@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/src/middleware/approval-gate.ts

@@ -16,9 +16,31 @@
  * pausing again.
  *
  * Platform tool defaults: DeepAgents JS backend tools (read, write,
- * edit, execute, etc.) are not covered by MCP policy chains. This
- * middleware applies sensible defaults: read-only tools are auto-approved,
- * mutating tools require approval when no explicit policy exists.
+ * edit, execute, etc.) are not covered by MCP policy chains. Built-in tools
+ * are classified through the shared {@link toolApprovalCategory} — the single
+ * source of truth, shared with the Cursor deny-oracle hook — so read-only tools
+ * are auto-approved and every mutating tool (write/edit/delete/shell) is gated
+ * fail-CLOSED, by category rather than by a hand-maintained name list. An
+ * unrecognized mutating built-in (e.g. `bash`, `overwrite_file`) is therefore
+ * gated by what it does, not by whether someone remembered to list it.
+ *
+ * Gateway invariant (Phase 2): this middleware IS the in-process execution
+ * gateway for the deep-agent harness — `handler(request)` is the side effect. A
+ * side effect runs only with a backing authorization: either (a) the tool was
+ * auto-approved (policy/classifier cleared it, or auto-approve-all disabled the
+ * whole gate), or (b) the user explicitly approved THIS interrupted call. Every
+ * other outcome — skip, reject, or an unrecognized decision — returns a
+ * ToolMessage WITHOUT executing. There is no path from a model proposal to a
+ * side effect that skips an authorization.
+ *
+ * Shadow ExecutionReceipt: when the gateway lets a side effect through it emits a
+ * structured, non-persisted receipt (a `[hitl-gateway] receipt …` log carrying
+ * the action's HMAC fingerprint and the authorization source). This is an audit
+ * + uniformity signal only — no proto, no storage — mirroring the Phase-1 shadow
+ * discipline. On the deep-agent normal path the fingerprint match is guaranteed
+ * by LangGraph checkpoint replay (the resumed action equals the approved one), so
+ * the receipt is defense-in-depth here; the fingerprint earns real enforcement
+ * teeth in the out-of-process Cursor substrate.
  */
 
 import { ToolMessage } from "@langchain/core/messages";
@@ -26,13 +48,79 @@ import { interrupt } from "@langchain/langgraph";
 import type { StigmerMiddleware, ToolCallRequest } from "./types.js";
 import {
   type MergedToolPolicy,
+  type PolicySource,
+  POLICY_ENGINE_VERSION,
   resolveApprovalMessage,
 } from "../shared/approval-policy.js";
+import { toolApprovalCategory, type ToolApprovalCategory } from "../shared/tool-kind.js";
+import { extractFilePath } from "../shared/file-tools.js";
+import { isSecretLikePath } from "../shared/filereview/secret-paths.js";
+import {
+  computeApprovalFingerprint,
+  type FingerprintKey,
+} from "../shared/approval-fingerprint.js";
 
 export interface ApprovalGateConfig {
   readonly policies: ReadonlyMap<string, MergedToolPolicy>;
-  readonly autoApproveAll: boolean;
+  /**
+   * Built-in approval categories with a run-lifetime lease (the scoped successor
+   * to auto-approve-all; see ActiveLeases). A built-in whose category is leased
+   * is auto-approved for the rest of the run. MCP-server leases are NOT carried
+   * here — they are applied upstream by dropping the server's tools from
+   * `policies` (mergeApprovalPolicies), which clears them for this gate too.
+   * Absent/empty means no built-in lease is active. Inherited verbatim by
+   * sub-agents along with the rest of this config.
+   */
+  readonly leasedCategories?: ReadonlySet<ToolApprovalCategory>;
   readonly toolServerMap: ReadonlyMap<string, string>;
+  /**
+   * Per-execution HMAC key for the shadow receipt's action fingerprint. Derived
+   * from the runner master secret + execution_id (see fingerprint-secret.ts).
+   * Optional: when absent (unit tests, no-secret paths) the receipt is emitted
+   * without a fingerprint rather than failing.
+   */
+  readonly fingerprintKey?: FingerprintKey;
+  /** Execution id, carried into the shadow receipt for audit correlation. */
+  readonly executionId?: string;
+  /**
+   * Apply-then-review capture mode (git workspaces). When true, a built-in
+   * `write`/`delete` whose target path is capturable (git-tracked — see
+   * {@link isCapturablePath}) FLOWS instead of interrupting: the edit is reviewed
+   * post-hoc as a captured `FileChangeSet`, not gated before it runs. A gitignored
+   * path is NOT capturable, so it stays gated (the git substrate cannot capture or
+   * revert it) — the exact twin of the Cursor hook's `__stigmer_is_gitignored`
+   * allow-branch. `shell` and MCP tools are never bypassed by this flag. Off (the
+   * default) keeps the classic true-pause gate for every mutation.
+   */
+  readonly fileCaptureMode?: boolean;
+  /**
+   * Capturability predicate for {@link fileCaptureMode}: given a tool's raw target
+   * path (as the model wrote it), resolves true when the path would be captured by
+   * the git snapshot (tracked / not gitignored). Injected by setup so the gate
+   * stays pure and testable, and so the harness owns path normalization (the
+   * deep-agent virtual-root path mapping). Absent ⇒ nothing is bypassed (safe).
+   */
+  readonly isCapturablePath?: (rawPath: string) => Promise<boolean>;
+  /**
+   * Route gitignored `write`/`edit` edits into CAS capture (apply-then-review)
+   * instead of the interrupt gate, applying the DD-E secret gate. When off, a
+   * gitignored path stays on the interrupt gate exactly as before.
+   *
+   * TRUE ONLY FOR THE PARENT GATE. Sub-agents build their own plain filesystem
+   * backends, which the CAS observer does not wrap, so flowing their gitignored
+   * edits would apply unobserved, unreviewable bytes. `buildSubAgentMiddleware`
+   * therefore forces this to false for sub-agent gates — it must NOT be inherited
+   * as true. (Sub-agent git-tracked edits are still captured by the turn-boundary
+   * git diff, which is backend-agnostic.)
+   */
+  readonly captureIgnored?: boolean;
+  /**
+   * Sink for a gitignored path hard-blocked as secret-like (DD-E): the write is
+   * never applied and never captured, and the turn boundary reads these paths to
+   * author a `DIFF_UNREVIEWABLE` change entry (path only — the name is not the
+   * secret; the CONTENT never leaves the workspace). Absent ⇒ nothing recorded.
+   */
+  readonly recordBlockedSecret?: (rawPath: string) => void;
 }
 
 interface ApprovalDecision {
@@ -40,36 +128,25 @@ interface ApprovalDecision {
   readonly comment?: string;
 }
 
-const SAFE_PLATFORM_TOOLS = new Set([
-  "read", "read_file",
-  "ls", "list_directory",
-  "glob", "find_files",
-  "grep", "search", "ripgrep",
-  "think",
-]);
-
-const DANGEROUS_PLATFORM_TOOLS = new Map<string, string>([
-  ["write", "Write file: {{args.path}}"],
-  ["write_file", "Write file: {{args.path}}"],
-  ["edit", "Edit file: {{args.path}}"],
-  ["edit_file", "Edit file: {{args.path}}"],
-  ["create", "Create file: {{args.path}}"],
-  ["create_file", "Create file: {{args.path}}"],
-  ["delete", "Delete: {{args.path}}"],
-  ["delete_file", "Delete file: {{args.path}}"],
-  ["execute", "Execute command: {{args.command}}"],
-  ["shell", "Execute shell command: {{args.command}}"],
-  ["str_replace_editor", "Edit file: {{args.path}}"],
-]);
+// Approval-message template per mutating category. Keyed by category (not raw
+// tool name) so every alias of a mutation renders one message; placeholders
+// resolve against the deep-agent stream arg shape (`path`/`command`). Mirrors
+// the Cursor side's CATEGORY_APPROVAL_MESSAGE.
+const CATEGORY_APPROVAL_MESSAGE: Record<ToolApprovalCategory, string> = {
+  write: "Write file: {{args.path}}",
+  delete: "Delete: {{args.path}}",
+  shell: "Execute command: {{args.command}}",
+};
 
 export function createApprovalGateMiddleware(
   config: ApprovalGateConfig,
 ): StigmerMiddleware {
-  const { policies, autoApproveAll, toolServerMap } = config;
+  const { policies, toolServerMap } = config;
+  const leasedCategories = config.leasedCategories ?? EMPTY_CATEGORY_SET;
 
-  if (autoApproveAll) {
-    return { name: "ApprovalGateMiddleware" };
-  }
+  // No global-bypass early return: a pre-armed spec.auto_approve_all means the
+  // gate is never even installed (setup.ts builds this config only when not
+  // global). Scoped leases keep the gate active so non-leased actions still gate.
 
   return {
     name: "ApprovalGateMiddleware",
@@ -78,15 +155,65 @@ export function createApprovalGateMiddleware(
       const { toolCall } = request;
       const toolName = toolCall.name;
       const serverSlug = toolServerMap.get(toolName) ?? "";
+      const category = toolApprovalCategory(toolName);
+
+      // Capture mode (git workspaces): a git-tracked built-in file mutation flows
+      // during the turn and is reviewed post-hoc via the file_review ledger (the
+      // apply-then-review model). shell and MCP tools (serverSlug present) are
+      // never bypassed here.
+      if (
+        config.fileCaptureMode &&
+        config.isCapturablePath &&
+        !serverSlug &&
+        (category === "write" || category === "delete")
+      ) {
+        const path = extractFilePath(toolCall.args);
+        if (path !== null) {
+          if (await config.isCapturablePath(path)) {
+            // Git-tracked: flows and is reviewed post-hoc by the git substrate.
+            emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", "file_capture");
+            return await handler(request);
+          }
+          // Gitignored path. Only the PARENT gate (captureIgnored) routes it into
+          // CAS capture; sub-agent gates fall through to the interrupt gate below,
+          // exactly as before (their backends are not CAS-observed).
+          if (config.captureIgnored) {
+            if (isSecretLikePath(path)) {
+              // DD-E fail-closed: a secret-like gitignored edit is NEVER applied
+              // and NEVER captured. Record it so the turn boundary authors a
+              // DIFF_UNREVIEWABLE entry (blocking approval); nothing is written.
+              config.recordBlockedSecret?.(path);
+              return new ToolMessage({
+                content:
+                  `Tool '${toolName}' was blocked for security: '${path}' matches a ` +
+                  `secret-like path Stigmer will not capture for review. Nothing was written.`,
+                tool_call_id: toolCall.id,
+                name: toolName,
+              });
+            }
+            if (category === "write") {
+              // Non-secret gitignored write/edit: flows (apply-then-review). The
+              // CAS observer already holds its before-bytes and the turn boundary
+              // captures it into CAS. (A gitignored delete has no backend capture
+              // path, so it falls through to the interrupt gate.)
+              emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", "file_capture");
+              return await handler(request);
+            }
+          }
+        }
+      }
 
       const requirement = resolveToolApproval(
         toolName,
         serverSlug,
         toolCall.args,
         policies,
+        leasedCategories,
       );
 
       if (!requirement.requiresApproval) {
+        // Backing authorization: the classifier/policy auto-approved this tool.
+        emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", requirement.source);
         return await handler(request);
       }
 
@@ -95,6 +222,10 @@ export function createApprovalGateMiddleware(
         tool_name: toolName,
         mcp_server_slug: serverSlug,
         message: requirement.message,
+        // Carry the gate's provenance verdict through the interrupt so the
+        // reinvocation that seeds the WAITING_APPROVAL tool call (index.ts) can
+        // persist ToolCall.approval_policy_source without re-deriving it.
+        policy_source: requirement.source,
       };
 
       const response = interrupt(approvalRequest) as ApprovalDecision;
@@ -106,6 +237,8 @@ export function createApprovalGateMiddleware(
       ).toString().toLowerCase();
 
       if (action === "approve") {
+        // Backing authorization: the user approved THIS interrupted call.
+        emitExecutionReceipt(config, toolCall, serverSlug, category, "approval", requirement.source);
         return await handler(request);
       }
 
@@ -143,6 +276,8 @@ export function createApprovalGateMiddleware(
 interface ApprovalRequirement {
   readonly requiresApproval: boolean;
   readonly message: string;
+  /** Which policy layer determined this verdict — stamped on the shadow receipt. */
+  readonly source: PolicySource;
 }
 
 function resolveToolApproval(
@@ -150,30 +285,104 @@ function resolveToolApproval(
   serverSlug: string,
   args: Record<string, unknown>,
   policies: ReadonlyMap<string, MergedToolPolicy>,
+  leasedCategories: ReadonlySet<ToolApprovalCategory>,
 ): ApprovalRequirement {
   if (serverSlug) {
+    // MCP tools stay governed by the connect-flow classifier + four-level policy
+    // chain. The policy map carries only the tools that REQUIRE approval, so an
+    // absent entry means the classifier already auto-approved it — fail-OPEN is
+    // correct here (a fail-closed default would re-gate everything the classifier
+    // cleared). This is deliberately NOT changed by the built-in fail-closed flip.
+    //
+    // A server-scoped lease surfaces here as an absent entry too: the leased
+    // server's tools are dropped from `policies` upstream (mergeApprovalPolicies),
+    // so a lease-cleared MCP tool takes this same auto-approve path. (Its shadow
+    // receipt therefore reads classifier_default rather than approval_lease; a
+    // faithful per-server lease provenance would need the lease set threaded here
+    // and is deferred with the rest of the persisted-receipt work.)
     const key = `${serverSlug}/${toolName}`;
     const policy = policies.get(key);
     if (policy) {
       return {
         requiresApproval: policy.requiresApproval,
         message: resolveApprovalMessage(policy.approvalMessage, toolName, args),
+        source: policy.source,
       };
     }
-    return { requiresApproval: false, message: "" };
-  }
-
-  if (SAFE_PLATFORM_TOOLS.has(toolName)) {
-    return { requiresApproval: false, message: "" };
+    // Absent = cleared by the MCP four-level chain (classifier base) or by a
+    // server-scoped lease (dropped upstream).
+    return { requiresApproval: false, message: "", source: "classifier_default" };
   }
 
-  const dangerousTemplate = DANGEROUS_PLATFORM_TOOLS.get(toolName);
-  if (dangerousTemplate) {
+  // Built-in/platform tool: gate exactly the mutating categories via the shared
+  // classifier. Fail-CLOSED for the mutating set — any built-in classifyTool
+  // deems write/edit/delete/shell requires approval. Read-only and unclassified
+  // built-ins are not mutating, so they remain fail-open.
+  const category = toolApprovalCategory(toolName);
+  if (category) {
+    // Run-lifetime category lease: the user chose "approve all <category>"
+    // earlier in this run, so every built-in of that category is auto-approved
+    // for the rest of the run (the scoped successor to auto-approve-all).
+    if (leasedCategories.has(category)) {
+      return { requiresApproval: false, message: "", source: "approval_lease" };
+    }
     return {
       requiresApproval: true,
-      message: resolveApprovalMessage(dangerousTemplate, toolName, args),
+      message: resolveApprovalMessage(CATEGORY_APPROVAL_MESSAGE[category], toolName, args),
+      source: "builtin_category",
     };
   }
 
-  return { requiresApproval: false, message: "" };
+  return { requiresApproval: false, message: "", source: "builtin_category" };
+}
+
+/** Shared empty set so a config without leases allocates nothing per call. */
+const EMPTY_CATEGORY_SET: ReadonlySet<ToolApprovalCategory> = new Set();
+
+type AuthorizationSource = "auto_approve" | "approval";
+
+/**
+ * Emit the shadow ExecutionReceipt when the gateway authorizes a side effect.
+ *
+ * Scope: only side-effecting actions are recorded — a mutating built-in (a
+ * non-empty {@link ToolApprovalCategory}) or any MCP tool (`serverSlug` present).
+ * Read-only built-ins are not side effects, so recording them would only dilute
+ * the signal. The receipt is a structured log carrying the action's HMAC
+ * fingerprint and the authorization source; it is never persisted and crosses no
+ * wire (no proto). The fingerprint is omitted (empty) when no per-execution key
+ * was supplied (tests / no-secret paths).
+ */
+function emitExecutionReceipt(
+  config: ApprovalGateConfig,
+  toolCall: { id: string; name: string; args: Record<string, unknown> },
+  serverSlug: string,
+  category: ToolApprovalCategory | undefined,
+  source: AuthorizationSource,
+  policySource: PolicySource,
+): void {
+  if (!category && !serverSlug) return;
+
+  const fingerprint = config.fingerprintKey
+    ? computeApprovalFingerprint(config.fingerprintKey, {
+        toolName: toolCall.name,
+        mcpServerSlug: serverSlug,
+        args: toolCall.args,
+      })
+    : "";
+
+  console.log(
+    "[hitl-gateway] receipt " +
+    JSON.stringify({
+      executionId: config.executionId ?? "",
+      toolCallId: toolCall.id,
+      toolName: toolCall.name,
+      mcpServerSlug: serverSlug,
+      category: category ?? "",
+      authorization: source,
+      policySource,
+      policyEngineVersion: POLICY_ENGINE_VERSION,
+      fingerprint,
+      substrate: "deep-agent",
+    }),
+  );
 }

package/src/middleware/types.ts

@@ -94,11 +94,11 @@ export interface OtelSpansConfig {
   readonly toolServerMap: ReadonlyMap<string, string>;
 }
 
-export interface ApprovalGateConfig {
-  readonly policies: ReadonlyMap<string, import("../shared/approval-policy.js").MergedToolPolicy>;
-  readonly autoApproveAll: boolean;
-  readonly toolServerMap: ReadonlyMap<string, string>;
-}
+// Single source of truth lives in approval-gate.ts (the gate consumes it);
+// imported as a type (no runtime cycle) and re-exported so existing importers of
+// `ApprovalGateConfig` from this module keep working.
+import type { ApprovalGateConfig } from "./approval-gate.js";
+export type { ApprovalGateConfig };
 
 /**
  * Top-level configuration for buildMiddlewareStack().

package/src/shared/__tests__/activity-input.test.ts

@@ -0,0 +1,78 @@
+import { describe, it, expect } from "vitest";
+import {
+  normalizeActivityInput,
+  type ExecuteActivityInput,
+} from "../activity-input.js";
+
+describe("normalizeActivityInput — dual-shape activity boundary", () => {
+  it("reads the new typed object (snake_case wire keys from Go/Java)", () => {
+    const wire: ExecuteActivityInput = {
+      execution_id: "exec-1",
+      thread_id: "thread-1",
+      invoker_identity_account_id: "acct-1",
+      turn_seq: 2,
+    };
+    expect(normalizeActivityInput(wire)).toEqual({
+      executionId: "exec-1",
+      threadId: "thread-1",
+      turnSeq: 2,
+    });
+  });
+
+  it("reads the legacy positional args (old Go control plane: 2 args)", () => {
+    expect(normalizeActivityInput("exec-2", "thread-2")).toEqual({
+      executionId: "exec-2",
+      threadId: "thread-2",
+      turnSeq: 0,
+    });
+  });
+
+  it("ignores a legacy 3rd positional arg (old Java sent invokerId as arg2)", () => {
+    // The runner only declares (arg0, arg1); a 3rd positional arg is dropped by
+    // JS, so the old Java (executionId, threadId, invokerId) call still works.
+    expect(normalizeActivityInput("exec-3", "thread-3")).toEqual({
+      executionId: "exec-3",
+      threadId: "thread-3",
+      turnSeq: 0,
+    });
+  });
+
+  it("treats an empty thread_id (first run / new harness state) as empty", () => {
+    expect(
+      normalizeActivityInput({
+        execution_id: "exec-4",
+        thread_id: "",
+        invoker_identity_account_id: "acct-4",
+      }),
+    ).toEqual({ executionId: "exec-4", threadId: "", turnSeq: 0 });
+
+    expect(normalizeActivityInput("exec-5")).toEqual({
+      executionId: "exec-5",
+      threadId: "",
+      turnSeq: 0,
+    });
+  });
+
+  it("defaults turn_seq to 0 when the object omits it (first turn / older control plane)", () => {
+    expect(
+      normalizeActivityInput({
+        execution_id: "exec-7",
+        thread_id: "thread-7",
+        invoker_identity_account_id: "acct-7",
+      }),
+    ).toEqual({ executionId: "exec-7", threadId: "thread-7", turnSeq: 0 });
+  });
+
+  it("deserializes the exact JSON shape the control planes emit", () => {
+    // Mirrors the bytes the Go struct / Java record serialize to (snake_case),
+    // including the additive turn_seq the cutover threads through.
+    const fromWire = JSON.parse(
+      '{"execution_id":"exec-6","thread_id":"thread-6","invoker_identity_account_id":"acct-6","turn_seq":3}',
+    ) as ExecuteActivityInput;
+    expect(normalizeActivityInput(fromWire)).toEqual({
+      executionId: "exec-6",
+      threadId: "thread-6",
+      turnSeq: 3,
+    });
+  });
+});

package/src/shared/__tests__/approval-canonicalize.test.ts

@@ -0,0 +1,106 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import {
+  canonicalJson,
+  canonicalToolActionJson,
+  canonicalizeToolAction,
+  type ToolActionInput,
+} from "../approval-canonicalize.js";
+
+interface Vector {
+  name: string;
+  input: ToolActionInput;
+  expected: string;
+}
+
+// Single source of truth, shared with the future Go/Java implementations.
+const vectorsPath = fileURLToPath(
+  new URL("../../../../../../apis/testdata/hitl/canonicalization/vectors.json", import.meta.url),
+);
+const corpus = JSON.parse(readFileSync(vectorsPath, "utf-8")) as { vectors: Vector[] };
+
+describe("approval canonicalization vector corpus", () => {
+  it("loads a non-trivial corpus", () => {
+    expect(corpus.vectors.length).toBeGreaterThanOrEqual(10);
+  });
+
+  for (const v of corpus.vectors) {
+    it(`vector: ${v.name}`, () => {
+      expect(canonicalToolActionJson(v.input)).toBe(v.expected);
+    });
+  }
+});
+
+describe("canonicalJson", () => {
+  it("sorts object keys by UTF-16 code unit", () => {
+    expect(canonicalJson({ b: 1, a: 2, A: 3 })).toBe('{"A":3,"a":2,"b":1}');
+  });
+
+  it("preserves array order", () => {
+    expect(canonicalJson([3, 1, 2])).toBe("[3,1,2]");
+  });
+
+  it("drops undefined-valued keys", () => {
+    expect(canonicalJson({ a: 1, b: undefined })).toBe('{"a":1}');
+  });
+
+  it("rejects non-integer numbers (outside the canonical domain)", () => {
+    expect(() => canonicalJson({ x: 1.5 })).toThrow(/non-integer/);
+  });
+
+  it("rejects non-finite numbers", () => {
+    expect(() => canonicalJson({ x: Infinity })).toThrow(/non-finite/);
+  });
+});
+
+describe("canonicalizeToolAction normalization", () => {
+  it("is idempotent (canonicalizing the canonical form is a fixed point)", () => {
+    const input: ToolActionInput = {
+      toolName: "Write",
+      paths: ["/ws/src/b.ts", "/ws/src/a.ts"],
+      workspaceRoot: "/ws",
+      args: { flag: true },
+    };
+    const once = canonicalToolActionJson(input);
+    const twice = canonicalToolActionJson(input);
+    expect(twice).toBe(once);
+  });
+
+  it("redacts secret values to a stable digest without cleartext", () => {
+    const input: ToolActionInput = {
+      toolName: "create_secret",
+      args: { name: "db", value: "super-secret-password" },
+      secretKeys: ["value"],
+    };
+    const out = canonicalizeToolAction(input);
+    const redacted = out.args.value as string;
+
+    expect(redacted).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(redacted).not.toContain("super-secret-password");
+    expect(canonicalToolActionJson(input)).not.toContain("super-secret-password");
+  });
+
+  it("redaction is stable for the same secret and distinct for different secrets", () => {
+    const base = (value: string): ToolActionInput => ({
+      toolName: "t",
+      args: { value },
+      secretKeys: ["value"],
+    });
+    const a1 = canonicalizeToolAction(base("secret-a")).args.value;
+    const a2 = canonicalizeToolAction(base("secret-a")).args.value;
+    const b = canonicalizeToolAction(base("secret-b")).args.value;
+
+    expect(a1).toBe(a2);
+    expect(a1).not.toBe(b);
+  });
+
+  it("makes a workspace-absolute path relative and normalizes separators", () => {
+    const out = canonicalizeToolAction({
+      toolName: "Write",
+      paths: ["C:\\ws\\src\\main.ts"],
+      workspaceRoot: "C:\\ws",
+    });
+    expect(out.paths).toEqual(["src/main.ts"]);
+  });
+});