@hue-run/sdk 0.21.0 → 0.21.1

package/CLI.md

@@ -42,7 +42,7 @@ project manifest are refused because managers can update ancestor locks; Python
 The generated `hue.setup.mjs` or `hue_setup.py` always selects `captureContent: false` /
 `capture_content=False`. For a supported application, setup installs the dependency and adds the
 managed import and middleware registration to the existing entrypoint; an unreferenced helper is
-not a completed integration. TypeScript uses `@hue-run/sdk@0.21.0`, `@opentelemetry/api@1.9.1` and
+not a completed integration. TypeScript uses `@hue-run/sdk@0.21.1`, `@opentelemetry/api@1.9.1` and
 `@opentelemetry/context-async-hooks@2.11.0`; Python setup uses its separately tested package pin.
 Content capture requires an ordinary account-managed key and a later explicit application decision.
 
@@ -193,19 +193,19 @@ for staging). Hue's Settings page does not show these snippets; this command kee
   write** access to every active project in the organization the consent page names, within your
   role, so an agent first calls `list_projects` and passes the chosen project's id as `project_id`.
   The approval lasts 30 days; then sign in again. Sign-in covers the MCP server only: tracing and
-  `hue eval` still use a project key as `HUE_API_KEY`. It is available for `claude-code`, `codex`
-  and `conductor`. Hue does not yet accept Cursor's sign-in callback, so `cursor` and the other
-  clients use a key.
+  `hue eval` still use a project key as `HUE_API_KEY`. It is available for `claude-code`, `codex`,
+  `conductor` and `cursor`; the other clients use a key.
 - `key` references the `HUE_MCP_KEY` environment variable, which `hue login` stores in
   `.env.hue`. A key value is never written. Use a key for read-only access (a **Read** key, which
   only `hue login --keys coding-agent` accepts), for a run that cannot complete a browser sign-in
   (CI, `claude -p`), or for access that must outlast 30 days.
 
-Without `--auth`, `claude-code`, `codex` and `conductor` sign in and the other clients use a key.
-`--read-only` (or `read_only=true` in `--url`) selects a key. Otherwise `claude-code` and `codex`
-keep the choice of the server's existing entry, in `./.mcp.json` or as `codex mcp get` reports it,
-so a rerun that changes `--toolsets` keeps a key and its `read_only`; for a new entry they use a
-key when `HUE_MCP_KEY` is set (only its presence is checked). When `codex` is on `PATH` but `codex mcp get` fails
+Without `--auth`, `claude-code`, `codex`, `conductor` and `cursor` sign in and the other clients
+use a key. `--read-only` (or `read_only=true` in `--url`) selects a key. Otherwise `claude-code`,
+`codex` and `cursor` keep the choice of the server's existing entry, in `./.mcp.json`,
+`./.cursor/mcp.json` or as `codex mcp get` reports it, so a rerun that changes `--toolsets` keeps a
+key and its `read_only`; for a new entry they use a key when `HUE_MCP_KEY` is set (only its
+presence is checked). When `codex` is on `PATH` but `codex mcp get` fails
 for another reason, the command asks for `--auth` rather than guess which to keep. `conductor` keeps signing in, since
 its agents read the login-shell environment Conductor captures rather than your terminal's. The
 command names its choice on stderr; pass `--auth` to replace an entry as given.
@@ -253,7 +253,7 @@ reviewed cases `case_id`, environment versions `environment_version_id`, and tra
 | `claude-code` | Merges `mcpServers.hue` into `./.mcp.json`. `--scope user` runs `claude mcp add --transport http --scope user hue URL --header 'Authorization: Bearer ${HUE_MCP_KEY}'` when `claude` is on `PATH`, otherwise prints it. | Merges `mcpServers.hue` with only `type` and `url` into `./.mcp.json`; `--scope user` runs `claude mcp add --transport http --scope user hue URL`. Then restart Claude Code, run `/mcp`, select `hue` and choose **Authenticate**. |
 | `codex` | Runs `codex mcp add hue --url URL --bearer-token-env-var HUE_MCP_KEY`, or prints the `[mcp_servers.hue]` TOML block for `~/.codex/config.toml`. | Runs `codex mcp add hue --url URL`, which signs in at once and waits up to 5 minutes for the browser; without `--auth` and outside a terminal (CI, an agent's shell tool) the command prints it instead. A sign-in that does not finish leaves the server registered, and `codex mcp login hue` signs in. Then start a new Codex session. The printed TOML block keeps its URL bare and sends the selection as the `X-Hue-MCP-Toolsets` header. |
 | `conductor` | Runs the Claude Code user-scope and Codex key commands above. | Runs `claude mcp add --transport http --scope user hue URL` and `codex mcp add hue --url URL` (printed outside a terminal, as for `codex`). Then use `hue`'s authentication action in Conductor's MCP status (the plug icon or `/mcp-status`). |
-| `cursor` | Merges `mcpServers.hue` into `./.cursor/mcp.json` with `${env:HUE_MCP_KEY}`. | Refused. |
+| `cursor` | Merges `mcpServers.hue` into `./.cursor/mcp.json` with `${env:HUE_MCP_KEY}`. | Merges `mcpServers.hue` with only `url` into `./.cursor/mcp.json`. Then turn on `hue` in Cursor's MCP settings and use its login action, or run `cursor-agent mcp login hue`. |
 | `vscode` | Merges `servers.hue` and the `hue-mcp-key` password input into `./.vscode/mcp.json`. | Refused. |
 | `windsurf` | Prints the `serverUrl` snippet for `~/.codeium/windsurf/mcp_config.json`; nothing is written to the home directory. | Refused. |
 | `gemini` | Runs `gemini mcp add --scope user --transport http hue URL --header 'Authorization: Bearer ${HUE_MCP_KEY}'`, or prints it. | Refused. |
@@ -381,8 +381,8 @@ and Hue never receives or stores them. The command is part of the `hue` executab
 #   LANGFUSE_PUBLIC_KEY=pk-lf-...
 #   LANGFUSE_SECRET_KEY=sk-lf-...
 #   LANGFUSE_BASE_URL=https://cloud.langfuse.com
-npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
-npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
+npx -y @hue-run/sdk@0.21.1 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
+npx -y @hue-run/sdk@0.21.1 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
 ```
 
 `LANGFUSE_PUBLIC_KEY` and `LANGFUSE_SECRET_KEY` come from the environment or `--env-path`
@@ -698,7 +698,7 @@ node packages/sdk-typescript/scripts/verify-package.mjs --artifacts-dir .artifac
 # Set project to an existing supported fixture; use the same directory on resume.
 project=/absolute/path/to/supported-fixture
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.21.0.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.21.1.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command setup \
   --evidence .context/setup-staging-before-claim.json
@@ -709,7 +709,7 @@ the private local handoff and finish the real browser claim, then reconcile the
 
 ```sh
 node packages/sdk-typescript/scripts/verify-setup-live.mjs \
-  --archive .artifacts/typescript/hue-run-sdk-0.21.0.tgz \
+  --archive .artifacts/typescript/hue-run-sdk-0.21.1.tgz \
   --origin https://STAGING_ORIGIN \
   --project "$project" --command claim \
   --evidence .context/setup-staging-after-claim.json
@@ -751,10 +751,10 @@ otherwise. Never hand the agent Hue-native tools (`context.tools`, `context.mcp`
 production agent lacks. Pin the SDK, so the agent's repository gains no dependency:
 
 ```sh
-npx -y @hue-run/sdk@0.21.0 eval --case "Refund an eligible charge" --command "node agent.js"
-npx -y @hue-run/sdk@0.21.0 eval --case https://app.hue.run/projects/demo/scenarios/<id> --command "python agent.py" --timeout 120 --baseline <run id>
-npx -y @hue-run/sdk@0.21.0 eval --set "Billing regressions" --scorer-version <id> --command "node agent.js" --save-version
-npx -y @hue-run/sdk@0.21.0 eval --worker --command "node agent.js" --agent-key support-agent --revision <new-agent-revision>
+npx -y @hue-run/sdk@0.21.1 eval --case "Refund an eligible charge" --command "node agent.js"
+npx -y @hue-run/sdk@0.21.1 eval --case https://app.hue.run/projects/demo/scenarios/<id> --command "python agent.py" --timeout 120 --baseline <run id>
+npx -y @hue-run/sdk@0.21.1 eval --set "Billing regressions" --scorer-version <id> --command "node agent.js" --save-version
+npx -y @hue-run/sdk@0.21.1 eval --worker --command "node agent.js" --agent-key support-agent --revision <new-agent-revision>
 ```
 
 One invocation creates one run holding every selected case; it prints the run URL
@@ -792,7 +792,7 @@ export default function runMyAgent(inputs: JsonValue, context: SimulationTargetC
 ```
 
 ```sh
-npx -y @hue-run/sdk@0.21.0 eval --case "Refund an eligible charge" ./hue-agent.ts --content
+npx -y @hue-run/sdk@0.21.1 eval --case "Refund an eligible charge" ./hue-agent.ts --content
 ```
 
 `--scenario` remains an alias for `--case` for existing scripts. Pass one selection flag.

package/README.md

@@ -82,9 +82,9 @@ claim. Setup never enables content capture or creates a simulation, Hue Run, eva
 or remote execution. See the [setup CLI contract](./CLI.md) for the supported shapes and release gates.
 
 For an existing account, `hue mcp install --client claude-code` (or `codex`, `conductor`,
-`cursor`, `vscode`, `windsurf`, `gemini`) writes the Hue MCP configuration. For Claude Code, Codex
-and Conductor it holds only the URL, and you sign in with Hue in the client; for the other clients,
-`--read-only` and `--auth key` it references `HUE_MCP_KEY` (VS Code prompts for the key).
+`cursor`, `vscode`, `windsurf`, `gemini`) writes the Hue MCP configuration. For Claude Code, Codex,
+Conductor and Cursor it holds only the URL, and you sign in with Hue in the client; for the other
+clients, `--read-only` and `--auth key` it references `HUE_MCP_KEY` (VS Code prompts for the key).
 `hue login` validates keys created in Hue Settings and stores them in `.env.hue` without printing
 them. See [Store project keys](./CLI.md#store-project-keys) and
 [Install the MCP for your coding agent](./CLI.md#install-the-mcp-for-your-coding-agent).
@@ -202,9 +202,9 @@ helpers (`setInput`, `setOutput`, `tool` arguments and results, `recordMessages`
 that is not JSON, such as a `Date` or a class instance, is omitted with an instrumentation failure
 while the callback result is returned unchanged.
 
-### Tool endpoint evidence (unreleased)
+### Tool endpoint evidence
 
-This checkout adds optional `ToolOptions.endpoint`: `{ url, source, method?, captureQueryParameters? }`.
+Since TypeScript `0.21.0`, `ToolOptions` accepts an optional `endpoint`: `{ url, source, method?, captureQueryParameters? }`.
 Use the actual HTTP(S) request URL, client config URL or receipt URL; set `source` to `request`,
 `client_config` or `receipt`. Supply `method` only when known. With content capture enabled,
 Hue records `url.full`, `hue.tool.endpoint.source` and optional `http.request.method` through the
@@ -552,8 +552,8 @@ the Langfuse project's own keys (`LANGFUSE_PUBLIC_KEY`, `LANGFUSE_SECRET_KEY`, a
 `HUE_API_KEY`:
 
 ```sh
-npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
-npx -y @hue-run/sdk@0.21.0 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
+npx -y @hue-run/sdk@0.21.1 import langfuse --env-path .env.langfuse --from 2026-01-01 --dry-run
+npx -y @hue-run/sdk@0.21.1 import langfuse --env-path .env.langfuse --from 2026-01-01 --media
 ```
 
 - It reads Langfuse Cloud and self-hosted v4 through the Observations API v2, and self-hosted v3
@@ -741,8 +741,8 @@ in `finally`. Shut down a shared server client only when the application stops.
 
 The integration creates real Vercel provider, streaming and tool spans and passes
 `recordInputs` and `recordOutputs` explicitly. The installed-package verification
-tests the matching 7.0.99/1.0.99 and
-7.0.100/1.0.100 pairs. Compatible-major ranges do not mean every later release
+tests the matching 7.0.99/1.0.99, 7.0.100/1.0.100, 7.0.137/1.0.137,
+7.0.138/1.0.138 and 7.0.139/1.0.139 pairs. Compatible-major ranges do not mean every later release
 has been verified. Other OTel
 instrumentations can use `hue.tracer` directly or explicitly attach the processors
 below. Instrumentations that only use a global provider need your application's

package/dist/cli/mcp.d.ts

@@ -31,7 +31,7 @@ export declare const MCP_TOOLSETS: readonly ["all", "observe", "author", "evalua
 export declare const TOOLSETS_HEADER = "X-Hue-MCP-Toolsets";
 /** The header form of `?project=`, used by the sign-in Codex TOML to keep its URL bare. */
 export declare const PROJECT_HEADER = "X-Hue-MCP-Project";
-export declare const MCP_USAGE = "Usage: hue mcp install --client <claude-code|codex|conductor|cursor|vscode|windsurf|gemini>\n                       [--auth key|oauth] [--read-only] [--project ID-OR-SLUG]\n                       [--toolsets NAMES] [--url URL]\n                       [--scope project|user] [--dry-run] [--print]\n\nConfigure a coding agent to use the Hue MCP server. A sign-in configuration holds only the\nURL: the client opens Hue in a browser, where you approve access to the projects of one\norganization. A key configuration references the HUE_MCP_KEY environment variable; a key value\nis never written.\n\nOptions:\n  --client NAME   Coding agent to configure (required)\n  --auth MODE     oauth: URL only, sign in with Hue in the client (claude-code, codex and\n                  conductor; their default)\n                  key: reference HUE_MCP_KEY (the default for the other clients and with\n                  --read-only). Without --auth, claude-code and codex keep the choice of\n                  an existing entry, and use a key for a new one when HUE_MCP_KEY is set\n  --read-only     Add ?read_only=true to a key configuration's URL so write tools are\n                  hidden; selects a key without --auth. A sign-in connection has Read and\n                  write access; use a Read key for read-only\n  --project VALUE Pin the connection to one project by id or slug. Its tools omit project_id,\n                  and the server is named hue-<value> so it can coexist with an unpinned hue\n  --toolsets NAMES\n                  Tools to list, comma-separated: all; the observe, author or evaluate\n                  profiles; or project, traces, eval_sets, runs, judges, cases, runners,\n                  environments, intents or docs. Added to the URL as ?toolsets=.\n                  Defaults: all for claude-code, codex and conductor,\n                  which search their own tools; observe for cursor. Without a selection\n                  Hue lists the production reads and search_hue_tools, which reaches\n                  every other tool\n  --url URL       Hue MCP endpoint (default https://mcp.hue.run/mcp)\n  --scope SCOPE   claude-code only: project writes .mcp.json (default); user runs\n                  `claude mcp add --scope user`\n  --dry-run       Print the resulting file content or commands without writing or running\n  --print         Print the configuration snippet only\n  -h, --help      Show this help\n\nFiles: claude-code .mcp.json, cursor .cursor/mcp.json, vscode .vscode/mcp.json (relative to the\ncurrent directory). codex and gemini use their own CLI when it is on PATH; windsurf prints the\nsnippet for its user configuration file. conductor registers the server for its Claude Code\n(user scope) and Codex agents with their CLIs, printing the command for a CLI not on PATH.\ncodex mcp add signs in at once and waits up to 5 minutes for the browser, so without --auth\nand outside a terminal the command prints it instead of running it.";
+export declare const MCP_USAGE = "Usage: hue mcp install --client <claude-code|codex|conductor|cursor|vscode|windsurf|gemini>\n                       [--auth key|oauth] [--read-only] [--project ID-OR-SLUG]\n                       [--toolsets NAMES] [--url URL]\n                       [--scope project|user] [--dry-run] [--print]\n\nConfigure a coding agent to use the Hue MCP server. A sign-in configuration holds only the\nURL: the client opens Hue in a browser, where you approve access to the projects of one\norganization. A key configuration references the HUE_MCP_KEY environment variable; a key value\nis never written.\n\nOptions:\n  --client NAME   Coding agent to configure (required)\n  --auth MODE     oauth: URL only, sign in with Hue in the client (claude-code, codex,\n                  conductor and cursor; their default)\n                  key: reference HUE_MCP_KEY (the default for the other clients and with\n                  --read-only). Without --auth, claude-code, codex and cursor keep the\n                  choice of an existing entry, and use a key for a new one when\n                  HUE_MCP_KEY is set\n  --read-only     Add ?read_only=true to a key configuration's URL so write tools are\n                  hidden; selects a key without --auth. A sign-in connection has Read and\n                  write access; use a Read key for read-only\n  --project VALUE Pin the connection to one project by id or slug. Its tools omit project_id,\n                  and the server is named hue-<value> so it can coexist with an unpinned hue\n  --toolsets NAMES\n                  Tools to list, comma-separated: all; the observe, author or evaluate\n                  profiles; or project, traces, eval_sets, runs, judges, cases, runners,\n                  environments, intents or docs. Added to the URL as ?toolsets=.\n                  Defaults: all for claude-code, codex and conductor,\n                  which search their own tools; observe for cursor. Without a selection\n                  Hue lists the production reads and search_hue_tools, which reaches\n                  every other tool\n  --url URL       Hue MCP endpoint (default https://mcp.hue.run/mcp)\n  --scope SCOPE   claude-code only: project writes .mcp.json (default); user runs\n                  `claude mcp add --scope user`\n  --dry-run       Print the resulting file content or commands without writing or running\n  --print         Print the configuration snippet only\n  -h, --help      Show this help\n\nFiles: claude-code .mcp.json, cursor .cursor/mcp.json, vscode .vscode/mcp.json (relative to the\ncurrent directory). codex and gemini use their own CLI when it is on PATH; windsurf prints the\nsnippet for its user configuration file. conductor registers the server for its Claude Code\n(user scope) and Codex agents with their CLIs, printing the command for a CLI not on PATH.\ncodex mcp add signs in at once and waits up to 5 minutes for the browser, so without --auth\nand outside a terminal the command prints it instead of running it.";
 /**
  * A URL as a POSIX shell word for printed commands: `?` is a zsh glob and `&` ends a command, so a
  * URL with a query (such as `?read_only=true`) is single-quoted. Executed commands pass argv.
@@ -103,6 +103,10 @@ export declare function renderMcpSignInSnippets(url: string, serverName?: string
         url: string;
     };
     claudeCodeProjectJson: string;
+    cursorServer: {
+        url: string;
+    };
+    cursorJson: string;
     claudeCodeCli: {
         args: string[];
         display: string;

package/dist/cli/mcp.js

@@ -37,7 +37,7 @@ const CLIENT_LABELS = {
     gemini: "Gemini CLI",
 };
 /** Clients whose browser sign-in with Hue works against the deployed server. */
-const OAUTH_CLIENTS = ["claude-code", "codex", "conductor"];
+const OAUTH_CLIENTS = ["claude-code", "codex", "conductor", "cursor"];
 /** Toolset names Hue's MCP server accepts: `all`, its catalog groups and its curated profiles. */
 export const MCP_TOOLSETS = [
     "all",
@@ -89,11 +89,12 @@ is never written.
 
 Options:
   --client NAME   Coding agent to configure (required)
-  --auth MODE     oauth: URL only, sign in with Hue in the client (claude-code, codex and
-                  conductor; their default)
+  --auth MODE     oauth: URL only, sign in with Hue in the client (claude-code, codex,
+                  conductor and cursor; their default)
                   key: reference ${ENV_VAR} (the default for the other clients and with
-                  --read-only). Without --auth, claude-code and codex keep the choice of
-                  an existing entry, and use a key for a new one when ${ENV_VAR} is set
+                  --read-only). Without --auth, claude-code, codex and cursor keep the
+                  choice of an existing entry, and use a key for a new one when
+                  ${ENV_VAR} is set
   --read-only     Add ?read_only=true to a key configuration's URL so write tools are
                   hidden; selects a key without --auth. A sign-in connection has Read and
                   write access; use a Read key for read-only
@@ -218,9 +219,12 @@ export function renderMcpSignInSnippets(url, serverName = SERVER_NAME) {
         project ? `"${PROJECT_HEADER}" = "${project}"` : null,
     ].filter((value) => value !== null);
     const claudeCodeServer = { type: "http", url };
+    const cursorServer = { url };
     return {
         claudeCodeServer,
         claudeCodeProjectJson: json({ mcpServers: { [serverName]: claudeCodeServer } }),
+        cursorServer,
+        cursorJson: json({ mcpServers: { [serverName]: cursorServer } }),
         claudeCodeCli: {
             args: ["mcp", "add", "--transport", "http", "--scope", "user", serverName, url],
             display: `claude mcp add --transport http --scope user ${serverName} ${shellWord(url)}`,
@@ -677,11 +681,14 @@ function readClientCli(executable, args, options) {
     });
 }
 const hasAuthorization = (headers) => isRecord(headers) && Object.keys(headers).some((name) => name.toLowerCase() === "authorization");
-/** The server's HTTP entry in `./.mcp.json`; an unreadable file is reported by the write. */
-async function readClaudeProjectEntry(cwd, serverName) {
+/**
+ * The server's HTTP entry under `mcpServers` in a project file (`.mcp.json` for Claude Code,
+ * `.cursor/mcp.json` for Cursor); an unreadable file is reported by the write.
+ */
+async function readProjectEntry(cwd, file, serverName) {
     let config;
     try {
-        ({ config } = await readJsonConfig(resolve(cwd, ".mcp.json"), ".mcp.json"));
+        ({ config } = await readJsonConfig(resolve(cwd, file), file));
     }
     catch {
         return undefined;
@@ -691,7 +698,7 @@ async function readClaudeProjectEntry(cwd, serverName) {
     if (!isRecord(entry) || typeof entry.url !== "string" || !parseMcpUrl(entry.url))
         return undefined;
     const auth = hasAuthorization(entry.headers) ? "key" : "oauth";
-    return { url: entry.url, auth, source: ".mcp.json" };
+    return { url: entry.url, auth, source: file };
 }
 /**
  * The server's entry in Codex's configuration, as `codex mcp get --json` reports it: `found` with
@@ -767,7 +774,7 @@ const notOnPath = (executable, label) => `${executable} is not on PATH. Run this
 /** `auth: "oauth"` is only planned for {@link OAUTH_CLIENTS}; the caller refuses the others. */
 function planFor(client, auth, scope, url, serverName) {
     const snippets = renderMcpSnippets(url, serverName);
-    // Claude Code and Codex take the same plan shape with or without a key.
+    // Claude Code, Codex and Cursor take the same plan shape with or without a key.
     const shared = auth === "oauth" ? renderMcpSignInSnippets(url, serverName) : snippets;
     const claudeUser = {
         executable: "claude",
@@ -810,8 +817,8 @@ function planFor(client, auth, scope, url, serverName) {
                 kind: "file",
                 file: join(".cursor", "mcp.json"),
                 key: "mcpServers",
-                entry: snippets.cursorServer,
-                snippet: snippets.cursorJson,
+                entry: shared.cursorServer,
+                snippet: shared.cursorJson,
             };
         case "vscode":
             return {
@@ -842,8 +849,8 @@ function planFor(client, auth, scope, url, serverName) {
 /**
  * The authentication used without `--auth`, and the line saying why. A client that can sign in
  * does, unless a key is asked for: read-only access (`--read-only`, or `read_only=true` in
- * `--url`), which a sign-in connection does not have. For Claude Code and Codex, an existing entry
- * keeps its choice, so rerunning the command, to change `--toolsets` for instance, never swaps a
+ * `--url`), which a sign-in connection does not have. For Claude Code, Codex and Cursor, an existing
+ * entry keeps its choice, so rerunning the command, to change `--toolsets` for instance, never swaps a
  * working setup; a key keeps its `read_only`. A new entry uses a key when `HUE_MCP_KEY` is set in
  * `env`; only the variable's presence is checked. Conductor signed in by default before and keeps
  * doing so: its agents read the login-shell environment Conductor captures, not this shell's. The
@@ -903,10 +910,15 @@ function nextSteps(client, auth, serverName, project, scope, readOnly) {
                         `If Codex did not open Hue in your browser, run: codex mcp login ${serverName}`,
                         `${approve} Then start a new Codex session, which loads ${serverName}.`,
                     ]
-                    : [
-                        `In Conductor, open MCP status from the plug icon or /mcp-status, refresh, and use ${serverName}'s authentication action. ${approve}`,
-                        "Start a new agent session if the Hue tools do not appear. Hue has not yet verified signed-in Conductor end to end; if the tools still do not load, rerun with --auth key.",
-                    ];
+                    : client === "cursor"
+                        ? [
+                            `Turn on ${serverName} in Cursor's MCP settings and use its login action, or run: cursor-agent mcp login ${serverName}`,
+                            approve,
+                        ]
+                        : [
+                            `In Conductor, open MCP status from the plug icon or /mcp-status, refresh, and use ${serverName}'s authentication action. ${approve}`,
+                            "Start a new agent session if the Hue tools do not appear. Hue has not yet verified signed-in Conductor end to end; if the tools still do not load, rerun with --auth key.",
+                        ];
     else if (client === "vscode")
         lines = [
             `${label} prompts for the key (input ${INPUT_ID}) when the server starts; paste the ${ENV_VAR} value that hue login stored in .env.hue.`,
@@ -969,9 +981,7 @@ export async function runMcpCommand(argv, io = {}) {
     if (explicitAuth !== undefined && explicitAuth !== "key" && explicitAuth !== "oauth")
         return fail(`--auth must be key or oauth.\n\n${MCP_USAGE}`, 2);
     if (explicitAuth === "oauth" && !OAUTH_CLIENTS.includes(clientId))
-        return fail(clientId === "cursor"
-            ? "--auth oauth is not available for cursor: Hue does not yet accept Cursor's sign-in callback. Use a key (the default), or sign in from claude-code or codex."
-            : `--auth oauth is available for ${OAUTH_CLIENTS.join(", ")}. Use a key (the default) for ${clientId}.`, 2);
+        return fail(`--auth oauth is available for ${OAUTH_CLIENTS.join(", ")}. Use a key (the default) for ${clientId}.`, 2);
     const scope = parsed.values.scope ?? "project";
     if (scope !== "project" && scope !== "user")
         return fail(`--scope must be project or user.\n\n${MCP_USAGE}`, 2);
@@ -1005,11 +1015,13 @@ export async function runMcpCommand(argv, io = {}) {
             ? "read_only in --url"
             : undefined;
     // Without --auth or read_only, an existing entry keeps its choice. A user-scope `claude mcp add`
-    // refuses a name it already has, and Conductor keeps its default, so only these two are read.
+    // refuses a name it already has, and Conductor keeps its default, so only these three are read.
     let existing;
     if (explicitAuth === undefined && !parsed.values["read-only"] && !urlReadOnly) {
         if (clientId === "claude-code" && scope === "project")
-            existing = await readClaudeProjectEntry(cwd, serverName);
+            existing = await readProjectEntry(cwd, ".mcp.json", serverName);
+        else if (clientId === "cursor")
+            existing = await readProjectEntry(cwd, join(".cursor", "mcp.json"), serverName);
         else if (clientId === "codex") {
             // Without codex on PATH nothing is run, so nothing Codex holds is replaced. With it, an
             // entry that cannot be read may hold either a key or a sign-in, so the command does not

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export declare const sdkVersion = "0.21.0";
+export declare const sdkVersion = "0.21.1";
 /** OTLP dependency version sent in the export User-Agent. */
 export declare const otlpExporterVersion = "0.223.0";

package/dist/version.js

@@ -1,5 +1,5 @@
 // Generated by scripts/write-version.mjs from package.json; do not edit by hand.
 /** Package version shared by the instrumentation scope and the export User-Agent. */
-export const sdkVersion = "0.21.0";
+export const sdkVersion = "0.21.1";
 /** OTLP dependency version sent in the export User-Agent. */
 export const otlpExporterVersion = "0.223.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hue-run/sdk",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "private": false,
   "license": "MIT",
   "publishConfig": {
@@ -101,12 +101,12 @@
     "zod": "^3.25.76 || ^4.6.5"
   },
   "devDependencies": {
-    "@ai-sdk/otel": "1.0.137",
+    "@ai-sdk/otel": "1.0.139",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/context-async-hooks": "2.12.0",
     "@types/bun": "1.4.2",
     "@types/node": "26.6.4",
-    "ai": "7.0.137",
+    "ai": "7.0.139",
     "ajv": "8.20.0",
     "protobufjs": "8.8.0",
     "typescript": "7.0.2"