@stigmer/runner 3.0.8-dev.20260613085218 → 3.0.8

package/src/activities/execute-cursor/__tests__/build-prompt.test.ts

@@ -14,6 +14,7 @@ import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agente
 
 import { buildPrompt } from "../index.js";
 import type { BuildPromptInput } from "../index.js";
+import { buildReinvocationPrompt, formatToolApprovalProtocol } from "../prompt-builder.js";
 import type { AgentResolution, AgentResolutionReason } from "../session-lifecycle.js";
 
 const USER_MESSAGE = "What was the secret token I told you?";
@@ -109,3 +110,76 @@ describe("buildPrompt", () => {
     expect(prompt).not.toContain("tool-call-1");
   });
 });
+
+describe("tool-approval protocol injection", () => {
+  it("includes the tool-approval protocol on the first execution", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_first_execution") }),
+    );
+    expect(prompt).toContain("<tool_approval_protocol>");
+    // The decisive override against a server's "ask first" guidance.
+    expect(prompt).toContain("calling the appropriate tool directly");
+    expect(prompt).toContain("Invoke the tool and let the platform");
+  });
+
+  it("places the protocol after the agent instructions, before the user request", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_first_execution") }),
+    );
+    const protocolIdx = prompt.indexOf("<tool_approval_protocol>");
+    const requestIdx = prompt.indexOf("<user_request>");
+    expect(protocolIdx).toBeGreaterThan(prompt.indexOf("<agent_instructions>"));
+    expect(protocolIdx).toBeLessThan(requestIdx);
+  });
+
+  it("also injects the protocol for a fresh agent after a resume failure", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_after_resume_failure") }),
+    );
+    expect(prompt).toContain("<tool_approval_protocol>");
+  });
+});
+
+describe("formatToolApprovalProtocol", () => {
+  it("instructs the agent to invoke tools and never ask for permission in prose", () => {
+    const section = formatToolApprovalProtocol();
+    expect(section).toContain("<tool_approval_protocol>");
+    expect(section).toContain("</tool_approval_protocol>");
+    expect(section.toLowerCase()).toContain("never ask the");
+    // Explicit override of MCP-server "confirm before acting" guidance.
+    expect(section.toLowerCase()).toContain("even if a tool or mcp server");
+    expect(section).toContain("Invoke the tool and let the platform");
+  });
+
+  it("contains no characters that would break the prompt assembly", () => {
+    // Sanity: the protocol is plain prose joined into the user-message prompt.
+    expect(formatToolApprovalProtocol()).not.toContain("undefined");
+  });
+});
+
+describe("buildReinvocationPrompt", () => {
+  function pending(toolCallId: string, message: string) {
+    return create(PendingApprovalSchema, { toolCallId, toolName: "Write", message });
+  }
+
+  it("tells the agent to carry out approved actions and keep invoking tools", () => {
+    const decisions = new Map<string, ApprovalAction>([
+      ["tc-1", ApprovalAction.APPROVE],
+    ]);
+    const prompt = buildReinvocationPrompt([pending("tc-1", "Write file: a.txt")], decisions);
+    expect(prompt).toContain("APPROVED");
+    expect(prompt).toContain("Write file: a.txt");
+    // The continuation + override directive must be present.
+    expect(prompt).toContain("Continue the rest of the task");
+    expect(prompt.toLowerCase()).toContain("do not ask the user for permission in prose");
+  });
+
+  it("still carries the continuation/override when every action was skipped", () => {
+    const decisions = new Map<string, ApprovalAction>([
+      ["tc-1", ApprovalAction.SKIP],
+    ]);
+    const prompt = buildReinvocationPrompt([pending("tc-1", "Write file: a.txt")], decisions);
+    expect(prompt).toContain("SKIPPED");
+    expect(prompt).toContain("Continue the rest of the task");
+  });
+});

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -89,13 +89,26 @@ function setup(opts: {
   };
 }
 
-// Real hook-input shapes (PascalCase name, file_path/command in tool_input).
+// Real preToolUse hook-input shapes (PascalCase name, file_path/command in
+// tool_input). These omit hook_event_name on purpose: a payload with no event
+// must still take the built-in arm (the script only diverts to the MCP arm on an
+// explicit beforeMCPExecution).
 const hookWrite = (filePath: string) => ({ tool_name: "Write", tool_input: { file_path: filePath, content: "x" } });
 const hookShell = (command: string) => ({ tool_name: "Shell", tool_input: { command, cwd: "/x", timeout: 30000 } });
 const hookDelete = (filePath: string) => ({ tool_name: "Delete", tool_input: { file_path: filePath } });
 const hookRead = (filePath: string) => ({ tool_name: "Read", tool_input: { file_path: filePath } });
 
-d("generated preToolUse hook", () => {
+// Real beforeMCPExecution shape (captured live): bare tool_name, tool_input as a
+// JSON STRING, server identity, and the hook_event_name discriminator.
+const hookMcp = (name: string, input: Record<string, unknown> = {}) => ({
+  tool_name: name,
+  tool_input: JSON.stringify(input),
+  mcp_server_name: "srv",
+  command: "npx -y srv mcp",
+  hook_event_name: "beforeMCPExecution",
+});
+
+d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
   it("denies gated built-ins (Write/Shell/Delete) and records a category+salient token", () => {
     const h = setup({});
 
@@ -134,24 +147,86 @@ d("generated preToolUse hook", () => {
     expect(h.decide(hookWrite("/x/OTHER.txt")).permission).toBe("deny");
   });
 
-  it("denies require-approval MCP tools and allows them once granted (name-only)", () => {
-    const mcpPolicies = { apply_x: { requiresApproval: true, message: "Apply X" } };
-    const denyH = setup({ mcpPolicies });
-    expect(denyH.decide({ tool_name: "apply_x", tool_input: {} }).permission).toBe("deny");
-    expect(denyH.ledger()[0].token).toBe(grantToken("apply_x", ""));
-
-    const grantH = setup({
-      mcpPolicies,
-      grants: [{ toolName: "apply_x", mcpServerSlug: "srv", key: "apply_x", salient: "" }],
-    });
-    expect(grantH.decide({ tool_name: "apply_x", tool_input: {} }).permission).toBe("allow");
-  });
-
   it("fails closed (deny) when the state file is missing", () => {
     const h = setup({ noStateFile: true });
     expect(h.decide(hookWrite("/x/a.txt")).permission).toBe("deny");
   });
 
+  // MCP gating runs ONLY on the beforeMCPExecution event (preToolUse does not
+  // enforce MCP), so a denial is recorded in exactly one place. The identity is
+  // name-only (base64("<tool>\n")) because the bare tool name is identical on the
+  // hook input and the runner's stream event.
+  describe("MCP tools (beforeMCPExecution event)", () => {
+    it("denies a require-approval MCP tool and surfaces its policy message", () => {
+      const h = setup({ mcpPolicies: { click: { requiresApproval: true, message: "Approve click?" } } });
+      const res = h.decide(hookMcp("click", { app: "Slack", element_index: "59" }));
+      expect(res.permission).toBe("deny");
+      expect(res.raw).toContain("Approve click?");
+      expect(h.ledger()).toHaveLength(1);
+      expect(h.ledger()[0].token).toBe(grantToken("click", ""));
+    });
+
+    it("denial agent_message frames approval as automatic and never trains ask-in-prose", () => {
+      const h = setup({ mcpPolicies: { click: { requiresApproval: true, message: "Approve click?" } } });
+      const res = h.decide(hookMcp("click"));
+      // The agent_message must tell the model approval is handled automatically
+      // and that it should continue, NOT stop and wait or ask for permission.
+      expect(res.raw).toContain("submitted to the user for approval automatically");
+      expect(res.raw).toContain("continue with the rest of the task");
+      // The old propose-then-wait framing and internal sentinel must be gone.
+      expect(res.raw).not.toContain("STIGMER_APPROVAL_REQUIRED");
+      expect(res.raw).not.toContain("Stop and wait");
+    });
+
+    it("allows a require-approval MCP tool once it has been granted (reinvocation)", () => {
+      const h = setup({
+        mcpPolicies: { click: { requiresApproval: true } },
+        grants: [{ toolName: "click", mcpServerSlug: "srv", key: "click", salient: "" }],
+      });
+      expect(h.decide(hookMcp("click")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("allows an auto-approved MCP tool (absent from mcpToolPolicies)", () => {
+      const h = setup({ mcpPolicies: { click: { requiresApproval: true } } });
+      expect(h.decide(hookMcp("list_apps")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("allows an MCP tool whose policy is explicitly requiresApproval:false", () => {
+      const h = setup({ mcpPolicies: { click: { requiresApproval: false } } });
+      expect(h.decide(hookMcp("click")).permission).toBe("allow");
+    });
+
+    it("auto-approve-all allows a require-approval MCP tool", () => {
+      const h = setup({ autoApproveAll: true, mcpPolicies: { click: { requiresApproval: true } } });
+      expect(h.decide(hookMcp("click")).permission).toBe("allow");
+    });
+
+    it("fails closed (deny) when the state file is missing", () => {
+      const h = setup({ noStateFile: true });
+      expect(h.decide(hookMcp("click")).permission).toBe("deny");
+    });
+
+    it("does NOT gate the same MCP tool delivered on preToolUse (no double-gating)", () => {
+      const h = setup({ mcpPolicies: { click: { requiresApproval: true } } });
+      // preToolUse must fall through to allow for MCP — gating belongs to
+      // beforeMCPExecution alone, so the denial is never recorded twice.
+      const res = h.decide({ tool_name: "click", tool_input: "{}", hook_event_name: "preToolUse" });
+      expect(res.permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("scope guard: a foreign MCP invocation is allowed and never recorded", () => {
+      const h = setup({
+        mcpPolicies: { click: { requiresApproval: true } },
+        runnerPid: 2_147_483_600,
+      });
+      expect(h.decide(hookMcp("click")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+    });
+  });
+
   // Regression: the original grep-based extraction truncated string values at
   // the first JSON-escaped character, so a shell command containing double
   // quotes (e.g. `printf '%s' 'x' > "file"`) produced a ledger token that never

package/src/activities/execute-cursor/__tests__/tool-result-image.test.ts

@@ -0,0 +1,244 @@
+/**
+ * Unit tests for Cursor MCP image-result normalization.
+ *
+ * The Cursor SDK wraps an MCP tool result as
+ *   { status, value: { content: [ { text:{text} }, { image:{ data, mimeType } } ] } }
+ * where image `data` is a Node Buffer-JSON ({ type:"Buffer", data:number[] }).
+ * The translator must re-emit that as the canonical top-level content-block
+ * array the shared persist-time offload consumes, so a screenshot lands as a
+ * renderable image ToolCallOutputRef instead of text/plain. These tests pin
+ * that normalization and confirm it flows end-to-end through the offload.
+ */
+
+import { describe, it, expect, vi } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { SDKMessage } from "@cursor/sdk";
+import type { ArtifactStorage } from "../../../shared/artifact-storage.js";
+import {
+  offloadOversizedToolOutputs,
+  detectImagePayload,
+} from "../../../shared/status-offload.js";
+import {
+  toResultString,
+  canonicalizeImageResult,
+  buildToolCallProto,
+  MessageAccumulator,
+} from "../message-translator.js";
+import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+
+// PNG signature + a little payload, the way the Cursor SDK serializes bytes.
+const PNG_BYTES = [137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82];
+const PNG_BASE64 = Buffer.from(PNG_BYTES).toString("base64");
+
+function cursorImageEnvelope(text = "App=com.example") {
+  return {
+    status: "success",
+    value: {
+      content: [
+        { text: { text } },
+        { image: { data: { type: "Buffer", data: PNG_BYTES }, mimeType: "image/png" } },
+      ],
+      isError: false,
+    },
+  };
+}
+
+describe("canonicalizeImageResult", () => {
+  it("converts a Cursor image envelope (Buffer-JSON) to the canonical array", () => {
+    const out = canonicalizeImageResult(cursorImageEnvelope("App=Slack"));
+    expect(out).toBeDefined();
+    expect(JSON.parse(out!)).toEqual([
+      { type: "text", text: "App=Slack" },
+      { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+    ]);
+  });
+
+  it("handles a bare { content: [...] } envelope (no status/value wrapper)", () => {
+    const out = canonicalizeImageResult({
+      content: [{ image: { data: { type: "Buffer", data: PNG_BYTES }, mimeType: "image/png" } }],
+    });
+    expect(JSON.parse(out!)).toEqual([
+      { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+    ]);
+  });
+
+  it("accepts an already-base64 image data string", () => {
+    const out = canonicalizeImageResult({
+      content: [{ image: { data: PNG_BASE64, mimeType: "image/png" } }],
+    });
+    expect(JSON.parse(out!)).toEqual([
+      { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+    ]);
+  });
+
+  it("accepts a data: URL image data string", () => {
+    const out = canonicalizeImageResult({
+      content: [{ image: { data: `data:image/png;base64,${PNG_BASE64}`, mimeType: "image/png" } }],
+    });
+    expect(JSON.parse(out!)).toEqual([
+      { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+    ]);
+  });
+
+  it("defaults mimeType to image/png when absent", () => {
+    const out = canonicalizeImageResult({
+      content: [{ image: { data: { type: "Buffer", data: PNG_BYTES } } }],
+    });
+    expect(JSON.parse(out!)[0]).toEqual({ type: "image", data: PNG_BASE64, mimeType: "image/png" });
+  });
+
+  it("returns undefined for a text-only envelope (no transformation)", () => {
+    expect(canonicalizeImageResult({ status: "success", value: { content: [{ text: { text: "hi" } }] } }))
+      .toBeUndefined();
+  });
+
+  it("returns undefined when there is no content array", () => {
+    expect(canonicalizeImageResult({ status: "success", value: { stdout: "ok" } })).toBeUndefined();
+    expect(canonicalizeImageResult("plain string")).toBeUndefined();
+    expect(canonicalizeImageResult(null)).toBeUndefined();
+  });
+});
+
+describe("toResultString", () => {
+  it("passes a string through unchanged", () => {
+    expect(toResultString("just logs")).toBe("just logs");
+  });
+
+  it("returns empty string for an absent result", () => {
+    expect(toResultString(null)).toBe("");
+    expect(toResultString(undefined)).toBe("");
+  });
+
+  it("JSON.stringifies a non-image object unchanged (text-only envelope)", () => {
+    const env = { status: "success", value: { content: [{ text: { text: "hi" } }] } };
+    expect(toResultString(env)).toBe(JSON.stringify(env));
+  });
+
+  it("normalizes an image envelope to the canonical array", () => {
+    const out = toResultString(cursorImageEnvelope("App=X"));
+    expect(JSON.parse(out)).toEqual([
+      { type: "text", text: "App=X" },
+      { type: "image", data: PNG_BASE64, mimeType: "image/png" },
+    ]);
+  });
+});
+
+describe("buildToolCallProto image normalization", () => {
+  it("produces a result the shared offload detector recognizes as an image", () => {
+    const event = {
+      type: "tool_call",
+      agent_id: "a1",
+      run_id: "r1",
+      call_id: "tc-img",
+      name: "mcp",
+      status: "completed",
+      args: { providerIdentifier: "open-computer-use", toolName: "get_app_state", args: {} },
+      result: cursorImageEnvelope(),
+    } as unknown as Extract<SDKMessage, { type: "tool_call" }>;
+
+    const tc = buildToolCallProto(event);
+    expect(tc.name).toBe("get_app_state");
+    const img = detectImagePayload(tc.result);
+    expect(img).not.toBeNull();
+    expect(img?.mimeType).toBe("image/png");
+    expect(img?.base64).toBe(PNG_BASE64);
+    // The bloated Buffer-JSON must not survive into the persisted result.
+    expect(tc.result).not.toContain('"Buffer"');
+  });
+});
+
+describe("cursor image flows through the persist-time offload", () => {
+  it("offloads the screenshot as an image ref with no inline bytes", async () => {
+    const uploads: { key: string; contentType?: string }[] = [];
+    const storage: ArtifactStorage = {
+      upload: vi.fn(async (key: string, _content: Buffer, contentType?: string) => {
+        uploads.push({ key, contentType });
+        return key;
+      }),
+      getDownloadUrl: vi.fn(async (key: string) => `https://artifacts.local/${key}`),
+      exists: vi.fn(async () => true),
+    };
+
+    const event = {
+      type: "tool_call",
+      agent_id: "a1",
+      run_id: "r1",
+      call_id: "tc-img",
+      name: "mcp",
+      status: "completed",
+      args: { providerIdentifier: "open-computer-use", toolName: "get_app_state", args: {} },
+      result: cursorImageEnvelope(),
+    } as unknown as Extract<SDKMessage, { type: "tool_call" }>;
+
+    const tc = buildToolCallProto(event);
+    const status = create(AgentExecutionStatusSchema, {
+      messages: [create(AgentMessageSchema, { toolCalls: [tc] })],
+    });
+
+    await offloadOversizedToolOutputs(status, { artifactStorage: storage, executionId: "exec-1" });
+
+    const out = status.messages[0].toolCalls[0];
+    expect(out.outputRef).toBeDefined();
+    expect(out.outputRef!.isImage).toBe(true);
+    expect(out.outputRef!.mimeType).toBe("image/png");
+    expect(out.outputRef!.storageKey.endsWith(".png")).toBe(true);
+    expect(uploads[0]?.contentType).toBe("image/png");
+    // Inline result is collapsed; no base64/Buffer bytes remain in the status.
+    expect(out.result).not.toContain(PNG_BASE64);
+    expect(out.result).not.toContain('"Buffer"');
+  });
+});
+
+describe("sub-agent image normalization (extractConversationSteps)", () => {
+  it("normalizes a screenshot returned inside a sub-agent toolCall step", () => {
+    const messages: AgentMessage[] = [];
+    const acc = new MessageAccumulator(messages);
+
+    const running = {
+      type: "tool_call",
+      agent_id: "a1",
+      run_id: "r1",
+      call_id: "tc-sub-img",
+      name: "task",
+      status: "running",
+      args: { description: "screenshot", prompt: "capture" },
+    } as unknown as Extract<SDKMessage, { type: "tool_call" }>;
+    acc.processEvent(running);
+    acc.trackSubAgentExecution(running);
+
+    const completed = {
+      type: "tool_call",
+      agent_id: "a1",
+      run_id: "r1",
+      call_id: "tc-sub-img",
+      name: "task",
+      status: "completed",
+      args: { description: "screenshot", prompt: "capture" },
+      result: {
+        status: "success",
+        value: {
+          conversationSteps: [
+            {
+              type: "toolCall",
+              message: {
+                type: "get_app_state",
+                args: {},
+                result: cursorImageEnvelope("App=SubAgent"),
+              },
+            },
+          ],
+        },
+      },
+    } as unknown as Extract<SDKMessage, { type: "tool_call" }>;
+
+    acc.processEvent(completed);
+    acc.trackSubAgentExecution(completed);
+
+    const sub = acc.subAgentExecutions[0];
+    const subToolResult = sub.messages[0].toolCalls[0].result;
+    const img = detectImagePayload(subToolResult);
+    expect(img?.base64).toBe(PNG_BASE64);
+  });
+});

package/src/activities/execute-cursor/__tests__/workspace-setup.test.ts

@@ -43,9 +43,12 @@ function freshRoot(): string {
 const stigmerScript = (root: string) =>
   join(root, ".stigmer", "sessions", "ses-1", "hitl", "stigmer-approval.sh");
 
+// Single preToolUse registration — the common shape in these tests.
+const pre = (scriptPath: string) => [{ event: "preToolUse", scriptPath }];
+
 describe("buildMergedConfig", () => {
   it("writes a standalone config and restores by delete when no hooks.json exists", () => {
-    const { merged, restoreTo } = buildMergedConfig(null, "/abs/hitl/stigmer-approval.sh");
+    const { merged, restoreTo } = buildMergedConfig(null, pre("/abs/hitl/stigmer-approval.sh"));
     const parsed = JSON.parse(merged);
     expect(parsed.hooks.preToolUse).toHaveLength(1);
     expect(parsed.hooks.preToolUse[0].command).toBe("/abs/hitl/stigmer-approval.sh");
@@ -54,6 +57,47 @@ describe("buildMergedConfig", () => {
     expect(restoreTo).toBeNull();
   });
 
+  it("registers multiple events (preToolUse + beforeMCPExecution) and restores by delete", () => {
+    const { merged, restoreTo } = buildMergedConfig(null, [
+      { event: "preToolUse", scriptPath: "/abs/hitl/stigmer-approval.sh" },
+      { event: "beforeMCPExecution", scriptPath: "/abs/hitl/stigmer-mcp-capture.sh" },
+    ]);
+    const parsed = JSON.parse(merged);
+    expect(parsed.hooks.preToolUse[0].command).toBe("/abs/hitl/stigmer-approval.sh");
+    expect(parsed.hooks.beforeMCPExecution[0].command).toBe("/abs/hitl/stigmer-mcp-capture.sh");
+    expect(parsed.hooks.beforeMCPExecution[0].failClosed).toBe(true);
+    expect(restoreTo).toBeNull();
+  });
+
+  it("merges into both event arrays and strips stale Stigmer entries from each on restore", () => {
+    const root = "/abs";
+    const stalePre = join(root, ".stigmer", "sessions", "ses-1", "hitl", "stigmer-approval.sh");
+    const staleMcp = join(root, ".stigmer", "sessions", "ses-1", "hitl", "stigmer-mcp-capture.sh");
+    const original = JSON.stringify({
+      version: 1,
+      hooks: {
+        preToolUse: [{ command: "./user.sh" }, { command: stalePre, failClosed: true }],
+        beforeMCPExecution: [{ command: staleMcp, failClosed: true }],
+      },
+    });
+    const freshPre = join(root, ".stigmer", "sessions", "ses-2", "hitl", "stigmer-approval.sh");
+    const freshMcp = join(root, ".stigmer", "sessions", "ses-2", "hitl", "stigmer-mcp-capture.sh");
+
+    const { merged, restoreTo } = buildMergedConfig(original, [
+      { event: "preToolUse", scriptPath: freshPre },
+      { event: "beforeMCPExecution", scriptPath: freshMcp },
+    ]);
+
+    const m = JSON.parse(merged);
+    expect(m.hooks.preToolUse.map((e: any) => e.command)).toEqual(["./user.sh", freshPre]);
+    expect(m.hooks.beforeMCPExecution.map((e: any) => e.command)).toEqual([freshMcp]);
+
+    // Restore is self-healing: every stale Stigmer entry is removed from both.
+    const r = JSON.parse(restoreTo!);
+    expect(r.hooks.preToolUse).toEqual([{ command: "./user.sh" }]);
+    expect(r.hooks.beforeMCPExecution).toEqual([]);
+  });
+
   it("merges with a user's hooks.json and restores the original bytes verbatim", () => {
     const original = JSON.stringify(
       {
@@ -67,7 +111,7 @@ describe("buildMergedConfig", () => {
       2,
     );
     const script = "/abs/.stigmer/sessions/ses-1/hitl/stigmer-approval.sh";
-    const { merged, restoreTo } = buildMergedConfig(original, script);
+    const { merged, restoreTo } = buildMergedConfig(original, pre(script));
     const parsed = JSON.parse(merged);
 
     // Our entry is appended; the user's preToolUse hook is preserved...
@@ -93,7 +137,7 @@ describe("buildMergedConfig", () => {
       },
     });
     const fresh = join(root, ".stigmer", "sessions", "ses-2", "hitl", "stigmer-approval.sh");
-    const { merged, restoreTo } = buildMergedConfig(original, fresh);
+    const { merged, restoreTo } = buildMergedConfig(original, pre(fresh));
 
     const mergedParsed = JSON.parse(merged);
     // No duplicate: user entry + exactly one fresh Stigmer entry.
@@ -109,7 +153,7 @@ describe("buildMergedConfig", () => {
 
   it("replaces an unparseable hooks.json for the turn but restores its exact bytes", () => {
     const garbage = "{ this is not json ";
-    const { merged, restoreTo } = buildMergedConfig(garbage, "/abs/hitl/stigmer-approval.sh");
+    const { merged, restoreTo } = buildMergedConfig(garbage, pre("/abs/hitl/stigmer-approval.sh"));
     // We still install a working gate for the turn...
     expect(JSON.parse(merged).hooks.preToolUse).toHaveLength(1);
     // ...and never "fix" the user's file: restore their exact original bytes.
@@ -147,6 +191,11 @@ describe("installHitlGate / removeHitlGate", () => {
     const command = hooksJson.hooks.preToolUse[0].command;
     expect(command).toBe(join(hitlDir, "stigmer-approval.sh"));
     expect(command.startsWith("/")).toBe(true);
+    // The SAME script gates MCP via beforeMCPExecution (preToolUse does not
+    // enforce MCP); the script branches internally on hook_event_name.
+    expect(hooksJson.hooks.beforeMCPExecution[0].command).toBe(
+      join(hitlDir, "stigmer-approval.sh"),
+    );
     // The workspace holds no relocated artifacts.
     expect(existsSync(join(workspaceRoot, ".cursor", "hooks"))).toBe(false);
   });