@stigmer/runner 3.0.1

package/dist/ipc-protocol-fixtures.d.ts

@@ -0,0 +1,32 @@
+import { type IpcAddSession, type IpcAddWorkflowExecution, type IpcError, type IpcReady, type IpcRemoveSession, type IpcRemoveWorkflowExecution, type IpcSessionAdded, type IpcSessionRemoved, type IpcShutdown, type IpcShutdownComplete, type IpcTokenUpdated, type IpcUpdateToken, type IpcWorkflowExecutionAdded, type IpcWorkflowExecutionRemoved } from "./ipc-protocol.js";
+/** The full golden fixture set: the protocol version plus every command and response. */
+export interface IpcFixtures {
+    ipcProtocolVersion: number;
+    commands: {
+        addSession: IpcAddSession;
+        removeSession: IpcRemoveSession;
+        addWorkflowExecution: IpcAddWorkflowExecution;
+        removeWorkflowExecution: IpcRemoveWorkflowExecution;
+        updateTokenSet: IpcUpdateToken;
+        updateTokenCleared: IpcUpdateToken;
+        shutdown: IpcShutdown;
+    };
+    responses: {
+        ready: IpcReady;
+        readyLegacy: Omit<IpcReady, "protocolVersion">;
+        sessionAdded: IpcSessionAdded;
+        sessionRemoved: IpcSessionRemoved;
+        workflowExecutionAdded: IpcWorkflowExecutionAdded;
+        workflowExecutionRemoved: IpcWorkflowExecutionRemoved;
+        tokenUpdated: IpcTokenUpdated;
+        error: IpcError;
+        shutdownComplete: IpcShutdownComplete;
+    };
+}
+export declare function buildFixtures(): IpcFixtures;
+/**
+ * Serializes the fixtures to the exact text written to disk: 2-space JSON with a trailing
+ * newline. Centralized so the writer and the `--check` guard format identically — any
+ * difference would make the textual freshness diff falsely fail.
+ */
+export declare function serializeFixtures(): string;

package/dist/ipc-protocol-fixtures.js

@@ -0,0 +1,69 @@
+// Golden wire-shape examples for the manager-mode IPC contract — one representative
+// instance per message. This is the single source the cross-language mirrors assert
+// against (Rust `protocol.rs`, Go `unified_runner.go`): the generator script serializes
+// `buildFixtures()` to `fixtures/ipc-protocol.generated.json`, and each mirror's tests
+// read that artifact. Because every sample is typed against an `Ipc*` interface from
+// `ipc-protocol.ts`, renaming or retyping a field there fails `tsc` here — that compile
+// error is what binds the fixtures to the contract. Full rules: docs/ipc-protocol.md.
+import { IPC_PROTOCOL_VERSION, buildReadyMessage, } from "./ipc-protocol.js";
+// Stable example identifiers shared by every mirror's tests. Keep them in sync with the
+// values hard-coded in protocol.rs and ipc_fixtures_test.go — they are part of the golden
+// artifact, so a change here regenerates the fixture and the mirrors must match it.
+const SESSION_ID = "ses_example";
+const EXECUTION_ID = "wfe_example";
+const TOKEN = "tok_example";
+// Builds the golden fixture set. `ready` uses the real builder so the artifact reflects
+// the message the runner actually emits; every other message is a typed literal. Insertion
+// order here is the artifact's key order — keep it stable so the freshness guard's textual
+// diff stays meaningful (consumers compare semantically and do not depend on it).
+export function buildFixtures() {
+    return {
+        ipcProtocolVersion: IPC_PROTOCOL_VERSION,
+        commands: {
+            addSession: { type: "addSession", sessionId: SESSION_ID },
+            removeSession: { type: "removeSession", sessionId: SESSION_ID },
+            addWorkflowExecution: {
+                type: "addWorkflowExecution",
+                executionId: EXECUTION_ID,
+            },
+            removeWorkflowExecution: {
+                type: "removeWorkflowExecution",
+                executionId: EXECUTION_ID,
+            },
+            updateTokenSet: { type: "updateToken", token: TOKEN },
+            updateTokenCleared: { type: "updateToken", token: null },
+            shutdown: { type: "shutdown" },
+        },
+        responses: {
+            ready: buildReadyMessage(),
+            readyLegacy: { type: "ready" },
+            sessionAdded: {
+                type: "sessionAdded",
+                sessionId: SESSION_ID,
+                taskQueue: `session:${SESSION_ID}`,
+            },
+            sessionRemoved: { type: "sessionRemoved", sessionId: SESSION_ID },
+            workflowExecutionAdded: {
+                type: "workflowExecutionAdded",
+                executionId: EXECUTION_ID,
+                taskQueue: `wfexec:${EXECUTION_ID}`,
+            },
+            workflowExecutionRemoved: {
+                type: "workflowExecutionRemoved",
+                executionId: EXECUTION_ID,
+            },
+            tokenUpdated: { type: "tokenUpdated" },
+            error: { type: "error", message: "boom", fatal: true },
+            shutdownComplete: { type: "shutdownComplete" },
+        },
+    };
+}
+/**
+ * Serializes the fixtures to the exact text written to disk: 2-space JSON with a trailing
+ * newline. Centralized so the writer and the `--check` guard format identically — any
+ * difference would make the textual freshness diff falsely fail.
+ */
+export function serializeFixtures() {
+    return `${JSON.stringify(buildFixtures(), null, 2)}\n`;
+}
+//# sourceMappingURL=ipc-protocol-fixtures.js.map

package/dist/ipc-protocol-fixtures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-protocol-fixtures.js","sourceRoot":"","sources":["../src/ipc-protocol-fixtures.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,oFAAoF;AACpF,wFAAwF;AACxF,uFAAuF;AACvF,qFAAqF;AACrF,wFAAwF;AACxF,sFAAsF;AAEtF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,GAelB,MAAM,mBAAmB,CAAC;AAE3B,wFAAwF;AACxF,0FAA0F;AAC1F,oFAAoF;AACpF,MAAM,UAAU,GAAG,aAAa,CAAC;AACjC,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,KAAK,GAAG,aAAa,CAAC;AA8B5B,wFAAwF;AACxF,2FAA2F;AAC3F,2FAA2F;AAC3F,kFAAkF;AAClF,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,kBAAkB,EAAE,oBAAoB;QACxC,QAAQ,EAAE;YACR,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE;YACzD,aAAa,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE;YAC/D,oBAAoB,EAAE;gBACpB,IAAI,EAAE,sBAAsB;gBAC5B,WAAW,EAAE,YAAY;aAC1B;YACD,uBAAuB,EAAE;gBACvB,IAAI,EAAE,yBAAyB;gBAC/B,WAAW,EAAE,YAAY;aAC1B;YACD,cAAc,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE;YACrD,kBAAkB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;YACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAC/B;QACD,SAAS,EAAE;YACT,KAAK,EAAE,iBAAiB,EAAE;YAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;YAC9B,YAAY,EAAE;gBACZ,IAAI,EAAE,cAAc;gBACpB,SAAS,EAAE,UAAU;gBACrB,SAAS,EAAE,WAAW,UAAU,EAAE;aACnC;YACD,cAAc,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE;YACjE,sBAAsB,EAAE;gBACtB,IAAI,EAAE,wBAAwB;gBAC9B,WAAW,EAAE,YAAY;gBACzB,SAAS,EAAE,UAAU,YAAY,EAAE;aACpC;YACD,wBAAwB,EAAE;gBACxB,IAAI,EAAE,0BAA0B;gBAChC,WAAW,EAAE,YAAY;aAC1B;YACD,YAAY,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;YACtC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;YACtD,gBAAgB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;SAC/C;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC"}

package/dist/ipc-protocol.d.ts

@@ -0,0 +1,60 @@
+export declare const IPC_PROTOCOL_VERSION = 1;
+export interface IpcAddSession {
+    type: "addSession";
+    sessionId: string;
+}
+export interface IpcRemoveSession {
+    type: "removeSession";
+    sessionId: string;
+}
+export interface IpcAddWorkflowExecution {
+    type: "addWorkflowExecution";
+    executionId: string;
+}
+export interface IpcRemoveWorkflowExecution {
+    type: "removeWorkflowExecution";
+    executionId: string;
+}
+export interface IpcUpdateToken {
+    type: "updateToken";
+    token: string | null;
+}
+export interface IpcShutdown {
+    type: "shutdown";
+}
+export type IpcCommand = IpcAddSession | IpcRemoveSession | IpcAddWorkflowExecution | IpcRemoveWorkflowExecution | IpcUpdateToken | IpcShutdown;
+export interface IpcReady {
+    type: "ready";
+    protocolVersion: number;
+}
+export interface IpcSessionAdded {
+    type: "sessionAdded";
+    sessionId: string;
+    taskQueue: string;
+}
+export interface IpcSessionRemoved {
+    type: "sessionRemoved";
+    sessionId: string;
+}
+export interface IpcWorkflowExecutionAdded {
+    type: "workflowExecutionAdded";
+    executionId: string;
+    taskQueue: string;
+}
+export interface IpcWorkflowExecutionRemoved {
+    type: "workflowExecutionRemoved";
+    executionId: string;
+}
+export interface IpcError {
+    type: "error";
+    message: string;
+    fatal: boolean;
+}
+export interface IpcTokenUpdated {
+    type: "tokenUpdated";
+}
+export interface IpcShutdownComplete {
+    type: "shutdownComplete";
+}
+export type IpcResponse = IpcReady | IpcSessionAdded | IpcSessionRemoved | IpcWorkflowExecutionAdded | IpcWorkflowExecutionRemoved | IpcTokenUpdated | IpcError | IpcShutdownComplete;
+export declare function buildReadyMessage(): IpcReady;

package/dist/ipc-protocol.js

@@ -0,0 +1,19 @@
+// Canonical machine-readable definition of the manager-mode IPC contract.
+// The runner emits these messages; the Rust host crate (crates/stigmer-runner-host/src/
+// protocol.rs) and the Go integration harness (unified_runner.go) hand-mirror them. Those
+// mirrors are kept honest by golden fixtures generated from this file via
+// ipc-protocol-fixtures.ts (run `make gen-ipc-fixtures`). Full spec and the rule for keeping
+// all definitions in sync: docs/ipc-protocol.md.
+// Integer protocol version advertised in the `ready` handshake. Bump ONLY on a
+// breaking change (removed/renamed message, changed field type, changed lifecycle
+// guarantee) — additive fields never bump it. Hosts read this to decide compatibility;
+// the runner never reads a version from the host (one-way advertisement).
+export const IPC_PROTOCOL_VERSION = 1;
+// ─── Message builders ────────────────────────────────────────────────────────
+// `ready` is the only message carrying protocol metadata, so it is the only one with a
+// constructor — a pure, importable seam the unit test asserts against (main.ts itself
+// self-executes and is not unit-testable). Every other message is a trivial inline literal.
+export function buildReadyMessage() {
+    return { type: "ready", protocolVersion: IPC_PROTOCOL_VERSION };
+}
+//# sourceMappingURL=ipc-protocol.js.map

package/dist/ipc-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-protocol.js","sourceRoot":"","sources":["../src/ipc-protocol.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,wFAAwF;AACxF,0FAA0F;AAC1F,0EAA0E;AAC1E,6FAA6F;AAC7F,iDAAiD;AAEjD,+EAA+E;AAC/E,kFAAkF;AAClF,uFAAuF;AACvF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AA8FtC,gFAAgF;AAEhF,uFAAuF;AACvF,sFAAsF;AACtF,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB;IAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,CAAC;AAClE,CAAC"}

package/dist/main.d.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for the unified runner service.
+ *
+ * Two modes of operation:
+ *
+ * 1. Static mode (default): Reads configuration from environment variables,
+ *    initializes OTel, creates a single-queue runner. Used by CLI daemon and
+ *    customer deployments.
+ *
+ * 2. Manager mode (STIGMER_RUNNER_MODE=manager): Reads JSON commands from
+ *    stdin, manages per-session Workers dynamically. Used by the desktop app
+ *    via the IPC protocol. Responses go to stdout; logs go to stderr.
+ *
+ * OTel is initialized here (not in the factory) because it mutates
+ * global state that the consumer should control when embedding the
+ * runner as a library.
+ */
+export {};

package/dist/main.js

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+/**
+ * CLI entry point for the unified runner service.
+ *
+ * Two modes of operation:
+ *
+ * 1. Static mode (default): Reads configuration from environment variables,
+ *    initializes OTel, creates a single-queue runner. Used by CLI daemon and
+ *    customer deployments.
+ *
+ * 2. Manager mode (STIGMER_RUNNER_MODE=manager): Reads JSON commands from
+ *    stdin, manages per-session Workers dynamically. Used by the desktop app
+ *    via the IPC protocol. Responses go to stdout; logs go to stderr.
+ *
+ * OTel is initialized here (not in the factory) because it mutates
+ * global state that the consumer should control when embedding the
+ * runner as a library.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+import { createInterface } from "node:readline";
+import { loadConfig } from "./config.js";
+import { initTracing, initMetrics } from "./otel.js";
+import { createStigmerRunner } from "./runner.js";
+import { createStigmerRunnerManager } from "./runner-manager.js";
+import { buildReadyMessage } from "./ipc-protocol.js";
+import { handleUnhandledRejection } from "./activities/execute-cursor/rejection-capture.js";
+process.on("unhandledRejection", (reason) => {
+    handleUnhandledRejection(reason);
+});
+process.on("uncaughtException", (err) => {
+    console.error("Uncaught exception in runner:", err);
+});
+// ─── IPC Helpers ─────────────────────────────────────────────────────────────
+function sendIpc(msg) {
+    process.stdout.write(JSON.stringify(msg) + "\n");
+}
+// ─── Manager Mode ────────────────────────────────────────────────────────────
+async function runManagerMode(config) {
+    // In manager mode, redirect console.log to stderr so stdout is reserved for IPC
+    const originalLog = console.log;
+    console.log = (...args) => {
+        process.stderr.write(args.map(String).join(" ") + "\n");
+    };
+    let manager;
+    try {
+        manager = await createStigmerRunnerManager({
+            temporalAddress: config.temporalAddress,
+            temporalNamespace: config.temporalNamespace,
+            stigmerEndpoint: config.stigmerBackendEndpoint,
+            stigmerToken: config.stigmerToken ?? undefined,
+            cursorApiKey: config.cursorApiKey || undefined,
+            workspaceRootDir: config.workspaceRootDir,
+            maxConcurrentActivitiesPerSession: config.maxConcurrentActivities,
+            proxyEndpoint: config.proxyEndpoint ?? undefined,
+            primaryModel: config.primaryModel,
+            checkpointerType: config.checkpointerType,
+            checkpointerProxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
+            cloudModeEnabled: config.cloudModeEnabled,
+            executionMode: config.mode,
+        });
+    }
+    catch (err) {
+        sendIpc({
+            type: "error",
+            message: `Failed to initialize runner manager: ${err}`,
+            fatal: true,
+        });
+        process.exit(1);
+    }
+    sendIpc(buildReadyMessage());
+    const rl = createInterface({ input: process.stdin });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let cmd;
+        try {
+            cmd = JSON.parse(trimmed);
+        }
+        catch {
+            sendIpc({
+                type: "error",
+                message: `Invalid JSON: ${trimmed}`,
+                fatal: false,
+            });
+            continue;
+        }
+        try {
+            switch (cmd.type) {
+                case "addSession": {
+                    await manager.addSession(cmd.sessionId);
+                    sendIpc({
+                        type: "sessionAdded",
+                        sessionId: cmd.sessionId,
+                        taskQueue: `session:${cmd.sessionId}`,
+                    });
+                    break;
+                }
+                case "removeSession": {
+                    await manager.removeSession(cmd.sessionId);
+                    sendIpc({ type: "sessionRemoved", sessionId: cmd.sessionId });
+                    break;
+                }
+                case "addWorkflowExecution": {
+                    await manager.addWorkflowExecution(cmd.executionId);
+                    sendIpc({
+                        type: "workflowExecutionAdded",
+                        executionId: cmd.executionId,
+                        taskQueue: `wfexec:${cmd.executionId}`,
+                    });
+                    break;
+                }
+                case "removeWorkflowExecution": {
+                    await manager.removeWorkflowExecution(cmd.executionId);
+                    sendIpc({ type: "workflowExecutionRemoved", executionId: cmd.executionId });
+                    break;
+                }
+                case "updateToken": {
+                    manager.updateToken(cmd.token);
+                    sendIpc({ type: "tokenUpdated" });
+                    break;
+                }
+                case "shutdown": {
+                    await manager.shutdown();
+                    sendIpc({ type: "shutdownComplete" });
+                    rl.close();
+                    return;
+                }
+                default: {
+                    sendIpc({
+                        type: "error",
+                        message: `Unknown command type: ${cmd.type}`,
+                        fatal: false,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            sendIpc({
+                type: "error",
+                message: `Command ${cmd.type} failed: ${err}`,
+                fatal: false,
+            });
+        }
+    }
+    // stdin closed (parent process died) — shut down gracefully
+    await manager.shutdown();
+}
+// ─── Static Mode ─────────────────────────────────────────────────────────────
+async function runStaticMode(config) {
+    const otelShutdown = await initTracing("stigmer-runner");
+    const metricsShutdown = await initMetrics("stigmer-runner");
+    const runner = await createStigmerRunner({
+        taskQueue: config.taskQueue,
+        temporalAddress: config.temporalAddress,
+        temporalNamespace: config.temporalNamespace,
+        stigmerEndpoint: config.stigmerBackendEndpoint,
+        stigmerToken: config.stigmerToken ?? undefined,
+        cursorApiKey: config.cursorApiKey || undefined,
+        workspaceRootDir: config.workspaceRootDir,
+        maxConcurrentActivities: config.maxConcurrentActivities,
+        proxyEndpoint: config.proxyEndpoint ?? undefined,
+        primaryModel: config.primaryModel,
+        checkpointerType: config.checkpointerType,
+        checkpointerProxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
+        cloudModeEnabled: config.cloudModeEnabled,
+        // Honor the operator's MODE env (resolved into config.mode) instead of
+        // re-deriving execution location from the proxy. This keeps static mode
+        // consistent with manager mode, which already passes config.mode.
+        executionMode: config.mode,
+    });
+    let shutdownRequested = false;
+    const shutdown = (signal) => {
+        if (shutdownRequested) {
+            console.warn("Shutdown already in progress, ignoring duplicate signal");
+            return;
+        }
+        shutdownRequested = true;
+        console.log(`Received ${signal}, stopping worker gracefully...`);
+        runner.shutdown();
+    };
+    process.on("SIGTERM", () => shutdown("SIGTERM"));
+    process.on("SIGINT", () => shutdown("SIGINT"));
+    await runner.start();
+    if (metricsShutdown) {
+        await metricsShutdown();
+    }
+    if (otelShutdown) {
+        await otelShutdown();
+    }
+}
+// ─── Build Fingerprint Check ─────────────────────────────────────────────────
+/**
+ * Compares the dist/.build-fingerprint against the current src/ hash.
+ * Exits the process if the runner binary is stale — silently running
+ * old code causes structured output failures, naming mismatches, and
+ * hours of wasted debugging time.
+ *
+ * If the fingerprint file is missing (first build, CI, integration
+ * tests using tsx), the check is skipped gracefully.
+ */
+function checkBuildFreshness() {
+    try {
+        const runnerRoot = new URL("../", import.meta.url).pathname;
+        const fpPath = join(runnerRoot, "dist", ".build-fingerprint");
+        let stored;
+        try {
+            stored = JSON.parse(readFileSync(fpPath, "utf-8"));
+        }
+        catch {
+            return;
+        }
+        const srcDir = join(runnerRoot, "src");
+        const tsFiles = collectTsFiles(srcDir).sort();
+        const hash = createHash("sha256");
+        for (const file of tsFiles) {
+            hash.update(relative(runnerRoot, file));
+            hash.update(readFileSync(file));
+        }
+        const currentHash = hash.digest("hex").slice(0, 16);
+        if (currentHash !== stored.hash) {
+            console.error(`\n` +
+                `!!! STALE RUNNER BUILD — REFUSING TO START !!!\n` +
+                `    dist/ was built at ${stored.builtAt} (hash ${stored.hash})\n` +
+                `    src/ has changed since (current hash ${currentHash})\n` +
+                `\n` +
+                `    Run 'make build-runner' or 'make desktop-dev' to rebuild.\n`);
+            process.exit(78);
+        }
+    }
+    catch {
+        // Missing fingerprint (tsx, CI, first build) — allow startup
+    }
+}
+function collectTsFiles(dir, files = []) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const fullPath = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (entry.name === "node_modules" || entry.name === "__tests__")
+                continue;
+            collectTsFiles(fullPath, files);
+        }
+        else if (entry.name.endsWith(".ts")) {
+            files.push(fullPath);
+        }
+    }
+    return files;
+}
+// ─── Entry Point ─────────────────────────────────────────────────────────────
+async function main() {
+    checkBuildFreshness();
+    const config = loadConfig();
+    // Route ALL Cursor SDK traffic through the Stigmer proxy in proxy mode.
+    //
+    // CURSOR_BACKEND_URL controls:
+    //   1. connect-node Connect RPC transport (AgentService/Run BiDi stream)
+    //   2. Token exchange (fetch to ${baseUrl}/auth/exchange_user_api_key)
+    //   3. CloudApiClient REST (fetch to ${baseUrl}/v1/models, agent CRUD)
+    //
+    // Setting it to proxyEndpoint makes connect-node send the BiDi stream to
+    // the proxy, where path routing (Caddy/Istio) dispatches /agent.v1* to the
+    // Netty BiDi proxy on port 8082.
+    //
+    // Side-effect: REST calls (#2, #3) also target proxyEndpoint via fetch.
+    // The fetch interceptor detects these (proxy-endpoint host, non-Connect path)
+    // and rewrites them to /v1/proxy/cursor/{upstream_host}{path} for Tomcat.
+    //
+    // CURSOR_API_BASE_URL is also set for completeness — older SDK versions
+    // may read it for token exchange instead of CURSOR_BACKEND_URL.
+    if (config.proxyEndpoint) {
+        const proxyBase = config.proxyEndpoint.replace(/\/+$/, "");
+        process.env.CURSOR_BACKEND_URL = proxyBase;
+        process.env.CURSOR_API_BASE_URL = proxyBase;
+    }
+    const runnerMode = process.env.STIGMER_RUNNER_MODE === "manager" ? "manager" : "static";
+    console.warn(`[runner] mode=${runnerMode}, proxy=${config.proxyEndpoint ?? "none"}, ` +
+        `hasToken=${!!config.stigmerToken}, workspace=${config.workspaceRootDir}, ` +
+        `taskQueue=${config.taskQueue}`);
+    if (runnerMode === "manager") {
+        await runManagerMode(config);
+    }
+    else {
+        await runStaticMode(config);
+    }
+}
+main().catch((err) => {
+    console.error("Fatal error in runner:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,OAAO,EAAE,wBAAwB,EAA0B,MAAM,kDAAkD,CAAC;AAEpH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;IAC1C,wBAAwB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAEhF,SAAS,OAAO,CAAC,GAAgB;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,cAAc,CAAC,MAAoC;IAChE,gFAAgF;IAChF,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC;IAChC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;QACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,0BAA0B,CAAC;YACzC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,eAAe,EAAE,MAAM,CAAC,sBAAsB;YAC9C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;YAC9C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;YAC9C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,iCAAiC,EAAE,MAAM,CAAC,uBAAuB;YACjE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;YAChD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,IAAI,SAAS;YACxE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,aAAa,EAAE,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,wCAAwC,GAAG,EAAE;YACtD,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE7B,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAErD,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,GAAe,CAAC;QACpB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC;gBACN,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,iBAAiB,OAAO,EAAE;gBACnC,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjB,KAAK,YAAY,CAAC,CAAC,CAAC;oBAClB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACxC,OAAO,CAAC;wBACN,IAAI,EAAE,cAAc;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,WAAW,GAAG,CAAC,SAAS,EAAE;qBACtC,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;gBACD,KAAK,eAAe,CAAC,CAAC,CAAC;oBACrB,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC3C,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;oBAC9D,MAAM;gBACR,CAAC;gBACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;oBAC5B,MAAM,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACpD,OAAO,CAAC;wBACN,IAAI,EAAE,wBAAwB;wBAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;wBAC5B,SAAS,EAAE,UAAU,GAAG,CAAC,WAAW,EAAE;qBACvC,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;gBACD,KAAK,yBAAyB,CAAC,CAAC,CAAC;oBAC/B,MAAM,OAAO,CAAC,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACvD,OAAO,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC5E,MAAM;gBACR,CAAC;gBACD,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC/B,OAAO,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;oBAClC,MAAM;gBACR,CAAC;gBACD,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACzB,OAAO,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBACtC,EAAE,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,OAAO,CAAC;wBACN,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,yBAA0B,GAAW,CAAC,IAAI,EAAE;wBACrD,KAAK,EAAE,KAAK;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC;gBACN,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,WAAW,GAAG,CAAC,IAAI,YAAY,GAAG,EAAE;gBAC7C,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,aAAa,CAAC,MAAoC;IAC/D,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,eAAe,EAAE,MAAM,CAAC,sBAAsB;QAC9C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;QAC9C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;QAC9C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;QAChD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,yBAAyB,EAAE,MAAM,CAAC,yBAAyB,IAAI,SAAS;QACxE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,uEAAuE;QACvE,wEAAwE;QACxE,kEAAkE;QAClE,aAAa,EAAE,MAAM,CAAC,IAAI;KAC3B,CAAC,CAAC;IAEH,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,iBAAiB,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,iCAAiC,CAAC,CAAC;QACjE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAErB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,eAAe,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,YAAY,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAE9D,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEpD,IAAI,WAAW,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,IAAI;gBACJ,kDAAkD;gBAClD,0BAA0B,MAAM,CAAC,OAAO,UAAU,MAAM,CAAC,IAAI,KAAK;gBAClE,4CAA4C,WAAW,KAAK;gBAC5D,IAAI;gBACJ,iEAAiE,CAClE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW,EAAE,QAAkB,EAAE;IACvD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAC1E,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,IAAI;IACjB,mBAAmB,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,wEAAwE;IACxE,EAAE;IACF,+BAA+B;IAC/B,yEAAyE;IACzE,uEAAuE;IACvE,uEAAuE;IACvE,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,iCAAiC;IACjC,EAAE;IACF,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,EAAE;IACF,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxF,OAAO,CAAC,IAAI,CACV,iBAAiB,UAAU,WAAW,MAAM,CAAC,aAAa,IAAI,MAAM,IAAI;QACxE,YAAY,CAAC,CAAC,MAAM,CAAC,YAAY,eAAe,MAAM,CAAC,gBAAgB,IAAI;QAC3E,aAAa,MAAM,CAAC,SAAS,EAAE,CAChC,CAAC;IAEF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/middleware/approval-gate.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Approval gate middleware for HITL (human-in-the-loop) tool approval.
+ *
+ * Checks each tool call against the merged approval policy. When a tool
+ * requires approval, calls LangGraph `interrupt()` to pause the graph
+ * at the checkpoint. The Temporal workflow then waits for the user's
+ * decision via the `approvalGateResolved` signal.
+ *
+ * On resume, LangGraph restarts the node from the beginning. The
+ * `interrupt()` call returns the user's decision (approve/skip/reject)
+ * from the `Command(resume=...)` payload.
+ *
+ * Idempotency: Because the node restarts on resume, this middleware
+ * will be invoked again for the same tool call. The `interrupt()` call
+ * is idempotent — on resume it returns the decision value instead of
+ * pausing again.
+ *
+ * Platform tool defaults: DeepAgents JS backend tools (read, write,
+ * edit, execute, etc.) are not covered by MCP policy chains. This
+ * middleware applies sensible defaults: read-only tools are auto-approved,
+ * mutating tools require approval when no explicit policy exists.
+ */
+import type { StigmerMiddleware } from "./types.js";
+import { type MergedToolPolicy } from "../shared/approval-policy.js";
+export interface ApprovalGateConfig {
+    readonly policies: ReadonlyMap<string, MergedToolPolicy>;
+    readonly autoApproveAll: boolean;
+    readonly toolServerMap: ReadonlyMap<string, string>;
+}
+export declare function createApprovalGateMiddleware(config: ApprovalGateConfig): StigmerMiddleware;