@cursor/july 0.1.99 → 0.1.101

package/docs/guides/slack.md

@@ -12,7 +12,7 @@ Replies stream there, with thinking steps and suggested prompts.
 Use `agent-sdk slack create` when Cursor should own the Slack app. Use
 `agent-sdk slack init --manual` when you own it. Commands and flags live
 in the [CLI reference](../reference/cli.md#slack). Coding agents should
-follow [`skills/setup-slack/SKILL.md`](../../skills/setup-slack/SKILL.md).
+follow [`skills/setup-slack/SKILL.md`](../skills/setup-slack.md).
 
 ## Define the channel
 
@@ -55,6 +55,85 @@ export default slackChannel({
 });
 ```
 
+## Choose how the reply arrives
+
+Slack gives an agent two places to show progress while a turn runs: the
+status chip under the thread ("Running grep…") and the reply message
+itself. It won't fill both at once. While a message is streaming, Slack
+shows its own "is working…" chip and hides any status text you set. Cards
+only exist inside a streamed message. `reply.mode` picks which one you get.
+
+### `post` (default): status chip, then one message
+
+Tool calls and the first line of each reasoning block show in the chip as
+they happen. The answer lands as a single message when the turn finishes.
+
+```ts
+export default slackChannel({
+  reply: {
+    mode: "post",
+    status: {
+      reasoning: true,
+      tools: true,
+      idle: ["Checking the monorepo…", "Poking Datadog…"],
+    },
+  },
+});
+```
+
+`idle` is the rotation Slack cycles through when nothing more specific is
+known, up to 5 lines of 50 characters. Pass a function to `tools` to write
+your own line from the calls in flight.
+
+### `stream`: live text, with cards
+
+The answer streams into one message as the model writes it. Slack owns the
+chip for the duration, so live feedback inside the message comes from
+cards. Both are off unless you turn them on.
+
+```ts
+export default slackChannel({
+  reply: {
+    mode: "stream",
+    reasoningCard: true,
+    toolCards: { group: "per-tool" },
+  },
+  toolLabels: { grep: "Searching code", read: "Reading files" },
+});
+```
+
+The reasoning card is one task card, titled "Thinking", that receives the
+model's reasoning as it streams and completes when the answer text starts.
+`maxChars` (default 1500) caps how much it collects. Slack caps a streamed
+message near 12k characters including cards; when an answer outgrows that,
+the streamed message closes where it stands and the rest continues in a
+new message.
+
+Tool cards default to one card per tool name with a call count in the title
+(`grep ×3`), updated in place as calls finish. `group: "per-call"` shows one
+card per call instead.
+
+Cards are collapsible by default: each call adds one line under the title,
+the same summary the playground shows in a tool's header (the grep pattern,
+the file path, the shell command), and the group expands the same way the
+reasoning card does. `collapsible: false` keeps cards to their titles. On a
+collapsible card, `details(call)` returns the line to add when a call starts
+and `output(result)` the text to add when it finishes.
+
+`toolLabels` renames tools everywhere they appear: the chip, card titles,
+and the default `Running …` line.
+
+### Migrating from `streaming` and `thinkingSteps`
+
+`streaming: false` is `reply: { mode: "post" }`. `streaming: true` is
+`reply: { mode: "stream", toolCards: { group: "per-call", collapsible:
+false } }`, the title-only cards it used to show. `loadingMessages` moves
+to `reply.status.idle`. The old options still work and `agent-sdk validate`
+prints the rewrite for each one.
+
+A channel that set none of these used to stream. It now posts. Set
+`reply: { mode: "stream" }` to keep streaming.
+
 ## Set it up
 
 `slack create` opens the Cursor dashboard wizard. Finish Slack consent

package/docs/hillclimbing.md

@@ -22,7 +22,7 @@ flowchart LR
 
 ## How do I hillclimb an agent with a coding agent?
 
-Have Cursor read [`skills/hillclimb/SKILL.md`](../skills/hillclimb/SKILL.md).
+Have Cursor read [`skills/hillclimb/SKILL.md`](./skills/hillclimb.md).
 
 Tell it:
 
@@ -36,10 +36,10 @@ Other skills cover the edges:
 
 | When you need… | Skill |
 | --- | --- |
-| The measured improvement loop | [`skills/hillclimb/SKILL.md`](../skills/hillclimb/SKILL.md) |
-| An eval that locks a kept win | [`skills/evals/SKILL.md`](../skills/evals/SKILL.md) |
-| Repeatable GitHub webhook inputs | [`skills/github/SKILL.md`](../skills/github/SKILL.md) |
-| A run that misbehaves | [`skills/debug/SKILL.md`](../skills/debug/SKILL.md) |
+| The measured improvement loop | [`skills/hillclimb/SKILL.md`](./skills/hillclimb.md) |
+| An eval that locks a kept win | [`skills/evals/SKILL.md`](./skills/evals.md) |
+| Repeatable GitHub webhook inputs | [`skills/github/SKILL.md`](./skills/github.md) |
+| A run that misbehaves | [`skills/debug/SKILL.md`](./skills/debug.md) |
 
 See [Building agents with agents](./building-with-agents.md) for every framework skill and a good first prompt.
 

package/docs/quickstart.md

@@ -13,7 +13,7 @@ review. Add GitHub event handling so pull requests can trigger reviews.
 
 - **Get started with an agent in Cursor:** follow
   [Scaffold an agent with Cursor](./scaffolding-agents.md) and ask Cursor
-  to read [`skills/create-agent/SKILL.md`](../skills/create-agent/SKILL.md).
+  to read [`skills/create-agent/SKILL.md`](./skills/create-agent.md).
 - **Get started in the CLI:** continue below.
 
 ## Prerequisites

package/docs/reference/connections.md

@@ -54,7 +54,7 @@ agent-sdk mcp oauth inventory --store   # also upsert deployment secrets
 ```
 
 Full walkthrough: [Host MCP OAuth](../guides/mcp-oauth.md). Companion
-skill: [`skills/mcp-auth/SKILL.md`](../../skills/mcp-auth/SKILL.md).
+skill: [`skills/mcp-auth/SKILL.md`](../skills/mcp-auth.md).
 
 Account MCP (`cursorAccount: true`) is the right choice for connectors
 already linked in the Cursor dashboard. Omit `servers` (or pass `"*"`)
@@ -124,6 +124,37 @@ be called through the direct tool API.
 In a dry-run session, MCP tools marked read-only run normally. Tools marked
 as writes are stubbed. Tools without effect annotations are unavailable.
 
+## Restrict which tools a connection serves
+
+Use `tools` the same way you allowlist harness tools on the agent. When
+set, the connection serves only those names. Use `disallowedTools` to
+drop names instead. The two combine as deny-wins, same as the Cursor
+SDK. The model and `host.mcp` only see what remains. On a model-visible
+connection, set `advertiseTools: true` so the raw server is not attached.
+
+```ts
+export default defineConnection({
+  url: "https://mcp.example.com/inventory",
+  advertiseTools: true,
+  tools: ["search_skus", "get_stock"],
+});
+
+export default defineConnection({
+  url: "https://mcp.example.com/inventory",
+  advertiseTools: true,
+  disallowedTools: ["place_order", "delete_sku"],
+});
+```
+
+Names are the server's `tools/list` names. Unknown names are omitted. A
+filter that matches nothing on the server fails the turn. Combine with
+`effects: "read"` to keep only the listed tools the server classifies as
+reads.
+
+A list of names is an allowlist. An object of handlers authors TypeScript
+tools. On `host-connections/`, a name list restricts `host.mcp` without
+advertising.
+
 ## Local stdio MCP server
 
 Run a local MCP server as a child process with `command`.

package/docs/reference/http-api.md

@@ -53,7 +53,7 @@ and `playgroundUrl` deep-links the session in the playground.
 | `message` | Required user message |
 | `title` | Session title |
 | `dryRun` | Run read tools and stub write tools |
-| `asOf` | ISO-8601 instant with a timezone, frozen at create; the prompt states it, `ctx.now()` returns it, and tools declaring `timeArgs` refuse calls not bounded at or before it. `400` when unusable |
+| `asOf` | ISO-8601 instant with a timezone, frozen at create; the prompt states it, `ctx.now()` returns it, and tool calls with relative, later-than-`asOf`, or omitted schema-declared time bounds are refused. `400` when unusable |
 | `workspaceFiles` | UTF-8 files written into the session workspace |
 | `cloud` | Per-session cloud options merged over the agent defaults |
 

package/docs/scaffolding-agents.md

@@ -11,7 +11,7 @@ decision.
 ## What does the create-agent skill do?
 
 The bundled
-[`create-agent` skill](../skills/create-agent/SKILL.md) turns your goal
+[`create-agent` skill](./skills/create-agent.md) turns your goal
 into a small working project. Have Cursor read that file and follow it.
 
 Where to find the file depends on how you got the package:
@@ -26,7 +26,7 @@ Where to find the file depends on how you got the package:
 - Installed `@cursor/july` as a dependency? The skill also ships inside
   the package at `node_modules/@cursor/july/skills/create-agent/SKILL.md`.
 - Working from this package's source? The skill is at
-  [`skills/create-agent/SKILL.md`](../skills/create-agent/SKILL.md). Run
+  [`skills/create-agent/SKILL.md`](./skills/create-agent.md). Run
   `agent-sdk install-skills` if you want the same copies in
   `~/.cursor/skills/agentsdk/` (the package postinstall skips the
   source checkout).
@@ -119,7 +119,7 @@ without a Cursor credential. Model turns and evals need
 
 Choose one to three fixed inputs, define what should improve, and name
 what must stay unchanged. Then have Cursor follow
-[`skills/hillclimb/SKILL.md`](../skills/hillclimb/SKILL.md).
+[`skills/hillclimb/SKILL.md`](./skills/hillclimb.md).
 
 The hillclimb skill measures a baseline, changes one lever, runs the same
 inputs again, and adds an eval for each improvement you keep.

package/docs/skills/index.md

@@ -0,0 +1,26 @@
+---
+title: "Coding-agent skills"
+description: "Task guides that ship with the Agent SDK for scaffolding, evals, channels, and hillclimbing."
+---
+
+# Coding-agent skills
+
+Each skill is a procedure a coding agent can follow. Installing
+`@cursor/july` copies them into `~/.cursor/skills/agentsdk/`. This site
+publishes the same files.
+
+See [Building agents with agents](../building-with-agents.md) for when
+to use each one.
+
+| Skill | Use it to |
+| --- | --- |
+| [framework-map](./framework-map.md) | Learn the project layout and runtimes |
+| [create-agent](./create-agent.md) | Scaffold and verify a new agent |
+| [evals](./evals.md) | Write fixtures and regression checks |
+| [ab](./ab.md) | Compare variants on live traffic |
+| [otel](./otel.md) | Export OpenTelemetry traces |
+| [hillclimb](./hillclimb.md) | Improve an agent against fixed inputs |
+| [github](./github.md) | Add GitHub webhooks and replay events |
+| [setup-slack](./setup-slack.md) | Connect an agent to Slack |
+| [mcp-auth](./mcp-auth.md) | Authorize host MCP OAuth |
+| [debug](./debug.md) | Diagnose a local run |

package/docs/troubleshooting.md

@@ -74,7 +74,7 @@ not on `PATH`, use `npx @cursor/july`.
 | Model asks for `mcp_auth` or IDE MCP for a connector it already has | Attached MCP is behind meta-tools. Set `advertiseTools: true` for named tools on local turns, or call it from a host tool via `ctx.host.mcp`. |
 
 See [Host MCP OAuth](./guides/mcp-oauth.md) and
-[`skills/mcp-auth/SKILL.md`](../skills/mcp-auth/SKILL.md).
+[`skills/mcp-auth/SKILL.md`](./skills/mcp-auth.md).
 
 ## What if a secret showed up in a terminal transcript?
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cursor/july",
-  "version": "0.1.99",
+  "version": "0.1.101",
   "description": "(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.",
   "license": "SEE LICENSE IN LICENSE.md",
   "repository": {
@@ -95,6 +95,20 @@
       "import": "./dist/skills.js",
       "default": "./dist/skills.js"
     },
+    "./extensions": {
+      "anysphere-source": "./src/extensions.ts",
+      "bun": "./dist/extensions.js",
+      "types": "./dist/extensions.d.ts",
+      "import": "./dist/extensions.js",
+      "default": "./dist/extensions.js"
+    },
+    "./extensions/cursor-cloud-agents": {
+      "anysphere-source": "./src/extensions/cursor-cloud-agents/extension.ts",
+      "bun": "./dist/extensions/cursor-cloud-agents/extension.js",
+      "types": "./dist/extensions/cursor-cloud-agents/extension.d.ts",
+      "import": "./dist/extensions/cursor-cloud-agents/extension.js",
+      "default": "./dist/extensions/cursor-cloud-agents/extension.js"
+    },
     "./schedules": {
       "anysphere-source": "./src/schedules.ts",
       "types": "./dist/schedules.d.ts",
@@ -215,7 +229,7 @@
     }
   },
   "scripts": {
-    "build": "tsgo -p tsconfig.build.json && node scripts/bundle-publish-shims.mjs && pnpm run build:playground && pnpm run docs:build",
+    "build": "tsgo -p tsconfig.build.json && node scripts/bundle-publish-shims.mjs && node scripts/copy-extension-assets.mjs && pnpm run build:playground && pnpm run docs:build",
     "build:dist": "node scripts/build-hosted-dist.mjs",
     "postinstall": "node -e \"try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}\"",
     "build:playground": "vite build --config playground/vite.config.ts",
@@ -240,7 +254,7 @@
   },
   "dependencies": {
     "@bazel/runfiles": "6.5.0",
-    "@cursor/sdk": "1.0.30",
+    "@cursor/sdk": "1.0.31",
     "@modelcontextprotocol/sdk": "1.25.1",
     "@octokit/auth-app": "^7.2.0",
     "@octokit/rest": "^21.1.1",
@@ -303,4 +317,4 @@
     "yaml": "^2.4.2",
     "zustand": "^5.0.9"
   }
-}
+}

package/src/bin/agent-serve.ts

@@ -426,8 +426,8 @@ Options:
   --all              deploy: every child agent under a multi-agent --dir
                      (skips the interactive picker; mutually exclusive with
                      --slug).
-  --cursor-events-repo  deploy: repo (owner/name) whose SCM events the
-                     deployed engine pulls (repeatable).
+  --cursor-events-repo  deploy: repo (owner/name) the deployed agent
+                     watches (repeatable).
   --allow-domain     deploy: egress domain the engine pod may reach
                      (repeatable; unioned with hosting.egressDomains from the
                      agent manifest). Repo-backed deploys only.
@@ -1160,6 +1160,15 @@ async function main(argv: string[]): Promise<number> {
           info.skills.map((s) => `${s.name} — ${s.description}`)
         )
       );
+      lines.push(
+        section(
+          "extensions",
+          info.extensions.map(
+            (e) =>
+              `${e.name} — ${[...e.tools, ...e.skills].join(", ") || "(nothing contributed)"}`
+          )
+        )
+      );
       lines.push(
         section(
           "MCP connections",

package/src/channels/deployments/deployments-channel.ts

@@ -1,7 +1,11 @@
 import { z } from "zod";
 
 import { defineChannel, localDevStrict, POST } from "../../channels.js";
-import { resolveDeploymentSubscriptions } from "../../internal/cursor-deployment-relay.js";
+import {
+  deploymentEventMatches,
+  resolveDeploymentSubscriptions,
+} from "../../internal/cursor-deployment-relay.js";
+import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
 import type { ChannelDefinition, ChannelHandlerArgs } from "../../types.js";
 import {
@@ -43,14 +47,28 @@ export function getDeploymentsChannelOptions(
 /**
  * Events a {@link deploymentsChannel} dispatches on, unioned from its
  * subscriptions. Published as `meta.deploymentEventTypes` so the deploy
- * manifest can extract `eventTypes`. An empty deploy-source list is an
- * inert channel and yields no events.
+ * manifest can extract `eventTypes`.
+ *
+ * A channel with no resolved subscriptions declares the full event set:
+ * deploy sources usually come from env vars read at module load, and the
+ * hosted freeze bakes hermetically (no customer env/secrets), so deriving
+ * `[]` there would leave the manifest without event types and no
+ * subscription edge could ever materialize (invariant 26). Capability is
+ * the channel's code shape — `onEvent` handles any deployment event —
+ * while sources/environments/event narrowing are runtime subscription
+ * config; the hosted-admission adapter re-applies them before authored
+ * code runs. Inertness is still guaranteed by scope: a deploy that names
+ * no deploy sources binds no edges.
  */
 export function deriveDeploymentEventTypes(
   options: Pick<DeploymentsChannelOptions, "deploySourceUris" | "events">
 ): string[] {
+  const subscriptions = resolveDeploymentSubscriptions(options);
+  if (subscriptions.length === 0) {
+    return [...DEPLOYMENT_EVENT_TYPES].sort();
+  }
   const events = new Set<string>();
-  for (const subscription of resolveDeploymentSubscriptions(options)) {
+  for (const subscription of subscriptions) {
     for (const event of subscription.events) {
       events.add(event);
     }
@@ -59,9 +77,9 @@ export function deriveDeploymentEventTypes(
 }
 
 /**
- * Core deployment-event dispatch, used by the channel's replay route and by
- * the serve host's relay fan-out. Whether the event matches this channel's
- * subscriptions is the caller's decision.
+ * Core deployment-event dispatch, used by the channel's replay route, the
+ * serve host's relay fan-out, and the hosted-admission adapter. Whether the
+ * event matches this channel's subscriptions is the caller's decision.
  */
 export async function dispatchDeploymentEvent(input: {
   options: DeploymentsChannelOptions;
@@ -77,7 +95,61 @@ export async function dispatchDeploymentEvent(input: {
       payload: input.event,
     })
   );
-  return Response.json({ ok: true });
+  // "task": authored `onEvent` ran to completion without a captured send.
+  // Hosted admission only consults this when no send was captured.
+  return withDispatchOutcome(Response.json({ ok: true }), "task");
+}
+
+export type DeploymentsDispatchOutcome = "skip" | "task";
+
+const dispatchOutcomeByResponse = new WeakMap<
+  Response,
+  DeploymentsDispatchOutcome
+>();
+
+function withDispatchOutcome(
+  response: Response,
+  outcome: DeploymentsDispatchOutcome
+): Response {
+  dispatchOutcomeByResponse.set(response, outcome);
+  return response;
+}
+
+export function getDeploymentsDispatchOutcome(
+  response: Response
+): DeploymentsDispatchOutcome | undefined {
+  return dispatchOutcomeByResponse.get(response);
+}
+
+/**
+ * Whether this channel admits the event on a hosted pod. The hosted
+ * control plane fans out on `(deploy_source, eventType, team)` edges only —
+ * environments are not edge identity — so this is where the environment
+ * filter (and a stale-edge guard for sources/events) lives, mirroring what
+ * the v1 relay does before `onEvent`.
+ *
+ * A channel with NO resolved subscriptions admits everything the control
+ * plane delivered: deploy sources usually come from env vars read at
+ * module load, and the hosted freeze bakes hermetically (no customer env),
+ * so on a restored pod an env-configured channel resolves empty — the
+ * deploy-time edges (bound from the watched repositories) already carry
+ * the customer's scope, and refusing here would silently drop every
+ * delivery. Same posture as {@link deriveDeploymentEventTypes}: authored
+ * subscriptions narrow; an unconfigured channel defers to the deploy scope.
+ */
+export function deploymentEventMatchesChannel(
+  options: DeploymentsChannelOptions,
+  event: DeploymentEvent
+): boolean {
+  const subscriptions = resolveDeploymentSubscriptions(options);
+  if (subscriptions.length === 0) {
+    return true;
+  }
+  return subscriptions.some(
+    (subscription) =>
+      subscription.deploySourceUri === event.deploySourceUri.toLowerCase() &&
+      deploymentEventMatches(subscription, event)
+  );
 }
 
 /**
@@ -102,6 +174,13 @@ export async function dispatchDeploymentEvent(input: {
  * have. Nothing is pushed to this deployment and no shared secret exists on
  * either side.
  *
+ * Hosted v2 deployments do not poll: the control plane fans verified factory
+ * deployment events out on `deploy_source` subscription edges — derived from
+ * the deploy's watched `repositories`, since factory records deploy sources
+ * as Origin repo URLs — and delivers through hosted admission. The attached
+ * adapter re-applies this channel's subscription filter — environments are
+ * not edge identity — and skips before authored code runs.
+ *
  * The route on this channel exists for local replay (`agent-sdk` and tests):
  * POST an event body and it runs the same `onEvent`.
  */
@@ -136,5 +215,35 @@ export function deploymentsChannel(
     ],
   });
   deploymentsChannelOptionsByDefinition.set(definition, options);
+  // Hosted v2 delivery: the control plane admits a deployments mailbox item
+  // (deploy_source edge match) and posts the claim-checked factory envelope
+  // here. Environments are not edge identity, so non-matching environments
+  // (and stale-edge sources/events) are filtered to `skip` before authored
+  // code runs — the same pre-`onEvent` filter the v1 relay applies.
+  attachHostedAdmissionAdapter(definition, {
+    kind: DEPLOYMENTS_CHANNEL_KIND,
+    dispatch: async ({ payload, args }) => {
+      const parsed = deploymentEventSchema.safeParse(payload);
+      if (!parsed.success) {
+        return Response.json(
+          { ok: false, error: "invalid_deployment_event" },
+          { status: 400 }
+        );
+      }
+      const event = parsed.data as DeploymentEvent;
+      if (!deploymentEventMatchesChannel(options, event)) {
+        return withDispatchOutcome(
+          Response.json({
+            ok: true,
+            skipped: true,
+            reason: "subscription_mismatch",
+          }),
+          "skip"
+        );
+      }
+      return dispatchDeploymentEvent({ options, event, args });
+    },
+    getOutcome: (response) => getDeploymentsDispatchOutcome(response),
+  });
   return definition;
 }

package/src/channels/deployments/types.ts

@@ -54,9 +54,10 @@ export interface DeploymentsChannelOptions {
    * and then receives nothing. A bare string takes the default environment and
    * event filters.
    *
-   * There is no team-wide subscription: every deploy source is named. At least
-   * one is required — an empty list is how a consumer *deregisters*, so it
-   * cannot also mean "everything".
+   * There is no team-wide subscription: every deploy source is named. An
+   * empty list is how a consumer *deregisters*, so it cannot also mean
+   * "everything". A live array that starts empty and is filled later is
+   * re-read on each registration heartbeat.
    */
   deploySourceUris: readonly (string | DeploymentSubscription)[];
   /**

package/src/channels/github/defaults.ts

@@ -27,9 +27,18 @@ export function buildDefaultGitHubEvents(
   options: BuildDefaultGitHubEventsOptions = {}
 ): ChannelEventHandlers<GitHubChannelState> {
   const deliverReplies = options.deliverReplies !== false;
+  const requiredSuccessfulTools = new Set(
+    options.progress?.requireSuccessfulTools
+      ?.map((toolName) => toolName.trim())
+      .filter((toolName) => toolName !== "") ?? []
+  );
+  const toolOutcomesBySession = new Map<string, Map<string, boolean>>();
 
   return {
-    async "turn.started"(_event, channel) {
+    async "turn.started"(event, channel) {
+      if (requiredSuccessfulTools.size > 0) {
+        toolOutcomesBySession.set(event.sessionId, new Map());
+      }
       await applyGitHubProgress({
         phase: "pending",
         channel,
@@ -52,9 +61,31 @@ export function buildDefaultGitHubEvents(
       }
     },
 
-    async "turn.completed"(_event, channel) {
+    async "action.result"(event) {
+      if (
+        event.data.parentCallId !== undefined ||
+        !requiredSuccessfulTools.has(event.data.toolName)
+      ) {
+        return;
+      }
+      const outcomes = toolOutcomesBySession.get(event.sessionId) ?? new Map();
+      outcomes.set(
+        event.data.toolName,
+        !event.data.isError && event.data.stubbed !== true
+      );
+      toolOutcomesBySession.set(event.sessionId, outcomes);
+    },
+
+    async "turn.completed"(event, channel) {
+      const outcomes = toolOutcomesBySession.get(event.sessionId);
+      const pipelineSucceeded =
+        requiredSuccessfulTools.size === 0 ||
+        [...requiredSuccessfulTools].every(
+          (toolName) => outcomes?.get(toolName) === true
+        );
+      toolOutcomesBySession.delete(event.sessionId);
       await applyGitHubProgress({
-        phase: "success",
+        phase: pipelineSucceeded ? "success" : "failure",
         channel,
         options,
       });
@@ -82,6 +113,7 @@ export function buildDefaultGitHubEvents(
     },
 
     async "turn.failed"(event, channel) {
+      toolOutcomesBySession.delete(event.sessionId);
       await applyGitHubProgress({
         phase: "failure",
         channel,
@@ -91,6 +123,7 @@ export function buildDefaultGitHubEvents(
     },
 
     async "session.failed"(event, channel) {
+      toolOutcomesBySession.delete(event.sessionId);
       await applyGitHubProgress({
         phase: "failure",
         channel,

package/src/channels/github/progress.ts

@@ -35,6 +35,13 @@ export type GitHubBannerProgress = GitHubProgressPhaseCopy;
 export interface GitHubProgressConfig {
   /** When false, skip the eyes reaction on turn.started. Defaults to true. */
   reactions?: boolean;
+  /**
+   * Top-level tools that must each finish successfully before a completed
+   * turn is reported as successful. A missing, stubbed, or ultimately failed
+   * tool reports failure instead. Later successful retries replace an earlier
+   * failure for the same tool.
+   */
+  requireSuccessfulTools?: readonly string[];
   /**
    * Opt-in Checks API run on the PR head. Omit or `false` keeps today's
    * behavior (no check from default events). With `cursorAccount`, enabling