@stigmer/runner-slim 3.0.9-dev.20260615153829 → 3.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner-slim",
-  "version": "3.0.9-dev.20260615153829",
+  "version": "3.1.0",
   "description": "Self-contained Stigmer runner build for embedding in desktop apps — the bundle-friendly @stigmer/runner",
   "license": "Apache-2.0",
   "engines": {
@@ -16,11 +16,11 @@
     "jq-wasm": "^1.1.0-jq-1.8.1"
   },
   "optionalDependencies": {
-    "@stigmer/runner-slim-darwin-arm64": "3.0.9-dev.20260615153829",
-    "@stigmer/runner-slim-darwin-x64": "3.0.9-dev.20260615153829",
-    "@stigmer/runner-slim-linux-x64": "3.0.9-dev.20260615153829",
-    "@stigmer/runner-slim-linux-arm64": "3.0.9-dev.20260615153829",
-    "@stigmer/runner-slim-win32-x64": "3.0.9-dev.20260615153829"
+    "@stigmer/runner-slim-darwin-arm64": "3.1.0",
+    "@stigmer/runner-slim-darwin-x64": "3.1.0",
+    "@stigmer/runner-slim-linux-x64": "3.1.0",
+    "@stigmer/runner-slim-linux-arm64": "3.1.0",
+    "@stigmer/runner-slim-win32-x64": "3.1.0"
   },
   "keywords": [
     "stigmer",

package/workflow-bundle.js

@@ -27739,6 +27739,40 @@ async function orchestrateAgentCall(input) {
         activityError = err;
         activityDone = true;
     });
+    // Last-written file-review reference for this child, as a deterministic key, so
+    // we write pending_file_reviews only when the child's AWAITING_REVIEW set changes
+    // (avoids status-write storms). undefined = never written yet.
+    let lastFileReviewKey;
+    // Poll-derive the child's file-review gate and surface it (reference-only) on the
+    // parent. No new Temporal signal: the orchestrator already holds the child open
+    // (async-completion) and reads its status here on the same cadence as progress.
+    async function syncFileReviews(childId) {
+        let ids;
+        try {
+            ids = await statusProxy.GetAwaitingFileReviewChangeSetIds(childId);
+        }
+        catch (err) {
+            _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.warn("Failed to derive child file-review state (non-fatal)", {
+                error: String(err),
+                taskName: input.taskName,
+            });
+            return;
+        }
+        // Deterministic change key (sorted): a stable comparison across replays.
+        const key = [...ids].sort().join(",");
+        if (key === lastFileReviewKey)
+            return;
+        lastFileReviewKey = key;
+        try {
+            await statusProxy.UpdateWorkflowFileReviewStatus(input.workflowExecutionId, childId, ids);
+        }
+        catch (err) {
+            _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.warn("Failed to update workflow file-review status (non-fatal)", {
+                error: String(err),
+                taskName: input.taskName,
+            });
+        }
+    }
     while (!activityDone) {
         // Wait for a signal, activity completion, or periodic timeout for progress polling.
         // condition() returns false on timeout, true when the predicate became true.
@@ -27749,6 +27783,7 @@ async function orchestrateAgentCall(input) {
         if (childExecId && !initialProgressEmitted) {
             initialProgressEmitted = true;
             await emitProgress(input, childExecId, null);
+            await syncFileReviews(childExecId);
         }
         // Periodic progress: on timeout, poll the child execution for live data
         if (!conditionMet && childExecId) {
@@ -27765,6 +27800,7 @@ async function orchestrateAgentCall(input) {
             if (progress) {
                 await emitProgress(input, childExecId, progress);
             }
+            await syncFileReviews(childExecId);
         }
         // Handle HITL approval notification
         if (pendingNotification) {
@@ -27787,13 +27823,26 @@ async function orchestrateAgentCall(input) {
     if (childExecId && !initialProgressEmitted) {
         await emitProgress(input, childExecId, null);
     }
-    try {
-        await statusProxy.ClearWorkflowApprovalStatus(input.workflowExecutionId);
-    }
-    catch (clearErr) {
-        _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.warn("Failed to clear workflow approval status (non-fatal)", {
-            error: String(clearErr),
-        });
+    // Scoped clears for this child only (per-child merge) — a completing child must
+    // not wipe a parallel sibling's still-pending gate. Skipped if the child never
+    // started (nothing was ever surfaced for it).
+    if (childExecId) {
+        try {
+            await statusProxy.ClearWorkflowApprovalStatus(input.workflowExecutionId, childExecId);
+        }
+        catch (clearErr) {
+            _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.warn("Failed to clear workflow approval status (non-fatal)", {
+                error: String(clearErr),
+            });
+        }
+        try {
+            await statusProxy.UpdateWorkflowFileReviewStatus(input.workflowExecutionId, childExecId, []);
+        }
+        catch (clearErr) {
+            _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.warn("Failed to clear workflow file-review status (non-fatal)", {
+                error: String(clearErr),
+            });
+        }
     }
     if (activityError) {
         if (childExecId) {
@@ -27847,8 +27896,10 @@ async function emitProgress(input, childExecId, progress) {
 "use strict";
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   applyDestructiveHintTightener: () => (/* binding */ applyDestructiveHintTightener),
 /* harmony export */   connectMcpServer: () => (/* binding */ connectMcpServer),
-/* harmony export */   discoverMcpServerLegacy: () => (/* binding */ discoverMcpServerLegacy)
+/* harmony export */   discoverMcpServerLegacy: () => (/* binding */ discoverMcpServerLegacy),
+/* harmony export */   planIncrementalClassification: () => (/* binding */ planIncrementalClassification)
 /* harmony export */ });
 /* harmony import */ var _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(/*! @temporalio/workflow */ "./node_modules/@temporalio/workflow/lib/index.js");
 /**
@@ -27882,6 +27933,115 @@ function classifyWithTimeout(numTools) {
     });
 }
 // ─────────────────────────────────────────────────────────────────────────────
+// Incremental classification planner (pure, deterministic, sandbox-safe)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Canonical, order-stable signature of a single tool's definition.
+ *
+ * Mirrors the shape `toolsFingerprint` hashes (name + description + input_schema)
+ * so "unchanged" here means the same thing it means for the whole-server
+ * fingerprint. Uses only JSON — no `node:crypto` — so it is safe to call from
+ * inside the Temporal deterministic V8 isolate.
+ */
+function toolSignature(tool) {
+    return JSON.stringify({
+        name: tool.name,
+        description: tool.description,
+        input_schema: tool.inputSchema ?? null,
+    });
+}
+/**
+ * Partition the freshly discovered tools into those that must be classified and
+ * the prior approval decisions that can be carried forward verbatim.
+ *
+ * Reuse is **content-addressed**: a prior decision is kept only when a tool's
+ * name AND full definition are byte-identical to the previous connect. This is
+ * deliberately stricter than reusing by name alone — a tool can keep its name
+ * while its schema changes from benign to destructive, and such a tool MUST be
+ * re-evaluated rather than left with a stale "auto-approve". Tools that are
+ * unchanged are never re-classified (stable, deterministic, no LLM cost; no
+ * flapping for borderline tools), and a tool present last time but gone now is
+ * simply absent from both outputs (dropped).
+ *
+ * The previous approval list is a presence-set of *gated* tools (a tool in
+ * `previousToolApprovals` requires approval; a known tool absent from it was
+ * auto-approved). So a reused tool emits a carried-forward entry only when it
+ * was gated; reused auto-approved tools emit nothing, which correctly keeps them
+ * un-gated. `ClassifyToolApprovals` likewise returns only gated entries, so the
+ * union `[...carriedForward, ...classified]` is the complete gated set.
+ *
+ * Pure and free of Temporal APIs so it can be exhaustively unit-tested and is
+ * safe to evaluate inside the workflow sandbox.
+ */
+function planIncrementalClassification(previousTools, previousToolApprovals, currentTools) {
+    const prevSigByName = new Map();
+    for (const tool of previousTools) {
+        prevSigByName.set(tool.name, toolSignature(tool));
+    }
+    const prevGatedByName = new Map();
+    for (const approval of previousToolApprovals) {
+        prevGatedByName.set(approval.toolName, approval);
+    }
+    const toolsToClassify = [];
+    const carriedForward = [];
+    for (const tool of currentTools) {
+        const prevSig = prevSigByName.get(tool.name);
+        const unchanged = prevSig !== undefined && prevSig === toolSignature(tool);
+        if (!unchanged) {
+            toolsToClassify.push(tool);
+            continue;
+        }
+        const gated = prevGatedByName.get(tool.name);
+        if (gated) {
+            carriedForward.push({
+                tool_name: gated.toolName,
+                requires_approval: true,
+                message: gated.message,
+            });
+        }
+        // An unchanged tool that was not gated stays auto-approved — emit nothing.
+    }
+    return { toolsToClassify, carriedForward };
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// destructiveHint fail-closed tightener (pure, deterministic, sandbox-safe)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Force-gate any tool whose live MCP annotation declares `destructiveHint:true`
+ * but that the classifier (or carry-forward) left un-gated.
+ *
+ * This is the ONLY way annotations influence policy, and it is deliberately
+ * one-directional. The MCP spec warns that clients must never make tool-use
+ * decisions on annotations from untrusted servers; trusting a server's
+ * "I am destructive" claim only ever ADDS an approval prompt (the safe
+ * direction), so it cannot be abused. The inverse — trusting `readOnlyHint` to
+ * AUTO-APPROVE — is exactly the unsafe direction the spec forbids, so a spoofed
+ * `readOnlyHint:true` on a destructive tool must never relax it. Read-only
+ * auto-approval authority lives solely with the trusted LLM classifier.
+ *
+ * Recomputed from live discovery on every connect, so it has zero coupling to
+ * `toolSignature`/incremental reuse and needs no persistence. Pure JS so it is
+ * safe to evaluate inside the Temporal deterministic isolate.
+ */
+function applyDestructiveHintTightener(gated, currentTools) {
+    const gatedNames = new Set(gated.map((g) => g.tool_name));
+    const tightened = [...gated];
+    let addedCount = 0;
+    for (const tool of currentTools) {
+        if (tool.annotations?.destructiveHint === true && !gatedNames.has(tool.name)) {
+            tightened.push({
+                tool_name: tool.name,
+                requires_approval: true,
+                message: `Execute ${tool.name}`,
+                from_destructive_hint: true,
+            });
+            gatedNames.add(tool.name);
+            addedCount++;
+        }
+    }
+    return { tightened, addedCount };
+}
+// ─────────────────────────────────────────────────────────────────────────────
 // ConnectMcpServerWorkflow — primary connect flow
 // ─────────────────────────────────────────────────────────────────────────────
 async function connectMcpServer(input) {
@@ -27890,23 +28050,22 @@ async function connectMcpServer(input) {
         executionContextId: input.execution_context_id ?? null,
         invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
     });
-    const canReusePreviousApprovals = discovery.newToolsFingerprint !== "" &&
-        discovery.newToolsFingerprint === discovery.previousToolsFingerprint &&
-        discovery.previousToolApprovals.length > 0;
+    // Content-addressed incremental classification: reuse prior decisions for
+    // tools whose definition is unchanged, and classify only the new or changed
+    // ones. Keeps decisions stable/deterministic across reconnects and avoids
+    // redundant LLM calls, while still re-evaluating a tool whose schema changed.
+    const { toolsToClassify, carriedForward } = planIncrementalClassification(discovery.previousTools, discovery.previousToolApprovals, discovery.tools);
     let toolApprovals;
-    if (canReusePreviousApprovals) {
-        _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.info(`Tools unchanged for '${input.mcp_server_id}' ` +
-            `(fingerprint ${discovery.newToolsFingerprint.slice(0, 12)}) — ` +
-            `reusing ${discovery.previousToolApprovals.length} previous approval(s)`);
-        toolApprovals = discovery.previousToolApprovals.map((a) => ({
-            tool_name: a.toolName,
-            requires_approval: a.requiresApproval,
-            message: a.message,
-        }));
+    if (toolsToClassify.length === 0) {
+        _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.info(`Tools unchanged for '${input.mcp_server_id}' — reusing ` +
+            `${carriedForward.length} previous approval(s), no classification needed`);
+        toolApprovals = carriedForward;
     }
     else {
+        _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.info(`Classifying ${toolsToClassify.length} new/changed tool(s) for ` +
+            `'${input.mcp_server_id}', reusing ${carriedForward.length} prior decision(s)`);
         const classifyInput = {
-            tools: discovery.tools.map((t) => ({
+            tools: toolsToClassify.map((t) => ({
                 name: t.name,
                 description: t.description,
                 input_schema: t.inputSchema ?? null,
@@ -27915,9 +28074,22 @@ async function connectMcpServer(input) {
             serverDescription: "",
             mcpServerId: input.mcp_server_id,
         };
-        const classify = classifyWithTimeout(discovery.tools.length);
-        toolApprovals = await classify.ClassifyToolApprovals(classifyInput);
-    }
+        const classify = classifyWithTimeout(toolsToClassify.length);
+        const classified = await classify.ClassifyToolApprovals(classifyInput);
+        toolApprovals = [...carriedForward, ...classified];
+    }
+    // Fail-closed tightener over the FULL live tool set: a tool the server's own
+    // annotation marks destructiveHint=true is force-gated if it slipped through
+    // un-gated. Runs on live discovery (not the reused/classified subset), so it
+    // also re-asserts gating for carried-forward tools whose server later flips a
+    // tool to destructive. We never trust readOnlyHint to relax — see the
+    // tightener's contract for the MCP untrusted-hints rationale.
+    const { tightened, addedCount } = applyDestructiveHintTightener(toolApprovals, discovery.tools);
+    if (addedCount > 0) {
+        _temporalio_workflow__WEBPACK_IMPORTED_MODULE_0__.log.info(`Force-gated ${addedCount} tool(s) via destructiveHint annotation for ` +
+            `'${input.mcp_server_id}'`);
+    }
+    toolApprovals = tightened;
     return {
         tools: discovery.tools.map((t) => ({
             name: t.name,