];
+  if (detail.statusMessage !== null && detail.statusMessage.trim() !== "") {
+    lines.push(`  step:         ${detail.statusMessage}`);
+  }
+  if (detail.repositories !== undefined) {
+    lines.push(
+      `  watching:     ${
+        detail.repositories.length === 0
+          ? "(nothing)"
+          : detail.repositories.join(", ")
+      }`
+    );
+  }
+  if (detail.lastError !== null && detail.lastError !== undefined) {
+    lines.push(`  last error:   ${sanitizeCustomerError(detail.lastError)}`);
+  }
+  ctx.out(`${lines.join("\n")}\n`);
+}
+
 // ============================================================================
 // stop <slug>
 // ============================================================================
@@ -1854,10 +1964,35 @@ async function pollUntil<
   };
 
   for (;;) {
-    const detail = await fetchDetail().catch((error: unknown) => {
+    let detail: T;
+    try {
+      detail = await fetchDetail();
+    } catch (error: unknown) {
+      // Capacity / rate-limit on GET is not a bake failure. The v2 accept
+      // already started freeze; keep polling until the wait budget expires.
+      if (
+        isTransientDeployStatusError(error) &&
+        Date.now() - startedAt < ctx.timeoutMs
+      ) {
+        if (!ctx.json) {
+          const elapsed = Math.round((Date.now() - startedAt) / 1000);
+          const label = "Waiting for status (server busy)";
+          if (tty) {
+            ctx.err(`\r\x1b[2K${slug}: ${label} (${elapsed}s)`);
+            sawProgress = true;
+          } else if (label !== lastLabel) {
+            ctx.err(`${slug}: ${label}\n`);
+          }
+          lastLabel = label;
+        }
+        const waitMs = transientDeployStatusWaitMs(error, ctx.pollIntervalMs);
+        const remaining = ctx.timeoutMs - (Date.now() - startedAt);
+        await sleep(Math.max(0, Math.min(waitMs, remaining)));
+        continue;
+      }
       finishProgressLine();
       throw error;
-    });
+    }
     report(detail);
     if (terminal.has(detail.status)) {
       finishProgressLine();
@@ -1875,6 +2010,28 @@ async function pollUntil<
   }
 }
 
+/** Load-shed / rate-limit on status GET — the deploy itself may still be baking. */
+function isTransientDeployStatusError(error: unknown): error is DeployApiError {
+  return (
+    error instanceof DeployApiError &&
+    (error.status === 503 || error.status === 429)
+  );
+}
+
+function transientDeployStatusWaitMs(
+  error: DeployApiError,
+  pollIntervalMs: number
+): number {
+  if (
+    error.status === 429 &&
+    error.retryAfterSeconds !== undefined &&
+    error.retryAfterSeconds > 0
+  ) {
+    return Math.max(pollIntervalMs, error.retryAfterSeconds * 1000);
+  }
+  return pollIntervalMs;
+}
+
 /**
  * Wait until GET 404s (the delete reconciler purged the record). Treats
  * other errors as failures. Throws DeployApiError on timeout.
@@ -1938,9 +2095,42 @@ function aliasTokenBlock(aliasToken: string): string {
   );
 }
 
-function renderApiError(error: unknown, err: (text: string) => void): number {
+/**
+ * `: <reason>` suffix for a deploy that ended in a non-running state, or
+ * empty when the control plane recorded no reason.
+ */
+function deployFailureDetail(lastError: string | null | undefined): string {
+  if (
+    lastError === null ||
+    lastError === undefined ||
+    lastError.trim() === ""
+  ) {
+    return "";
+  }
+  return `: ${sanitizeCustomerError(lastError.trim())}`;
+}
+
+function renderApiError(
+  error: unknown,
+  err: (text: string) => void,
+  context?: { multiTenant?: boolean; teamId?: number }
+): number {
   if (error instanceof DeployApiError) {
     err(`${error.message}\n`);
+    if (
+      error.status === 409 &&
+      error.message.includes("application multiTenant does not match")
+    ) {
+      if (context?.multiTenant === true) {
+        err(
+          "This slug is a single-tenant application. Redeploy it without --multi-tenant.\n"
+        );
+      } else if (context?.teamId === MULTI_TENANT_HTTP_DEPLOY_TEAM_ID) {
+        err(
+          "This slug is a Cursor-managed (multi-tenant) product. Redeploy it with --multi-tenant.\n"
+        );
+      }
+    }
     return 1;
   }
   throw error;

package/src/internal/cli-mcp-oauth.ts

@@ -23,10 +23,10 @@ import { CLI_COMMAND_NAME as CLI, LOG_PREFIX } from "./distribution.js";
 import {
   createHostMcpOAuthProvider,
   MCP_OAUTH_CALLBACK_URL,
-  mcpOauthSecretNames,
   openBrowser,
   waitForMcpOAuthCallback,
 } from "./mcp-oauth.js";
+import { upsertHostMcpOauthSecrets } from "./mcp-oauth-persist.js";
 import { resolveProdSlug } from "./resolve-prod-target.js";
 
 export type McpOauthCliOptions = {
@@ -381,29 +381,15 @@ async function storeOauthSecrets(args: {
     return auth;
   }
 
-  const names = mcpOauthSecretNames(args.connection);
-  const secrets: Array<{ name: string; value: string }> = [
-    { name: names.accessToken, value: tokens.access_token },
-  ];
-  if (
-    tokens.refresh_token !== undefined &&
-    tokens.refresh_token.trim() !== ""
-  ) {
-    secrets.push({ name: names.refreshToken, value: tokens.refresh_token });
-  }
-  if (args.clientId !== undefined && args.clientId.trim() !== "") {
-    secrets.push({ name: names.clientId, value: args.clientId });
-  }
-
   try {
-    const secretNames = await auth.client.setSecrets({
-      teamId: auth.teamId,
-      slug,
-      secrets,
+    const secretNames = await upsertHostMcpOauthSecrets({
+      connection: args.connection,
+      tokens,
+      clientId: args.clientId,
+      target: { client: auth.client, teamId: auth.teamId, slug },
     });
     args.out(
-      `${LOG_PREFIX} Stored on ${slug}: ${secrets.map((s) => s.name).join(", ")}.\n` +
-        `${LOG_PREFIX} Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`
+      `${LOG_PREFIX} Stored on ${slug}. Secrets now: ${secretNames.join(", ")}. Next deploy picks them up.\n`
     );
     return 0;
   } catch (error) {