@stigmer/runner 3.0.9-dev.20260616060535 → 3.1.0

package/dist/shared/approval-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/shared/approval-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAG9F;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAyB;IAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;QACpE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAClC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;oBAAE,OAAO,IAAI,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAoC,EACpC,cAAsC,EACtC,cAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,IAAI,cAAc;QAAE,OAAO,MAAM,CAAC;IAElC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0D,CAAC;QAEzF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAC/B,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAClC,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAC/B,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAClC,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;gBACtD,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBACrC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE;oBACpC,gBAAgB,EAAE,IAAI;oBACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,QAAQ;gBACR,aAAa,EAAE,MAAM,CAAC,IAAI;gBAC1B,gBAAgB,EAAE,IAAI;gBACtB,eAAe,EAAE,MAAM,CAAC,OAAO;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,aAAqB,EACrB,QAAuC;IAEvC,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,IAA6B;IAE7B,OAAO,QAAQ;SACZ,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACvC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"approval-policy.js","sourceRoot":"","sources":["../../src/shared/approval-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAA6B,MAAM,gBAAgB,CAAC;AA8CjF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,aAAqB;IAErB,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAyB;IAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,QAAQ,GAAG,CAAC,EAIjB,EAAQ,EAAE;QACT,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;YAAE,OAAO;QAC7D,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS;gBAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;gBAClC,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS;oBAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,IAAI,KAAK;QAC/C,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAgC;IAClE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,OAAO,oBAAoB,CAAC,kBAAkB,CAAC;QACjD,KAAK,iBAAiB;YACpB,OAAO,oBAAoB,CAAC,eAAe,CAAC;QAC9C,KAAK,gBAAgB;YACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC;QAC7C,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,gBAAgB,CAAC;QAC/C,KAAK,gBAAgB;YACnB,OAAO,oBAAoB,CAAC,cAAc,CAAC;QAC7C,KAAK,kBAAkB;YACrB,OAAO,oBAAoB,CAAC,gBAAgB,CAAC;QAC/C,KAAK,gCAAgC;YACnC,OAAO,oBAAoB,CAAC,8BAA8B,CAAC;QAC7D,KAAK,cAAc;YACjB,2EAA2E;YAC3E,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,oBAAoB,CAAC,WAAW,CAAC;QAC1C,KAAK,SAAS;YACZ,OAAO,oBAAoB,CAAC,WAAW,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgB,EAChB,UAAkB,EAClB,QAA+C,EAC/C,gBAAmD,EACnD,YAAqB;IAErB,IAAI,YAAY;QAAE,OAAO,kBAAkB,CAAC;IAE5C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACjC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC5D,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAoC,EACpC,cAAsC,EACtC,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEjC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAE9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgF,CAAC;QAE/G,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAC/B,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAClC,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE;gBAC7D,MAAM,EAAE,MAAM,CAAC,mBAAmB;oBAChC,CAAC,CAAC,gCAAgC;oBAClC,CAAC,CAAC,oBAAoB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,+EAA+E;QAC/E,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAC/B,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE;gBAClC,gBAAgB,EAAE,IAAI;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,iBAAiB,MAAM,CAAC,QAAQ,EAAE;gBAC7G,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,yDAAyD;QACzD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;gBACtD,QAAQ,CAAC,MAAM,GAAG,gBAAgB,CAAC;gBACnC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACrB,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;gBACtC,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBACrC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE;oBACpC,gBAAgB,EAAE,IAAI;oBACtB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,iBAAiB,QAAQ,CAAC,QAAQ,EAAE;oBACjE,MAAM,EAAE,gBAAgB;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,gBAAgB;gBAAE,SAAS;YACvC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;gBACd,QAAQ;gBACR,aAAa,EAAE,MAAM,CAAC,IAAI;gBAC1B,gBAAgB,EAAE,IAAI;gBACtB,eAAe,EAAE,MAAM,CAAC,OAAO;gBAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,aAAqB,EACrB,QAAuC;IAEvC,OAAO,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,IAA6B;IAE7B,OAAO,QAAQ;SACZ,OAAO,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACvC,OAAO,CAAC,sBAAsB,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/shared/args-preview.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Harness-agnostic sanitization of tool arguments for the `args_preview` field.
+ *
+ * `args_preview` is the human-readable, UI-facing projection of a tool call's
+ * arguments. It is surfaced on the approval card, the CLI, and the web console,
+ * and — for the Cursor harness — it is the field a resumed turn parses to rebuild
+ * an approval grant's salient identity. So it must always be SMALL and VALID
+ * JSON: the per-tool offload does not touch it, and the aggregate size backstop
+ * would replace an oversized preview with an unparseable marker.
+ *
+ * This module is the single home for arg sanitization shared by both harnesses
+ * (native re-exports {@link sanitizeArgsPreview} from its status builders; the
+ * Cursor gate path uses {@link buildElidedArgsPreview}).
+ */
+/**
+ * Argument keys whose values are secrets and must never appear in a preview.
+ * Matched case-insensitively against the top-level key name.
+ */
+export declare const SENSITIVE_ARG_KEYS: ReadonlySet<string>;
+/** Whole-preview length cap for {@link sanitizeArgsPreview} (native). */
+export declare const MAX_ARGS_PREVIEW_LENGTH = 500;
+/**
+ * Sanitize args into a compact preview string (native harness behavior).
+ *
+ * Redacts sensitive keys, then truncates the whole JSON to a fixed length. The
+ * truncation can yield invalid JSON, which is acceptable for the native harness
+ * (its resume model keys on `tool_call_id`, never on a re-parsed preview). The
+ * Cursor gate path must instead use {@link buildElidedArgsPreview}, which keeps
+ * the JSON valid and preserves the salient identity fields.
+ */
+export declare function sanitizeArgsPreview(args: Record<string, unknown>): string;
+/**
+ * Build a compact, ALWAYS-VALID `args_preview` from a tool call's full,
+ * authoritative arguments.
+ *
+ * Unlike {@link sanitizeArgsPreview} (which truncates the whole string, possibly
+ * to invalid JSON), this elides oversized string *values* in place — preserving
+ * every key and the JSON structure. Two invariants make it safe for the Cursor
+ * gate path:
+ *  - It NEVER elides a salient field (the resume grant's identity — the file
+ *    path or shell command — is parsed back out of this preview, so it must
+ *    survive verbatim).
+ *  - It redacts secret keys.
+ *
+ * The heavy content (a whole-file body, a large diff) lives on `file_changes`
+ * (offloaded to a ref when large) and `args` (bounded by the size backstop), so
+ * the preview itself stays small even for a multi-MB write.
+ *
+ * @param args the full tool arguments
+ * @param salientFields keys whose values must be preserved verbatim (identity)
+ */
+export declare function buildElidedArgsPreview(args: Record<string, unknown>, salientFields: readonly string[]): string;

package/dist/shared/args-preview.js

@@ -0,0 +1,93 @@
+/**
+ * Harness-agnostic sanitization of tool arguments for the `args_preview` field.
+ *
+ * `args_preview` is the human-readable, UI-facing projection of a tool call's
+ * arguments. It is surfaced on the approval card, the CLI, and the web console,
+ * and — for the Cursor harness — it is the field a resumed turn parses to rebuild
+ * an approval grant's salient identity. So it must always be SMALL and VALID
+ * JSON: the per-tool offload does not touch it, and the aggregate size backstop
+ * would replace an oversized preview with an unparseable marker.
+ *
+ * This module is the single home for arg sanitization shared by both harnesses
+ * (native re-exports {@link sanitizeArgsPreview} from its status builders; the
+ * Cursor gate path uses {@link buildElidedArgsPreview}).
+ */
+/**
+ * Argument keys whose values are secrets and must never appear in a preview.
+ * Matched case-insensitively against the top-level key name.
+ */
+export const SENSITIVE_ARG_KEYS = new Set([
+    "password", "token", "secret", "api_key", "apikey",
+    "credentials", "auth", "authorization",
+]);
+/** Whole-preview length cap for {@link sanitizeArgsPreview} (native). */
+export const MAX_ARGS_PREVIEW_LENGTH = 500;
+/**
+ * Sanitize args into a compact preview string (native harness behavior).
+ *
+ * Redacts sensitive keys, then truncates the whole JSON to a fixed length. The
+ * truncation can yield invalid JSON, which is acceptable for the native harness
+ * (its resume model keys on `tool_call_id`, never on a re-parsed preview). The
+ * Cursor gate path must instead use {@link buildElidedArgsPreview}, which keeps
+ * the JSON valid and preserves the salient identity fields.
+ */
+export function sanitizeArgsPreview(args) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(args)) {
+        sanitized[key] = SENSITIVE_ARG_KEYS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+    }
+    try {
+        const json = JSON.stringify(sanitized);
+        return json.length > MAX_ARGS_PREVIEW_LENGTH
+            ? json.slice(0, MAX_ARGS_PREVIEW_LENGTH) + "…"
+            : json;
+    }
+    catch {
+        return "";
+    }
+}
+/** Per-string-value cap for {@link buildElidedArgsPreview}. */
+const MAX_PREVIEW_VALUE_LENGTH = 200;
+/**
+ * Build a compact, ALWAYS-VALID `args_preview` from a tool call's full,
+ * authoritative arguments.
+ *
+ * Unlike {@link sanitizeArgsPreview} (which truncates the whole string, possibly
+ * to invalid JSON), this elides oversized string *values* in place — preserving
+ * every key and the JSON structure. Two invariants make it safe for the Cursor
+ * gate path:
+ *  - It NEVER elides a salient field (the resume grant's identity — the file
+ *    path or shell command — is parsed back out of this preview, so it must
+ *    survive verbatim).
+ *  - It redacts secret keys.
+ *
+ * The heavy content (a whole-file body, a large diff) lives on `file_changes`
+ * (offloaded to a ref when large) and `args` (bounded by the size backstop), so
+ * the preview itself stays small even for a multi-MB write.
+ *
+ * @param args the full tool arguments
+ * @param salientFields keys whose values must be preserved verbatim (identity)
+ */
+export function buildElidedArgsPreview(args, salientFields) {
+    const out = {};
+    for (const [key, value] of Object.entries(args)) {
+        if (SENSITIVE_ARG_KEYS.has(key.toLowerCase())) {
+            out[key] = "[REDACTED]";
+        }
+        else if (!salientFields.includes(key) &&
+            typeof value === "string" &&
+            value.length > MAX_PREVIEW_VALUE_LENGTH) {
+            out[key] = `[${value.length} chars]`;
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    try {
+        return JSON.stringify(out);
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=args-preview.js.map

package/dist/shared/args-preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args-preview.js","sourceRoot":"","sources":["../../src/shared/args-preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IAC7D,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAClD,aAAa,EAAE,MAAM,EAAE,eAAe;CACvC,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,SAAS,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,MAAM,GAAG,uBAAuB;YAC1C,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,GAAG,GAAG;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAA6B,EAC7B,aAAgC;IAEhC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,IACL,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,GAAG,wBAAwB,EACvC,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,SAAS,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/shared/artifact-storage.d.ts

@@ -2,8 +2,13 @@
  * Artifact storage abstraction for the unified runner.
  *
  * Two backends:
- * - Local: writes to the filesystem, served by stigmer-server (OSS mode).
+ * - Local: writes to the filesystem (OSS mode). The runner reads its own
+ *   artifacts straight back off disk via {@link ArtifactStorage.download} — the
+ *   exact inverse of {@link ArtifactStorage.upload}. `getDownloadUrl` still
+ *   returns the stigmer-server serve URL, but that is for OTHER consumers (the
+ *   web console fetching an artifact for display), not the runner's own reads.
  * - Proxy: uses presigned URLs from the Stigmer Side-Channel Proxy (cloud mode).
+ *   Here `download` resolves a presigned URL and fetches it over HTTPS.
  *
  * The runner never holds R2/S3 credentials — in cloud mode it calls the proxy
  * to obtain a presigned upload URL, then PUTs content over plain HTTPS.
@@ -14,6 +19,17 @@ import type { Config } from "../config.js";
 export interface ArtifactStorage {
     upload(key: string, content: Buffer, contentType?: string): Promise<string>;
     getDownloadUrl(key: string): Promise<string>;
+    /**
+     * Read an artifact's raw bytes by key — the inverse of {@link upload} and the
+     * single read path for all runner read-back (CAS reconcile, exact-apply,
+     * claimcheck decode, attachment injection).
+     *
+     * Returns the exact stored bytes, or throws a descriptive, key-scoped `Error`
+     * when the object is missing or the transport fails. Per-backend semantics:
+     * local reads directly off disk; proxy resolves a presigned URL and fetches
+     * it. Callers own their own error-wrapping / degradation policy.
+     */
+    download(key: string): Promise<Buffer>;
     exists(key: string): Promise<boolean>;
 }
 export type ArtifactStorageType = "local" | "proxy";
@@ -23,6 +39,7 @@ export declare class LocalArtifactStorage implements ArtifactStorage {
     constructor(basePath: string, serveUrlBase: string);
     upload(key: string, content: Buffer, _contentType?: string): Promise<string>;
     getDownloadUrl(key: string): Promise<string>;
+    download(key: string): Promise<Buffer>;
     exists(key: string): Promise<boolean>;
 }
 export declare class ProxyArtifactStorage implements ArtifactStorage {
@@ -31,6 +48,7 @@ export declare class ProxyArtifactStorage implements ArtifactStorage {
     constructor(proxyEndpoint: string, authToken: string);
     upload(key: string, content: Buffer, contentType?: string): Promise<string>;
     getDownloadUrl(key: string): Promise<string>;
+    download(key: string): Promise<Buffer>;
     exists(key: string): Promise<boolean>;
 }
 export interface ArtifactStorageConfig {

package/dist/shared/artifact-storage.js

@@ -2,15 +2,20 @@
  * Artifact storage abstraction for the unified runner.
  *
  * Two backends:
- * - Local: writes to the filesystem, served by stigmer-server (OSS mode).
+ * - Local: writes to the filesystem (OSS mode). The runner reads its own
+ *   artifacts straight back off disk via {@link ArtifactStorage.download} — the
+ *   exact inverse of {@link ArtifactStorage.upload}. `getDownloadUrl` still
+ *   returns the stigmer-server serve URL, but that is for OTHER consumers (the
+ *   web console fetching an artifact for display), not the runner's own reads.
  * - Proxy: uses presigned URLs from the Stigmer Side-Channel Proxy (cloud mode).
+ *   Here `download` resolves a presigned URL and fetches it over HTTPS.
  *
  * The runner never holds R2/S3 credentials — in cloud mode it calls the proxy
  * to obtain a presigned upload URL, then PUTs content over plain HTTPS.
  *
  * DD-6: No direct R2 backend. Local + Proxy only.
  */
-import { mkdir, writeFile, access } from "node:fs/promises";
+import { mkdir, writeFile, readFile, access } from "node:fs/promises";
 import { dirname, join } from "node:path";
 // ── Local Backend ────────────────────────────────────────────────────
 export class LocalArtifactStorage {
@@ -29,6 +34,18 @@ export class LocalArtifactStorage {
     async getDownloadUrl(key) {
         return `${this.serveUrlBase}/${key}`;
     }
+    async download(key) {
+        // Direct disk read — the exact inverse of `upload`. The runner wrote these
+        // bytes to `basePath`, so it reads them back without a self-HTTP round-trip
+        // and without depending on the serve URL being set or reachable.
+        try {
+            return await readFile(join(this.basePath, key));
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            throw new Error(`Artifact not found for key '${key}': ${reason}`);
+        }
+    }
     async exists(key) {
         try {
             await access(join(this.basePath, key));
@@ -112,21 +129,41 @@ export class ProxyArtifactStorage {
         const data = await resp.json();
         return data.url;
     }
+    async download(key) {
+        const url = await this.getDownloadUrl(key);
+        const resp = await fetch(url);
+        if (!resp.ok) {
+            throw new Error(`Artifact download failed (HTTP ${resp.status}) for key '${key}': ` +
+                await resp.text());
+        }
+        return Buffer.from(await resp.arrayBuffer());
+    }
     async exists(key) {
+        // A presigned URL is minted for ANY key — the presign endpoint does not check
+        // the object — so "did presign succeed?" is NOT existence (that bug turned a
+        // git-only file-review reconcile into a doomed manifest download + 404 crash).
+        // Probe the object itself with a 1-byte ranged GET: the presigned URL is
+        // SigV4-signed for GET (a HEAD would break the signature), and `Range:
+        // bytes=0-0` transfers at most one byte. Missing => 404; present => 200/206
+        // (or 416 for a 0-byte object, whose range is unsatisfiable yet it exists).
+        let url;
         try {
-            const resp = await fetch(`${this.baseUrl}/presigned-download-url`, {
-                method: "POST",
-                headers: {
-                    "Authorization": `Bearer ${this.authToken}`,
-                    "Content-Type": "application/json",
-                },
-                body: JSON.stringify({ key }),
-            });
-            return resp.ok;
+            url = await this.getDownloadUrl(key);
         }
         catch {
+            // Presign endpoint unreachable: report absent. The sole caller (content-
+            // addressed CAS blob dedup) then re-uploads, which is idempotent.
             return false;
         }
+        const resp = await fetch(url, { headers: { Range: "bytes=0-0" } });
+        await resp.arrayBuffer().catch(() => undefined); // drain the <=1-byte body
+        if (resp.status === 404)
+            return false;
+        if (resp.status === 200 || resp.status === 206 || resp.status === 416)
+            return true;
+        // Any other status (e.g. 403 expired/misconfigured, 5xx) is a real fault, not
+        // an existence answer — surface it rather than silently mis-reporting.
+        throw new Error(`Artifact existence check failed (HTTP ${resp.status}) for key '${key}'`);
     }
 }
 export function loadArtifactStorageConfig(config) {

package/dist/shared/artifact-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAY,MAAM,EAAU,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAa1C,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,YAAY,aAAqB,EAAE,SAAiB;QAClD,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;oBAC3C,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;aAC9B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAYD,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB;QACtE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,cAAc,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwB1C,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,MAAM,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,YAAY,aAAqB,EAAE,SAAiB;QAClD,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,MAAM,cAAc,GAAG,KAAK;gBACnE,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnF,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,MAAM,cAAc,GAAG,GAAG,CACzE,CAAC;IACJ,CAAC;CACF;AAYD,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB;QACtE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,cAAc,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC"}

package/dist/shared/file-change.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Pure path + binary-detection helpers shared by the native (deepagents) and
+ * Cursor harnesses' file-review capture.
+ *
+ * Deliberately dependency-free and side-effect-free: no file IO, no diff
+ * computation, no proto knowledge. `resolveWorkspacePath` normalizes a touched
+ * path to (display path, absolute path); `looksBinary`/`bytesLookBinary` are the
+ * single definition of "binary" across every capture substrate.
+ *
+ * @since First-Class Diff Review (#186)
+ */
+/**
+ * Heuristic binary detection: a NUL byte never appears in valid UTF-8 text. This
+ * is a safety net, not a feature — the native edit/write tools are string-based,
+ * so captured content is text in practice.
+ */
+export declare function looksBinary(content: string): boolean;
+/**
+ * Byte-level binary detection: a NUL byte never appears in valid UTF-8 text. The
+ * single definition of "binary" shared by every substrate that reads raw bytes
+ * (the git substrate's blob reads and the CAS substrate's captured bodies), so
+ * "what is binary" is decided one way across the whole file-review subsystem.
+ *
+ * Prefer this over {@link looksBinary} whenever the raw bytes are in hand: it is
+ * exact, whereas scanning a UTF-8-decoded string can miss a NUL that a lossy
+ * decode dropped.
+ */
+export declare function bytesLookBinary(bytes: Uint8Array): boolean;
+/**
+ * Derive the workspace-root-relative display path and the absolute on-disk path
+ * for a file a tool touched.
+ *
+ * `virtualRoot` distinguishes the two harness path conventions:
+ *  - native (deepagents) addresses files against a virtual root where a leading
+ *    "/" denotes the workspace root — mirrors `InlinePublisher.normalizePath`;
+ *  - Cursor passes real filesystem paths that may be absolute.
+ *
+ * A path that is absolute but outside `rootDir` is displayed as-is (we never
+ * surface an escaping `../../` relative path).
+ */
+export declare function resolveWorkspacePath(rawPath: string, rootDir: string, virtualRoot: boolean): {
+    path: string;
+    absolutePath: string;
+};

package/dist/shared/file-change.js

@@ -0,0 +1,57 @@
+/**
+ * Pure path + binary-detection helpers shared by the native (deepagents) and
+ * Cursor harnesses' file-review capture.
+ *
+ * Deliberately dependency-free and side-effect-free: no file IO, no diff
+ * computation, no proto knowledge. `resolveWorkspacePath` normalizes a touched
+ * path to (display path, absolute path); `looksBinary`/`bytesLookBinary` are the
+ * single definition of "binary" across every capture substrate.
+ *
+ * @since First-Class Diff Review (#186)
+ */
+import { isAbsolute, join, relative } from "node:path";
+/**
+ * Heuristic binary detection: a NUL byte never appears in valid UTF-8 text. This
+ * is a safety net, not a feature — the native edit/write tools are string-based,
+ * so captured content is text in practice.
+ */
+export function looksBinary(content) {
+    return content.includes("\u0000");
+}
+/**
+ * Byte-level binary detection: a NUL byte never appears in valid UTF-8 text. The
+ * single definition of "binary" shared by every substrate that reads raw bytes
+ * (the git substrate's blob reads and the CAS substrate's captured bodies), so
+ * "what is binary" is decided one way across the whole file-review subsystem.
+ *
+ * Prefer this over {@link looksBinary} whenever the raw bytes are in hand: it is
+ * exact, whereas scanning a UTF-8-decoded string can miss a NUL that a lossy
+ * decode dropped.
+ */
+export function bytesLookBinary(bytes) {
+    return bytes.includes(0);
+}
+/**
+ * Derive the workspace-root-relative display path and the absolute on-disk path
+ * for a file a tool touched.
+ *
+ * `virtualRoot` distinguishes the two harness path conventions:
+ *  - native (deepagents) addresses files against a virtual root where a leading
+ *    "/" denotes the workspace root — mirrors `InlinePublisher.normalizePath`;
+ *  - Cursor passes real filesystem paths that may be absolute.
+ *
+ * A path that is absolute but outside `rootDir` is displayed as-is (we never
+ * surface an escaping `../../` relative path).
+ */
+export function resolveWorkspacePath(rawPath, rootDir, virtualRoot) {
+    if (virtualRoot || !isAbsolute(rawPath)) {
+        const rel = rawPath.replace(/^\/+/, "").replace(/^\.\//, "");
+        return { path: rel, absolutePath: join(rootDir, rel) };
+    }
+    const rel = relative(rootDir, rawPath);
+    if (rel && !rel.startsWith("..") && !isAbsolute(rel)) {
+        return { path: rel, absolutePath: rawPath };
+    }
+    return { path: rawPath, absolutePath: rawPath };
+}
+//# sourceMappingURL=file-change.js.map

package/dist/shared/file-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-change.js","sourceRoot":"","sources":["../../src/shared/file-change.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAe,EACf,WAAoB;IAEpB,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC"}

package/dist/shared/file-tools.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Introspection of file-modifying tools, shared by every runner surface that
+ * reacts to a file edit: the native (deepagents) streaming side-effects (publish,
+ * git writeback, post-exec file-change capture), the Cursor streaming capture,
+ * and BOTH harnesses' approval-gate pre-execution capture (shared/gate-file-change.ts).
+ *
+ * This is the single source of truth for "which tools mutate files" and "where
+ * their path / whole-file content / edit replacement lives in the tool
+ * arguments". It is deliberately pure — no IO, no proto knowledge — so the same
+ * identification logic is used whether args come from a streamed `on_tool_*`
+ * event, a v3 protocol event, an AI-message tool call read out of graph state at
+ * an interrupt, or the Cursor preToolUse hook's captured `tool_input`.
+ *
+ * Both taxonomies are covered in one place on purpose: the deepagents harness
+ * names a file write `write_file`/`write`, the Cursor SDK stream names it
+ * `edit`/`write`, and the Cursor preToolUse hook names it `Write`/`StrReplace`/
+ * `EditNotebook`. The four extractors below span every arg-field name these
+ * surfaces use, so a single capture path is correct for all of them.
+ *
+ * @since First-Class Diff Review (#186); cross-harness gate unification (HITL diff)
+ */
+/**
+ * The file-modifying tools, across both harness taxonomies.
+ *
+ * - deepagents (native): `write_file`/`edit_file`/`create_file` (stream) and
+ *   `write`/`edit`/`create`/`str_replace_editor` (SDK names);
+ * - Cursor: `write`/`edit` (SDK stream, shared with native) and
+ *   `Write`/`StrReplace`/`EditNotebook` (preToolUse hook + tool names).
+ *
+ * Delete is intentionally absent: it has no whole-file content or hunk to
+ * preview, so it is not "file-modifying" in the diff-capture sense.
+ */
+export declare const FILE_MODIFYING_TOOLS: ReadonlySet<string>;
+/** Whether `toolName` is a file-modifying tool in either harness taxonomy. */
+export declare function isFileModifyingTool(toolName: string): boolean;
+/**
+ * Extract the target file path from a file-modifying tool's arguments. Returns
+ * `null` when no recognized path key is present. The key set is the union across
+ * both taxonomies: deepagents/Cursor write+edit use `path`/`file_path`; a Cursor
+ * notebook edit uses `target_notebook`; the rest are defensive against drift.
+ */
+export declare function extractFilePath(args: Record<string, unknown>): string | null;
+/**
+ * Top-level arg keys, in priority order, that carry a write-family tool's
+ * WHOLE-FILE body, across both harness taxonomies (Cursor `Write` uses
+ * `content`; the SDK stream uses `contents`). Exported so the generated Cursor
+ * hook injects the SAME list into its inline content-digest extractor — the
+ * field names diverge across the hook/stream layers, so a single shared list is
+ * what keeps the runner-side and hook-side digests byte-identical.
+ */
+export declare const WRITE_CONTENT_FIELDS: readonly ["content", "contents", "file_content"];
+/**
+ * Extract the WHOLE-FILE content from a write-family tool's arguments. Returns
+ * `null` for an edit-family call (which carries `old_string`/`new_string`, not a
+ * whole-file body) or when no content key is present. An empty string is a real
+ * value (an empty file) and is preserved.
+ *
+ * Critical: this is kept strictly separate from {@link extractEditNewString}.
+ * `new_string` is an edit replacement fragment, NOT whole-file content;
+ * conflating the two would make an edit look like a whole-file capture and read
+ * the wrong `before` at the gate.
+ */
+export declare function extractWriteContent(args: Record<string, unknown>): string | null;
+/**
+ * Top-level arg keys for an edit-family tool's pre-/post-edit fragments, across
+ * both taxonomies. Exported for the same reason as {@link WRITE_CONTENT_FIELDS}:
+ * the Cursor hook injects them into its inline digest extractor so its content
+ * digest matches the runner's byte-for-byte.
+ */
+export declare const EDIT_OLD_FIELDS: readonly ["old_string", "old_text", "oldText"];
+export declare const EDIT_NEW_FIELDS: readonly ["new_string", "new_text", "newText", "replacement"];
+/**
+ * Extract an edit-family tool's pre-edit fragment (`old_string` and its
+ * variants). Returns `null` when absent; an empty string is preserved (an
+ * insertion has an empty `old_string`), matching the native gate capture.
+ */
+export declare function extractEditOldString(args: Record<string, unknown>): string | null;
+/**
+ * Extract an edit-family tool's post-edit fragment (`new_string` and its
+ * variants, including `replacement`). Returns `null` when absent; an empty
+ * string is preserved (a deletion has an empty `new_string`).
+ */
+export declare function extractEditNewString(args: Record<string, unknown>): string | null;
+/**
+ * Stable content digest of a file-mutating tool call's arguments — the content
+ * discriminator the deny-only Cursor HITL identity adds on top of
+ * (category, path) so a DIFFERENT edit to the same file re-gates rather than
+ * riding an earlier approval through.
+ *
+ * It hashes ONLY the edit content, never the path (the path is the identity's
+ * "salient" already). A whole-file write hashes its body; an edit hashes its
+ * (old, new) fragment pair. Returns "" for a call with no recoverable edit
+ * content — a shell command, a delete, a read, an MCP tool, or the hook's
+ * grep-fallback denial — which keep the coarse (category, salient) identity
+ * (already content-exact for a command / delete path).
+ *
+ * THE FORMAT IS A CROSS-LAYER CONTRACT. The Cursor preToolUse hook recomputes
+ * this digest inline from `tool_input`, running the SAME Node binary as the
+ * runner (see buildContentDigestScript in execute-cursor/hook-script.ts), so the
+ * two values must be byte-identical — any change here MUST be mirrored there.
+ * JSON.stringify of a fixed-shape string array is deterministic and identical on
+ * both sides; the leading tag ("w"/"e") keeps a write body from ever colliding
+ * with an edit pair, and the union field lists above are injected into the hook
+ * so both extract the same value despite the file_path/path & content/contents
+ * cross-layer name divergence.
+ */
+export declare function contentDigest(args: Record<string, unknown>): string;