@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/dist/activities/execute-cursor/workspace-setup.js

@@ -30,13 +30,26 @@
  * hooks.json is inert: the scope guard allows every invocation once the runner
  * PID is gone, and the relocated artifacts are not in the repo.
  */
-import { writeFile, readFile, mkdir, chmod, rm } from "node:fs/promises";
-import { join } from "node:path";
+import { writeFile, readFile, mkdir, chmod, rm, rmdir, readdir } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
 import { generateHookScript } from "./hook-script.js";
-import { writeApprovalStateFile, resetDenialLedger } from "./approval-state.js";
+import { buildToolApprovalRuleFile } from "./prompt-builder.js";
+import { writeApprovalStateFile, resetDenialLedger, activePointerPath, writeActiveTurnPointer, removeActiveTurnPointer, } from "./approval-state.js";
+import { resetCasObservations } from "./cas-observations.js";
+import { ensureHitlGateDir } from "../../shared/workspace/platform-dir.js";
 const CURSOR_DIR = ".cursor";
 const HOOKS_CONFIG_FILE = "hooks.json";
 const HOOK_SCRIPT_FILE = "stigmer-approval.sh";
+const RULES_DIR = "rules";
+// Pre-#173 the gate wrote its script/state/ledger INTO the repo here, as
+// `stigmer-*` files. Newer runs relocate them to the session HITL dir, but the
+// old files (and their hooks.json entry) linger in already-touched repos — see
+// removeLegacyWorkspaceHookArtifacts / isStigmerHookEntry.
+const LEGACY_HOOKS_DIR = "hooks";
+const RUNNER_OWNED_HOOK_FILE_PREFIX = "stigmer-";
+// Unmistakably runner-owned filename so installing it never collides with a
+// user's own project rules and restoring it never touches one.
+const TOOL_APPROVAL_RULE_FILE = "stigmer-tool-approval.mdc";
 /**
  * Cursor hook events the gate registers, both pointing at the same script (which
  * branches on `hook_event_name`). `preToolUse` gates built-in tools
@@ -56,14 +69,33 @@ const HOOK_TIMEOUT_SECONDS = 10;
  */
 export async function installHitlGate(params) {
     const { workspaceRoot, hitlDir, approvalState, runnerPid } = params;
-    const approvalScriptPath = await writeHitlArtifacts(hitlDir, approvalState, runnerPid);
+    // Heal any pre-#173 in-workspace gate leftovers before installing. Without
+    // this, a stale `.cursor/hooks/stigmer-approval.sh` (from a runner build that
+    // wrote the gate into the repo) keeps running alongside the current
+    // out-of-workspace gate and — reading an old, taskless approval-state with no
+    // grant for the current action — vetoes EVERY gated tool, including ones the
+    // user just approved ("blocked despite approval"). Its denials also land in a
+    // ledger this runner never reads, so the denial never surfaces as a pause and
+    // the run silently completes with the file never written. The merge below
+    // strips the stale hooks.json entry (see isStigmerHookEntry); this removes the
+    // orphaned script/state/ledger files so nothing can re-run them.
+    await removeLegacyWorkspaceHookArtifacts(workspaceRoot);
+    const { scriptPath: approvalScriptPath, gateDir } = await writeHitlArtifacts(workspaceRoot, hitlDir, approvalState, runnerPid);
     // One script, two events: preToolUse gates built-ins; beforeMCPExecution is
     // the only event Cursor enforces for MCP tools. The script branches internally
     // on hook_event_name so MCP is gated in exactly one place.
-    return installWorkspaceHook(workspaceRoot, [
+    const hookHandle = await installWorkspaceHook(workspaceRoot, [
         { event: PRE_TOOL_USE_EVENT, scriptPath: approvalScriptPath },
         { event: BEFORE_MCP_EVENT, scriptPath: approvalScriptPath },
     ]);
+    // Install the always-applied tool-approval rule. The deny-based gate surfaces
+    // an approval pause to the model as a tool failure (Cursor's generic "blocked
+    // by a hook" text), and the SDK exposes no non-leaky approval primitive — so
+    // this rule, which takes precedence over MCP-server instructions and persists
+    // across resumed turns, is the strongest available lever to stop the model
+    // from misreading the gate as a broken environment.
+    const rule = await installWorkspaceRule(workspaceRoot);
+    return { ...hookHandle, rule, gateDir };
 }
 /**
  * Restore the workspace to its pre-turn state.
@@ -72,36 +104,138 @@ export async function installHitlGate(params) {
  * and a leftover hooks.json is inert anyway (see the module doc).
  */
 export async function removeHitlGate(handle) {
+    await restoreWorkspaceFile(handle.hooksJsonPath, handle.restoreTo);
+    // Drop the active-turn pointer so the gate is INERT between turns: a hook that
+    // fires while no turn is active (a cached hooks.json, the user's own IDE on the
+    // same repo) reads no pointer and allows immediately. The stable hook script
+    // itself is intentionally left in place — it is harmless without a pointer and
+    // is reused (and refreshed) by the next turn.
+    await removeActiveTurnPointer(handle.gateDir);
+    if (handle.rule) {
+        await restoreWorkspaceFile(handle.rule.path, handle.rule.restoreTo);
+        // When we deleted our own rule file (restoreTo === null) and the `.cursor/
+        // rules` dir is now empty, remove it too so a repo that had no rules before
+        // is left exactly as we found it. rmdir only removes an empty dir, so a
+        // workspace with the user's own rules is untouched.
+        if (handle.rule.restoreTo === null) {
+            try {
+                await rmdir(dirname(handle.rule.path));
+            }
+            catch {
+                // Non-empty (user has other rules) or already gone — nothing to clean.
+            }
+        }
+    }
+}
+/**
+ * Restore a single gate-managed workspace file to its pre-turn state: delete it
+ * when nothing existed before (restoreTo === null), else write the snapshot
+ * bytes back. Best-effort and never throws — a teardown failure must not fail
+ * the execution, and a leftover artifact is inert (see the module doc).
+ */
+async function restoreWorkspaceFile(path, restoreTo) {
     try {
-        if (handle.restoreTo === null) {
-            await rm(handle.hooksJsonPath, { force: true });
+        if (restoreTo === null) {
+            await rm(path, { force: true });
         }
         else {
-            await writeFile(handle.hooksJsonPath, handle.restoreTo, "utf-8");
+            await writeFile(path, restoreTo, "utf-8");
         }
     }
     catch (err) {
-        console.warn(`removeHitlGate: failed to restore ${handle.hooksJsonPath} (non-fatal): ` +
+        console.warn(`removeHitlGate: failed to restore ${path} (non-fatal): ` +
             `${err instanceof Error ? err.message : err}`);
     }
 }
 /**
- * Write the runner-owned gate artifacts (approval-state file, fresh denial
- * ledger, hook script) into the session HITL directory and return the absolute
- * hook-script path. The script is regenerated every turn so the current runner
- * PID and the current state-file/ledger paths are always baked in.
+ * Delete pre-#173 in-workspace gate leftovers: the runner-owned `stigmer-*`
+ * files an older runner build wrote to `.cursor/hooks/` (the hook script, its
+ * approval-state, its denial ledger). These are the orphan that shadows the
+ * current gate (see installHitlGate). Best-effort and never throws — a cleanup
+ * failure must not fail the run.
+ *
+ * Only `stigmer-`-prefixed files are removed (the unmistakably runner-owned
+ * namespace, like the rule filename), so a user's own scripts in `.cursor/hooks`
+ * are untouched; the directory itself is removed only if it ends up empty.
+ */
+async function removeLegacyWorkspaceHookArtifacts(workspaceRoot) {
+    const hooksDir = join(workspaceRoot, CURSOR_DIR, LEGACY_HOOKS_DIR);
+    let entries;
+    try {
+        entries = await readdir(hooksDir);
+    }
+    catch {
+        return; // no legacy hooks dir — nothing to heal
+    }
+    let removedAny = false;
+    for (const name of entries) {
+        if (!name.startsWith(RUNNER_OWNED_HOOK_FILE_PREFIX))
+            continue;
+        try {
+            await rm(join(hooksDir, name), { force: true });
+            removedAny = true;
+        }
+        catch (err) {
+            console.warn(`removeLegacyWorkspaceHookArtifacts: failed to remove ${name} (non-fatal): ` +
+                `${err instanceof Error ? err.message : err}`);
+        }
+    }
+    if (removedAny) {
+        // rmdir only succeeds on an empty dir, so a user who keeps their own hooks
+        // here is left untouched; an empty (entirely-ours) dir is cleaned away.
+        try {
+            await rmdir(hooksDir);
+        }
+        catch {
+            // Non-empty (user owns other hooks) or already gone — nothing to clean.
+        }
+    }
+}
+/**
+ * Write this turn's gate artifacts and return the STABLE hook-script path plus
+ * the workspace gate directory.
+ *
+ * Two surfaces, deliberately split by scope:
+ *
+ * - Per-SESSION (in {@link hitlDir}): the approval-state file (hook input) and a
+ *   freshly-reset denial ledger (hook output the runner reads). Reset every turn
+ *   so the runner only ever reads denials from the current run, even across HITL
+ *   reinvocations and Temporal activity retries.
+ *
+ * - Per-WORKSPACE (in the gate dir): the STABLE hook script and the active-turn
+ *   pointer. The script path is stable across executions because the Cursor SDK
+ *   caches `.cursor/hooks.json` (the script path) for the runner process — a
+ *   per-session script would be cached at the first execution and reused for all
+ *   later ones, sending their denials to the first session's ledger (the
+ *   empty-ledger → COMPLETED regression). The script bakes NO per-session paths;
+ *   it reads the pointer, which we repoint (atomically) every turn to THIS turn's
+ *   state file, ledger, and runner PID. See generateHookScript / writeActiveTurnPointer.
  */
-async function writeHitlArtifacts(hitlDir, approvalState, runnerPid) {
+async function writeHitlArtifacts(workspaceRoot, hitlDir, approvalState, runnerPid) {
     await mkdir(hitlDir, { recursive: true });
     const stateFilePath = await writeApprovalStateFile(hitlDir, approvalState);
-    // Reset the denial ledger for this turn so the runner only reads denials
-    // produced by the current run, even across HITL reinvocations on the durable
-    // HITL directory and Temporal activity retries.
     const ledgerFilePath = await resetDenialLedger(hitlDir);
-    const approvalScriptPath = join(hitlDir, HOOK_SCRIPT_FILE);
-    await writeFile(approvalScriptPath, generateHookScript(stateFilePath, ledgerFilePath, runnerPid), "utf-8");
-    await chmod(approvalScriptPath, 0o755);
-    return approvalScriptPath;
+    // Reset the cas-observations sidecar too, so the turn boundary only ever reads
+    // gitignored observations the hook staged this run (deterministic across HITL
+    // reinvocations and Temporal retries, exactly like the denial ledger).
+    await resetCasObservations(hitlDir);
+    const gateDir = await ensureHitlGateDir(workspaceRoot);
+    const pointerPath = activePointerPath(gateDir);
+    const scriptPath = join(gateDir, HOOK_SCRIPT_FILE);
+    // Bake the workspace root so capture mode's `git check-ignore` runs against the
+    // right repo regardless of the hook's cwd. The root is stable per workspace
+    // (the gate dir is keyed by it), so the script stays stable across executions.
+    await writeFile(scriptPath, generateHookScript(pointerPath, workspaceRoot), "utf-8");
+    await chmod(scriptPath, 0o755);
+    // Point the stable hook at THIS turn's per-session artifacts (atomic, last
+    // write wins) — the single indirection that makes a process-cached hook resolve
+    // the current execution instead of the first one's.
+    await writeActiveTurnPointer(gateDir, {
+        stateFile: stateFilePath,
+        ledgerFile: ledgerFilePath,
+        runnerPid,
+    });
+    return { scriptPath, gateDir };
 }
 /**
  * Snapshot the workspace's existing `.cursor/hooks.json`, write a merged config
@@ -123,6 +257,28 @@ async function installWorkspaceHook(workspaceRoot, registrations) {
     await writeFile(hooksJsonPath, merged, "utf-8");
     return { hooksJsonPath, restoreTo };
 }
+/**
+ * Snapshot and install the always-applied tool-approval rule into
+ * `.cursor/rules/stigmer-tool-approval.mdc`, returning the path + restore
+ * target. The filename is runner-owned, so restoreTo is normally null (teardown
+ * deletes it); if a same-named file somehow pre-exists (e.g. a crash-leftover
+ * from a prior turn), its bytes are captured and restored so we never clobber a
+ * file we did not create.
+ */
+async function installWorkspaceRule(workspaceRoot) {
+    const rulesDir = join(workspaceRoot, CURSOR_DIR, RULES_DIR);
+    const rulePath = join(rulesDir, TOOL_APPROVAL_RULE_FILE);
+    let restoreTo = null;
+    try {
+        restoreTo = await readFile(rulePath, "utf-8");
+    }
+    catch {
+        restoreTo = null;
+    }
+    await mkdir(rulesDir, { recursive: true });
+    await writeFile(rulePath, buildToolApprovalRuleFile(), "utf-8");
+    return { path: rulePath, restoreTo };
+}
 /**
  * A hook entry the gate installs. Absolute `command` so the hook is found
  * regardless of which workspace root a multi-root IDE resolves against.
@@ -131,18 +287,31 @@ function buildHookEntry(scriptPath) {
     return { command: scriptPath, timeout: HOOK_TIMEOUT_SECONDS, failClosed: true };
 }
 /**
- * Identify a hook entry the gate itself wrote (in this or a prior, crash-leftover
- * turn) so a re-install never duplicates it and a restore strips it. Matched by
- * the unmistakable runner-owned HITL script path (`~/.stigmer/sessions/.../*.sh`),
- * never by a user's own hook — covers every event and every gate script.
+ * Identify a hook entry the gate itself wrote — in this turn, a prior
+ * crash-leftover turn, or a pre-#173 runner build — so a re-install never
+ * duplicates it and a restore strips it. Matches two runner-owned shapes, never
+ * a user's own hook:
+ *
+ * 1. Current: any script under the runner-owned `~/.stigmer/` tree (the session
+ *    HITL dir or the workspace gate dir, `~/.stigmer/.../*.sh`) — location-based,
+ *    so it covers every gate script regardless of name.
+ * 2. Legacy: a `stigmer-*.sh` script (historically the in-workspace
+ *    `.cursor/hooks/stigmer-approval.sh`) — recognized by its unmistakably
+ *    runner-owned basename. Without this, the old in-workspace hook is treated
+ *    as a user hook and preserved by the merge, so it keeps running alongside
+ *    (and vetoing) the current gate. The `stigmer-` prefix is the same
+ *    runner-owned namespace convention as the rule filename.
  */
 function isStigmerHookEntry(entry) {
     if (!entry || typeof entry !== "object")
         return false;
     const command = entry.command;
-    return (typeof command === "string" &&
-        command.includes("/.stigmer/sessions/") &&
-        command.endsWith(".sh"));
+    if (typeof command !== "string" || command.length === 0)
+        return false;
+    if (command.includes("/.stigmer/") && command.endsWith(".sh"))
+        return true;
+    const file = basename(command);
+    return file.startsWith(RUNNER_OWNED_HOOK_FILE_PREFIX) && file.endsWith(".sh");
 }
 const STANDALONE_CONFIG = (registrations) => JSON.stringify({ version: 1, hooks: mergeHooks({}, registrations).hooks }, null, 2);
 /**
@@ -203,11 +372,21 @@ export function buildMergedConfig(originalRaw, registrations) {
     const version = typeof root.version === "number" ? root.version : 1;
     const { hooks: mergedHooks, cleaned, strippedStale } = mergeHooks(hooks, registrations);
     const merged = JSON.stringify({ ...root, version, hooks: mergedHooks }, null, 2);
-    // Restore the user's exact original bytes — unless we stripped a stale Stigmer
-    // entry, in which case restore the cleaned form so our leftover never lingers.
-    const restoreTo = strippedStale
-        ? JSON.stringify({ ...root, version, hooks: cleaned }, null, 2)
-        : originalRaw;
+    // No stale Stigmer entry → restore the user's exact original bytes.
+    if (!strippedStale) {
+        return { merged, restoreTo: originalRaw };
+    }
+    // We stripped a stale Stigmer entry, so never restore the original bytes (that
+    // would re-plant our leftover). If stripping leaves NO user hooks at all and
+    // the file carried nothing but `version`/`hooks`, the entire hooks.json was our
+    // own leftover (the pre-#173 design wrote the whole file) — delete it on
+    // teardown so a polluted repo is left pristine. Otherwise restore the cleaned,
+    // Stigmer-free form, preserving the user's other hooks and root fields.
+    const onlyVersionAndHooks = Object.keys(root).every((k) => k === "version" || k === "hooks");
+    const noUserHooksRemain = Object.values(cleaned).every((v) => Array.isArray(v) && v.length === 0);
+    const restoreTo = onlyVersionAndHooks && noUserHooksRemain
+        ? null
+        : JSON.stringify({ ...root, version, hooks: cleaned }, null, 2);
     return { merged, restoreTo };
 }
 //# sourceMappingURL=workspace-setup.js.map

package/dist/activities/execute-cursor/workspace-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-setup.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/workspace-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAC;AAExG,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAQ9C,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAiBhC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAKrC;IACC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEpE,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACvF,4EAA4E;IAC5E,+EAA+E;IAC/E,2DAA2D;IAC3D,OAAO,oBAAoB,CAAC,aAAa,EAAE;QACzC,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;QAC7D,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE;KAC5D,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAsB;IACzD,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,qCAAqC,MAAM,CAAC,aAAa,gBAAgB;YACzE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,aAAgC,EAChC,SAAiB;IAEjB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3E,yEAAyE;IACzE,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAExD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,SAAS,CACb,kBAAkB,EAClB,kBAAkB,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,CAAC,EAC5D,OAAO,CACR,CAAC;IACF,MAAM,KAAK,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAEvC,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,aAAqB,EACrB,aAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEzD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE5E,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,OAAO,CACL,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxB,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,aAAiC,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtF;;;;GAIG;AACH,SAAS,UAAU,CACjB,aAAsC,EACtC,aAAiC;IAEjC,MAAM,KAAK,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAC;IAC5D,MAAM,OAAO,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAC;IAC9D,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,aAAa,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,aAAa,CAAC,KAAK,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,aAAa,GAAG,IAAI,CAAC;QAEjE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA0B,EAC1B,aAAiC;IAEjC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACxE,CAAC,CAAE,IAAI,CAAC,KAAiC;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAExF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjF,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,SAAS,GAAG,aAAa;QAC7B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,WAAW,CAAC;IAEhB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"workspace-setup.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/workspace-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAE3E,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,iBAAiB,GAAG,YAAY,CAAC;AACvC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,MAAM,SAAS,GAAG,OAAO,CAAC;AAC1B,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,2DAA2D;AAC3D,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,6BAA6B,GAAG,UAAU,CAAC;AACjD,4EAA4E;AAC5E,+DAA+D;AAC/D,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,YAAY,CAAC;AACxC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAQ9C,sEAAsE;AACtE,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAmChC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAKrC;IACC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAEpE,2EAA2E;IAC3E,8EAA8E;IAC9E,oEAAoE;IACpE,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,kCAAkC,CAAC,aAAa,CAAC,CAAC;IAExD,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAC1E,aAAa,EACb,OAAO,EACP,aAAa,EACb,SAAS,CACV,CAAC;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE;QAC3D,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,EAAE;QAC7D,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE;KAC5D,CAAC,CAAC;IAEH,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAEvD,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAsB;IACzD,MAAM,oBAAoB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACnE,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,wEAAwE;QACxE,oDAAoD;QACpD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAwB;IACxE,IAAI,CAAC;QACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,qCAAqC,IAAI,gBAAgB;YACzD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,kCAAkC,CAAC,aAAqB;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,wCAAwC;IAClD,CAAC;IAED,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,wDAAwD,IAAI,gBAAgB;gBAC5E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QACf,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,kBAAkB,CAC/B,aAAqB,EACrB,OAAe,EACf,aAAgC,EAChC,SAAiB;IAEjB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxD,+EAA+E;IAC/E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnD,gFAAgF;IAChF,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;IACrF,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAE/B,2EAA2E;IAC3E,gFAAgF;IAChF,oDAAoD;IACpD,MAAM,sBAAsB,CAAC,OAAO,EAAE;QACpC,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,cAAc;QAC1B,SAAS;KACV,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,aAAqB,EACrB,aAAiC;IAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAEzD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE5E,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IAEzD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,yBAAyB,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,aAAiC,EAAU,EAAE,CACtE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtF;;;;GAIG;AACH,SAAS,UAAU,CACjB,aAAsC,EACtC,aAAiC;IAEjC,MAAM,KAAK,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAC;IAC5D,MAAM,OAAO,GAA4B,EAAE,GAAG,aAAa,EAAE,CAAC;IAC9D,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,aAAa,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAE,aAAa,CAAC,KAAK,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,aAAa,GAAG,IAAI,CAAC;QAEjE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,4EAA4E;QAC5E,6DAA6D;QAC7D,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA0B,EAC1B,aAAiC;IAEjC,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QACxE,CAAC,CAAE,IAAI,CAAC,KAAiC;QACzC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAExF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjF,oEAAoE;IACpE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,yEAAyE;IACzE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CACjD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,OAAO,CACxC,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,IAAI,iBAAiB;QACxD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAElE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}

package/dist/activities/execute-deep-agent/__test-utils__/gateway-substrate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Deep-agent adapter for the HITL gateway Contract Test Kit.
+ *
+ * Drives the REAL in-process gateway: a `createDeepAgent` graph carrying the
+ * production {@link createApprovalGateMiddleware}, a `MemorySaver` checkpointer,
+ * and a scripted model that proposes the action under test. `authorize` runs the
+ * graph to its first pause and, for an approving/non-approving decision, resumes
+ * via `Command(resume=…)` — exactly the production pause/resume cycle proven in
+ * `__tests__/subagent-approval-propagation.test.ts`. There is no mocked
+ * `interrupt()`: the gate's own `interrupt()` fires, so the contract exercises the
+ * gateway end-to-end.
+ *
+ * Capabilities: this substrate IS the side effect, so it observes (and counts)
+ * execution; resource-exact leasing is not a property of this gate (sameness comes
+ * from checkpoint replay), so `enforcesExactResource` is false and
+ * `authorizeAfterGrant` is intentionally not implemented.
+ */
+import type { GatewaySubstrate } from "../../../__test-utils__/approval-contract/types.js";
+export declare function createDeepAgentSubstrate(): GatewaySubstrate;

package/dist/activities/execute-deep-agent/__test-utils__/gateway-substrate.js

@@ -0,0 +1,143 @@
+/**
+ * Deep-agent adapter for the HITL gateway Contract Test Kit.
+ *
+ * Drives the REAL in-process gateway: a `createDeepAgent` graph carrying the
+ * production {@link createApprovalGateMiddleware}, a `MemorySaver` checkpointer,
+ * and a scripted model that proposes the action under test. `authorize` runs the
+ * graph to its first pause and, for an approving/non-approving decision, resumes
+ * via `Command(resume=…)` — exactly the production pause/resume cycle proven in
+ * `__tests__/subagent-approval-propagation.test.ts`. There is no mocked
+ * `interrupt()`: the gate's own `interrupt()` fires, so the contract exercises the
+ * gateway end-to-end.
+ *
+ * Capabilities: this substrate IS the side effect, so it observes (and counts)
+ * execution; resource-exact leasing is not a property of this gate (sameness comes
+ * from checkpoint replay), so `enforcesExactResource` is false and
+ * `authorizeAfterGrant` is intentionally not implemented.
+ */
+import { HumanMessage } from "@langchain/core/messages";
+import { tool } from "@langchain/core/tools";
+import { z } from "zod";
+import { Command, MemorySaver } from "@langchain/langgraph";
+import { createDeepAgent, StateBackend } from "deepagents";
+import { createApprovalGateMiddleware } from "../../../middleware/approval-gate.js";
+import { deriveLeaseScope } from "../../../shared/approval-policy.js";
+import { ScriptedModel, readPendingInterrupts } from "./scripted-model.js";
+/**
+ * Translate an abstract action into a deep-agent tool name + args + MCP server.
+ * The names are deliberately ALIASES, not deepagents built-ins, so we can attach
+ * a counting handler without shadowing an injected built-in, while still hitting
+ * the right approval category via the shared classifier:
+ *  - write  → `overwrite_file` (FILE_WRITE), delete → `remove_file` (FILE_DELETE),
+ *    shell → `execute_command` (SHELL): each gated fail-closed by category.
+ *  - read   → an unknown, non-mutating name: auto-approved (fail-open), no gate.
+ *  - mcp    → the MCP tool name mapped to its server: governed by policy, absent
+ *    policy ⇒ auto-approved.
+ */
+function toDeepAgentTool(action) {
+    switch (action.kind) {
+        case "write":
+            return { name: "overwrite_file", args: { path: action.resource, content: "x" }, serverSlug: "" };
+        case "shell":
+            return { name: "execute_command", args: { command: action.resource }, serverSlug: "" };
+        case "delete":
+            return { name: "remove_file", args: { path: action.resource }, serverSlug: "" };
+        case "read":
+            return { name: "inspect_resource", args: { path: action.resource }, serverSlug: "" };
+        case "mcp":
+            return { name: action.mcpToolName ?? "mcp_tool", args: {}, serverSlug: action.mcpServerSlug ?? "srv" };
+    }
+}
+/** Map a contract decision to the gate's resume verdict (anything unrecognized = unknown). */
+function toResumeAction(decision) {
+    switch (decision) {
+        case "approve":
+            return "approve";
+        case "skip":
+            return "skip";
+        case "reject":
+            return "reject";
+        default:
+            return "unrecognized-verdict";
+    }
+}
+let threadSeq = 0;
+/**
+ * Drive one probe action through a freshly built gate and report the outcome.
+ * `leasedCategories` pre-arms a run-lifetime class lease (empty for the plain
+ * authorize path); `decision` resumes a pause for the non-lease drives.
+ */
+async function runProbe(action, decision, leasedCategories) {
+    const { name, args, serverSlug } = toDeepAgentTool(action);
+    let executionCount = 0;
+    const countingTool = tool(async () => {
+        executionCount += 1;
+        return "ok";
+    }, {
+        name,
+        description: `contract probe tool ${name}`,
+        schema: z.object({}).passthrough(),
+    });
+    const toolServerMap = serverSlug ? new Map([[name, serverSlug]]) : new Map();
+    const gate = createApprovalGateMiddleware({
+        policies: new Map(),
+        toolServerMap,
+        leasedCategories,
+    });
+    const agent = await createDeepAgent({
+        model: new ScriptedModel(() => ({
+            toolCalls: [{ name, args, id: "call_1" }],
+            done: "done",
+        })),
+        checkpointer: new MemorySaver(),
+        backend: new StateBackend(),
+        tools: [countingTool],
+        middleware: [gate],
+    });
+    const config = { configurable: { thread_id: `contract-${threadSeq++}` }, recursionLimit: 50 };
+    // Run to the first pause. A gated tool interrupts before its handler runs.
+    await agent.invoke({ messages: [new HumanMessage({ content: "go" })] }, config);
+    const pending = readPendingInterrupts((await agent.getState(config)));
+    const gated = pending.length > 0;
+    // The gate stamps the authorization provenance on every interrupt it raises;
+    // surface it so the contract can assert no side effect is gated without one.
+    const policySource = gated ? pending[0].policySource : "";
+    // `none` is the "no decision yet" probe: leave the action withheld.
+    if (gated && decision !== "none") {
+        const resume = {};
+        for (const p of pending)
+            resume[p.interruptId] = { action: toResumeAction(decision) };
+        await agent.invoke(new Command({ resume }), config);
+    }
+    return { executed: executionCount > 0, gated, executionCount, policySource };
+}
+const NO_LEASED_CATEGORIES = new Set();
+export function createDeepAgentSubstrate() {
+    return {
+        name: "deep-agent",
+        available: true,
+        capabilities: {
+            observesExecution: true,
+            enforcesExactResource: false,
+            // The deep-agent gate re-checks every distinct call and relies on
+            // checkpoint replay for sameness; content isolation is not a property of
+            // the gate itself, so the content-exact invariant does not apply here.
+            enforcesExactContent: false,
+            appliesRunLifetimeLease: true,
+            surfacesGatePolicySource: true,
+        },
+        async authorize(action, decision) {
+            return runProbe(action, decision, NO_LEASED_CATEGORIES);
+        },
+        async authorizeUnderClassLease(leased, probe) {
+            // Reduce the leased action to its class exactly as the runner does, then
+            // arm the gate with that category lease and run the probe with no fresh
+            // decision — so only the lease can clear it.
+            const leasedTool = toDeepAgentTool(leased);
+            const scope = deriveLeaseScope(leasedTool.name, leasedTool.serverSlug);
+            const leasedCategories = scope?.kind === "category" ? new Set([scope.category]) : NO_LEASED_CATEGORIES;
+            return runProbe(probe, "none", leasedCategories);
+        },
+    };
+}
+//# sourceMappingURL=gateway-substrate.js.map

package/dist/activities/execute-deep-agent/__test-utils__/gateway-substrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-substrate.js","sourceRoot":"","sources":["../../../../src/activities/execute-deep-agent/__test-utils__/gateway-substrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAQ3E;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,MAAsB;IAK7C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACnG,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACzF,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAClF,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvF,KAAK,KAAK;YACR,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,IAAI,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,aAAa,IAAI,KAAK,EAAE,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,cAAc,CAAC,QAAyB;IAC/C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,sBAAsB,CAAC;IAClC,CAAC;AACH,CAAC;AAED,IAAI,SAAS,GAAG,CAAC,CAAC;AAElB;;;;GAIG;AACH,KAAK,UAAU,QAAQ,CACrB,MAAsB,EACtB,QAAyB,EACzB,gBAAmD;IAEnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE3D,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,YAAY,GAAG,IAAI,CACvB,KAAK,IAAI,EAAE;QACT,cAAc,IAAI,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC,EACD;QACE,IAAI;QACJ,WAAW,EAAE,uBAAuB,IAAI,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;KACnC,CACF,CAAC;IAEF,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;IAC7F,MAAM,IAAI,GAAG,4BAA4B,CAAC;QACxC,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,aAAa;QACb,gBAAgB;KACjB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC;QAClC,KAAK,EAAE,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;YACzC,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,YAAY,EAAE,IAAI,WAAW,EAAW;QACxC,OAAO,EAAE,IAAI,YAAY,EAAE;QAC3B,KAAK,EAAE,CAAC,YAAY,CAAC;QACrB,UAAU,EAAE,CAAC,IAAI,CAAC;KACiC,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,YAAY,SAAS,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;IAE9F,2EAA2E;IAC3E,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAU,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACjC,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1D,oEAAoE;IACpE,IAAI,KAAK,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAuC,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtF,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC/E,CAAC;AAED,MAAM,oBAAoB,GAAsC,IAAI,GAAG,EAAE,CAAC;AAE1E,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE;YACZ,iBAAiB,EAAE,IAAI;YACvB,qBAAqB,EAAE,KAAK;YAC5B,kEAAkE;YAClE,yEAAyE;YACzE,uEAAuE;YACvE,oBAAoB,EAAE,KAAK;YAC3B,uBAAuB,EAAE,IAAI;YAC7B,wBAAwB,EAAE,IAAI;SAC/B;QAED,KAAK,CAAC,SAAS,CAAC,MAAsB,EAAE,QAAyB;YAC/D,OAAO,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,wBAAwB,CAC5B,MAAsB,EACtB,KAAqB;YAErB,yEAAyE;YACzE,wEAAwE;YACxE,6CAA6C;YAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YACvE,MAAM,gBAAgB,GACpB,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;YAChF,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activities/execute-deep-agent/__test-utils__/scripted-model.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Scripted deep-agent test harness: a deterministic chat model plus the
+ * parent-checkpoint interrupt reader.
+ *
+ * These two helpers are what every "drive a real deepagents/LangGraph graph
+ * through the approval gate" test needs, and they were previously copy-pasted
+ * inline. They are shared by:
+ * - `__tests__/subagent-approval-propagation.test.ts` (sub-agent interrupt
+ *   propagation against the real runtime), and
+ * - `__test-utils__/gateway-substrate.ts` (the deep-agent adapter for the
+ *   gateway Contract Test Kit).
+ *
+ * Keeping one copy means a change to how the runner reads pending interrupts (or
+ * how a scripted run is driven) updates every consumer at once.
+ */
+import { BaseChatModel } from "@langchain/core/language_models/chat_models";
+import { type BaseMessage } from "@langchain/core/messages";
+import type { ChatResult } from "@langchain/core/outputs";
+/** A single tool call the scripted model proposes on a non-terminal turn. */
+export interface ScriptedToolCall {
+    name: string;
+    args: Record<string, unknown>;
+    id: string;
+}
+/**
+ * What the scripted model does for a given role: propose `toolCalls` while no
+ * tool result is pending, then emit the `done` text once a tool result returns.
+ */
+export interface ScriptStep {
+    toolCalls: ScriptedToolCall[];
+    done: string;
+}
+/**
+ * Picks the {@link ScriptStep} for the currently-bound tool set. A single-agent
+ * test ignores the argument; a parent/sub-agent test keys the role on a tool
+ * unique to one role (e.g. the sub-agent's gated tool), because `createDeepAgent`
+ * injects the `task` tool into both the parent and its sub-agents.
+ */
+export type ScriptSelector = (boundToolNames: string[]) => ScriptStep;
+/**
+ * A deterministic two-turn chat model: on the first turn it proposes the
+ * selected role's tool calls; once a tool result comes back it returns the
+ * role's terminating text. No LLM, no network — the role is keyed on the bound
+ * tool names so the same model instance drives a parent and its sub-agents.
+ */
+export declare class ScriptedModel extends BaseChatModel {
+    toolNames: string[];
+    private readonly select;
+    constructor(select: ScriptSelector);
+    _llmType(): string;
+    bindTools(tools: unknown[]): this;
+    _generate(messages: BaseMessage[]): Promise<ChatResult>;
+}
+/** A pending approval interrupt surfaced at the parent checkpoint. */
+export interface PendingInterrupt {
+    taskId: string;
+    interruptId: string;
+    toolCallId: string;
+    toolName: string;
+    message: string;
+    /**
+     * Authorization provenance the gate attached to the interrupt
+     * (approval-gate.ts `policy_source`) — the PolicySource union string, or "" for
+     * legacy. Lets the gateway contract assert every gated side effect is
+     * provenance-tagged.
+     */
+    policySource: string;
+}
+/**
+ * Read the pending approval interrupts from a graph state, exactly as the
+ * production resume path does (`hitl.ts` / `index.ts`): scan the parent's
+ * top-level `tasks[].interrupts`, skipping any already carrying a resume value.
+ *
+ * Crucially `interruptId` is the interrupt's OWN id (`interrupts[].id`), not the
+ * owning `task.id` — for a nested sub-agent interrupt the two differ, and only
+ * the interrupt id routes a `Command(resume=...)` value back into the nested
+ * `interrupt()`.
+ */
+export declare function readPendingInterrupts(state: {
+    tasks?: ReadonlyArray<{
+        id: string;
+        interrupts?: ReadonlyArray<{
+            id?: string;
+            value?: unknown;
+            resumeValue?: unknown;
+        }>;
+    }>;
+}): PendingInterrupt[];