@stigmer/runner 3.0.9-dev.20260616060535 → 3.1.0

package/dist/activities/execute-cursor/approval-state.js

@@ -9,21 +9,36 @@
  * State file format (JSON):
  * {
  *   "autoApproveAll": false,
+ *   "leasedCategories": ["shell"],
  *   "mcpToolPolicies": {
  *     "apply_cloud_resource": { "requiresApproval": true, "message": "..." }
  *   },
- *   "approvedGrants": [{ "toolName": "edit", "mcpServerSlug": "", "key": "write", "salient": "a.txt" }],
- *   "approvedGrantTokens": ["d3JpdGUKYS50eHQ="]
+ *   "approvedGrants": [{ "toolName": "edit", "mcpServerSlug": "", "key": "write", "salient": "a.txt", "contentDigest": "<sha256>" }],
+ *   "approvedGrantTokens": ["<base64(key\nsalient[\ncontentDigest])>"]
  * }
  *
+ * A grant token is the action's PRIMARY token: base64(key \n salient \n digest)
+ * for a content-identified file edit (so a DIFFERENT edit to the same file does
+ * not match), or base64(key \n salient) for shell/delete/MCP and the rare
+ * content-less fallback. See {@link primaryToken}.
+ *
  * The hook gates the dangerous built-in set and the MCP tools that require
  * approval (mcpToolPolicies, which by construction holds only require-approval
  * entries); every other tool is allowed. The gated built-in set and its
  * name->category mapping are baked into the generated hook script (from
  * approval-policy.ts), not carried in the state file — only the dynamic inputs
- * (autoApproveAll, mcpToolPolicies, approvedGrantTokens) live here. This mirrors
- * the native harness and avoids denying auto-approved MCP tools, which are
- * absent from the policy map and indistinguishable from unknown tools by name.
+ * (autoApproveAll, leasedCategories, mcpToolPolicies, approvedGrantTokens) live
+ * here. This mirrors the native harness and avoids denying auto-approved MCP
+ * tools, which are absent from the policy map and indistinguishable from unknown
+ * tools by name.
+ *
+ * Approval leases (the scoped successor to autoApproveAll): `autoApproveAll` is
+ * now ONLY the pre-armed spec.auto_approve_all global bypass. An interactive
+ * "approve all" of a given class becomes a run-lifetime lease: a built-in
+ * category lease is listed in `leasedCategories` (the hook allows any built-in of
+ * that category), and an MCP-server lease is applied upstream by dropping the
+ * server's tools from mcpToolPolicies (so the hook allows them as auto-approved)
+ * — the hook is not server-aware, so omission is the lever there.
  *
  * Why grants instead of tool-call ids: a resumed Cursor agent re-issues the
  * approved tool with a BRAND NEW call id, so matching on the original call id
@@ -50,12 +65,15 @@
  * as approvedGrantTokens, so a denial token approved this turn becomes a grant
  * token next turn.
  */
-import { writeFile, readFile, mkdir } from "node:fs/promises";
+import { watch } from "node:fs";
+import { writeFile, readFile, mkdir, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { create } from "@bufbuild/protobuf";
 import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
-import { extractArgKey, approvalCategory } from "./approval-policy.js";
+import { extractArgKey, approvalCategory, POLICY_ENGINE_VERSION } from "./approval-policy.js";
+import { contentDigest } from "../../shared/file-tools.js";
+import { fingerprintCoarseIdentity, } from "../../shared/approval-fingerprint.js";
 export function toolIdentity(toolName, mcpServerSlug, args) {
     if (mcpServerSlug) {
         return { key: toolName, salient: "" };
@@ -74,20 +92,91 @@ export function toolIdentity(toolName, mcpServerSlug, args) {
 export function grantToken(key, salient) {
     return Buffer.from(`${key}\n${salient}`, "utf-8").toString("base64");
 }
+/**
+ * The content-exact wire token: `base64(key \n salient \n contentDigest)`. This
+ * is the exact-identity grant the hook matches for a file-mutating tool, so an
+ * approval of one edit does NOT authorize a DIFFERENT edit to the same file (a
+ * different digest yields a different token). The hook recomputes the identical
+ * token from `tool_input` (it appends the same `\n<digest>` only when the digest
+ * is non-empty — see hook-script.ts), so this encoding must stay byte-identical
+ * to the hook's, exactly as {@link grantToken} already is.
+ */
+export function contentToken(key, salient, contentDigest) {
+    return Buffer.from(`${key}\n${salient}\n${contentDigest}`, "utf-8").toString("base64");
+}
+/**
+ * The single token a tool call authorizes (as a grant) and is recorded under (as
+ * a denial): the {@link contentToken} when a content digest is present (file
+ * edits/writes), else the coarse {@link grantToken} (shell, delete, MCP, or a
+ * content-less grep-fallback). One definition, used by the runner for both grant
+ * building and denial correlation and mirrored by the hook, so the deny-time and
+ * reinvoke-time identities can never drift.
+ */
+export function primaryToken(key, salient, contentDigest) {
+    return contentDigest ? contentToken(key, salient, contentDigest) : grantToken(key, salient);
+}
+/**
+ * The shared HMAC coarse fingerprint of an approval grant.
+ *
+ * This is the SAME canonical coarse identity the wire token (grantToken) encodes
+ * — `(key, salient)` plus the MCP slug — run through the one shared HMAC+canonical
+ * path ({@link fingerprintCoarseIdentity}). It is NOT the hook's wire-match value:
+ * the hook matches on the mechanically-reproducible base64 token (a bash script
+ * can recompute base64 but not a keyed HMAC over a workspace-root-normalized
+ * salient). This fingerprint is the cross-substrate, anti-forgery identity used
+ * for the runner-side shadow receipt today and as the successor wire token once a
+ * lease becomes a server-issued bearer token (Phase 7). Because it shares the
+ * exact category + salient the token uses, the hook-side and stream-side
+ * fingerprints of one action are equal by construction (see the parity tests).
+ */
+export function grantFingerprint(key, grant) {
+    return fingerprintCoarseIdentity(key, {
+        tool: grant.key,
+        mcpServerSlug: grant.mcpServerSlug,
+        salient: grant.salient,
+    });
+}
+/**
+ * Emit a best-effort shadow ExecutionReceipt for each grant the runner issues
+ * this turn (Phase 2, mirror of the deep-agent gateway's receipt).
+ *
+ * Cursor executes tools out-of-process, so unlike the in-process deep-agent
+ * gateway the runner cannot observe the actual side effect — the receipt is
+ * issued when the authorization GRANT is written (best-effort, `verified:false`),
+ * not at execution. Structured log only: never persisted, no proto. Shares the
+ * one HMAC+canonical fingerprint path so the value matches the deep-agent and
+ * cross-language corpus definitions.
+ */
+export function emitCursorGrantReceipts(grants, fingerprintKey, executionId) {
+    for (const g of grants) {
+        console.log("[hitl-gateway] receipt " +
+            JSON.stringify({
+                executionId,
+                toolName: g.toolName,
+                mcpServerSlug: g.mcpServerSlug,
+                category: g.mcpServerSlug ? "" : g.key,
+                authorization: "approval",
+                policyEngineVersion: POLICY_ENGINE_VERSION,
+                fingerprint: grantFingerprint(fingerprintKey, g),
+                substrate: "cursor",
+                verified: false,
+            }));
+    }
+}
 /**
  * Build approval grants from the pending approvals the user adjudicated and
  * their decisions. Only APPROVE / APPROVE_ALL decisions produce grants. Each
  * grant carries the canonical {@link ToolIdentity} (category + salient resource)
  * so the hook allows the exact approved resource on the resumed turn.
  */
-export function buildApprovalGrants(pendingApprovals, decisions) {
+export function buildApprovalGrants(pendingApprovals, decisions, contentDigests) {
     const grants = [];
     for (const pa of pendingApprovals) {
         // Both APPROVE and APPROVE_ALL allow the adjudicated tool through on the
-        // resumed turn. APPROVE_ALL additionally flips autoApproveAll for the whole
-        // run (handled by the caller via hasApproveAllDecision), but we still emit a
-        // grant here so the clicked tool is allowed regardless of how the hook reads
-        // the state file.
+        // resumed turn. APPROVE_ALL additionally grants a run-lifetime lease for the
+        // clicked action's class (handled by the caller via deriveActiveLeases ->
+        // leasedCategories / dropped MCP server), but we still emit a grant here so
+        // the clicked tool itself is allowed regardless of how the hook reads state.
         const decision = decisions.get(pa.toolCallId);
         if (decision !== ApprovalAction.APPROVE && decision !== ApprovalAction.APPROVE_ALL)
             continue;
@@ -97,6 +186,14 @@ export function buildApprovalGrants(pendingApprovals, decisions) {
             mcpServerSlug: pa.mcpServerSlug,
             key: id.key,
             salient: id.salient,
+            // The content digest comes from the gate's authoritative captured input
+            // (carried on the tool call, see reconstructAdjudicatedApprovals) — NOT
+            // from argsPreview, which elides heavy edit content. Empty when the gate
+            // had no content (shell/delete/MCP) or it was unrecoverable, in which case
+            // the grant degrades to the coarse token (a same-file sibling can ride it,
+            // the documented bounded residual).
+            contentDigest: contentDigests?.get(pa.toolCallId) ?? "",
+            sourceToolCallId: pa.toolCallId,
         });
     }
     return grants;
@@ -117,14 +214,17 @@ function parseArgs(argsPreview) {
  * grants from a previous HITL cycle.
  *
  * The state file carries the hook script's DYNAMIC inputs:
- * - mcpToolPolicies: per-tool policy for MCP tools requiring approval
+ * - globalBypass: the pre-armed spec.auto_approve_all (written as autoApproveAll)
+ * - leasedCategories: built-in categories with a run-lifetime lease
+ * - mcpToolPolicies: per-tool policy for MCP tools requiring approval (leased
+ *   servers are already absent — dropped upstream by mergeApprovalPolicies)
  * - approvedGrants / approvedGrantTokens: tools approved in the current HITL
  *   cycle, allowed through on reinvocation
  *
  * The static gated built-in set and its category mapping are baked into the
  * generated hook script (from approval-policy.ts), not carried here.
  */
-export function buildApprovalState(mergedPolicies, autoApproveAll, grants) {
+export function buildApprovalState(mergedPolicies, globalBypass, leasedCategories, grants, captureMode = false, captureIgnored = false, gitWorkspace = true) {
     const approvedGrants = grants ?? [];
     const mcpToolPolicies = {};
     for (const policy of mergedPolicies.values()) {
@@ -134,10 +234,17 @@ export function buildApprovalState(mergedPolicies, autoApproveAll, grants) {
         };
     }
     return {
-        autoApproveAll,
+        autoApproveAll: globalBypass,
+        leasedCategories: [...leasedCategories],
         mcpToolPolicies,
         approvedGrants,
-        approvedGrantTokens: approvedGrants.map((g) => grantToken(g.key, g.salient)),
+        // The hook matches a tool call's PRIMARY token (content when it can compute a
+        // digest from tool_input, else coarse). A content-identified grant authorizes
+        // only its exact content; a content-less grant authorizes the coarse token.
+        approvedGrantTokens: approvedGrants.map((g) => primaryToken(g.key, g.salient, g.contentDigest)),
+        captureMode,
+        captureIgnored,
+        gitWorkspace,
     };
 }
 const STATE_FILE_NAME = "approval-state.json";
@@ -188,6 +295,48 @@ export async function resetDenialLedger(hitlDir) {
     await writeFile(filePath, "", "utf-8");
     return filePath;
 }
+/**
+ * Watch the denial ledger so the stream loop learns about a hook denial the
+ * moment it is written — not on the next tool_call event.
+ *
+ * The hook appends to denials.jsonl BEFORE Cursor surfaces the failure to the
+ * model, so a filesystem notification is the earliest possible signal that a
+ * turn must pause. The watcher deliberately does NOT read the file itself: it
+ * only flips the caller's dirty flag, and the stream loop confirms with a
+ * readDenialLedger() — a notification can fire for the per-turn reset
+ * truncation too, and only a read distinguishes "reset to empty" from "denial
+ * appended". Watching the DIRECTORY (not the file) survives the file being
+ * replaced/truncated between turns.
+ *
+ * fs.watch is best-effort by platform contract, so this is an accelerator,
+ * never the only trigger: the stream loop keeps its tool_call-event read as
+ * the backstop. On any watcher error we fall back to that backstop silently.
+ *
+ * Returns a close function, idempotent and safe to call on every exit path.
+ */
+export function watchDenialLedger(hitlDir, onDirty) {
+    try {
+        const watcher = watch(hitlDir, (_eventType, filename) => {
+            if (!filename || filename === DENIAL_LEDGER_FILE)
+                onDirty();
+        });
+        // Without an error listener a watcher error crashes the process; with one,
+        // the watcher just goes quiet and the tool_call backstop takes over.
+        watcher.on("error", () => { });
+        return () => {
+            try {
+                watcher.close();
+            }
+            catch {
+                // Already closed — nothing to release.
+            }
+        };
+    }
+    catch {
+        // Watch unsupported on this platform/filesystem — backstop only.
+        return () => { };
+    }
+}
 /**
  * Read the denial ledger written by the hook during the turn. Missing file →
  * no denials. Blank or partially-written lines are tolerated (the hook appends
@@ -213,6 +362,7 @@ export async function readDenialLedger(hitlDir) {
                 entries.push({
                     toolName: typeof obj.toolName === "string" ? obj.toolName : "",
                     token: obj.token,
+                    input: decodeLedgerInput(obj.input),
                 });
             }
         }
@@ -222,9 +372,70 @@ export async function readDenialLedger(hitlDir) {
     }
     return entries;
 }
+/**
+ * Decode the hook's base64(JSON(tool_input)) into the authoritative args object,
+ * or undefined when absent/garbage. Tolerant by construction: a bad capture must
+ * never drop the denial it rides on — the gate still surfaces, just without the
+ * richer preview.
+ */
+function decodeLedgerInput(raw) {
+    if (typeof raw !== "string" || raw.length === 0)
+        return undefined;
+    try {
+        const json = Buffer.from(raw, "base64").toString("utf-8");
+        const parsed = JSON.parse(json);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Active-turn pointer (runner → stable hook): the per-turn indirection that makes
+// a single, process-cached hook script resolve the CURRENT execution's artifacts
+// ─────────────────────────────────────────────────────────────────────────────
+const ACTIVE_POINTER_FILE = "active.json";
+/** Absolute path of the active-turn pointer inside a workspace's gate directory. */
+export function activePointerPath(gateDir) {
+    return join(gateDir, ACTIVE_POINTER_FILE);
+}
+/**
+ * Atomically point the workspace's stable hook at the current turn's artifacts.
+ *
+ * Written compactly (the hook's grep fallback parses `"key":"value"` with no
+ * spaces) and atomically (write a temp sibling, then rename) so a hook firing
+ * concurrently with the write never reads a half-written pointer. Returns the
+ * pointer path.
+ */
+export async function writeActiveTurnPointer(gateDir, pointer) {
+    await mkdir(gateDir, { recursive: true });
+    const filePath = activePointerPath(gateDir);
+    const tmpPath = `${filePath}.${process.pid}.tmp`;
+    await writeFile(tmpPath, JSON.stringify(pointer), "utf-8");
+    await rename(tmpPath, filePath);
+    return filePath;
+}
+/**
+ * Remove the active-turn pointer on teardown so the gate is INERT between turns:
+ * a hook that fires when no turn is active (a leftover cached hooks.json, the
+ * user's own IDE) reads no pointer and allows immediately. Best-effort — a
+ * teardown failure must never fail the execution, and a stale pointer is itself
+ * inert once its runnerPid is gone (the scope guard fails closed to allow).
+ */
+export async function removeActiveTurnPointer(gateDir) {
+    try {
+        await rm(activePointerPath(gateDir), { force: true });
+    }
+    catch {
+        // Already gone or unwritable — nothing to clean.
+    }
+}
 export function reconstructAdjudicatedApprovals(messages) {
     const pendingApprovals = [];
     const decisions = new Map();
+    const contentDigests = new Map();
     for (const msg of messages) {
         for (const tc of msg.toolCalls) {
             if (tc.status !== ToolCallStatus.TOOL_CALL_WAITING_APPROVAL)
@@ -232,6 +443,11 @@ export function reconstructAdjudicatedApprovals(messages) {
             if (tc.approvalAction === ApprovalAction.UNSPECIFIED)
                 continue;
             decisions.set(tc.id, tc.approvalAction);
+            // Prefer the persisted digest (set at the gate from the authoritative
+            // captured input, and never elided); recompute from args only for an
+            // execution that predates the field.
+            contentDigests.set(tc.id, tc.approvalContentDigest ||
+                (tc.args ? contentDigest(tc.args) : ""));
             pendingApprovals.push(create(PendingApprovalSchema, {
                 toolCallId: tc.id,
                 toolName: tc.name,
@@ -242,6 +458,6 @@ export function reconstructAdjudicatedApprovals(messages) {
             }));
         }
     }
-    return { pendingApprovals, decisions };
+    return { pendingApprovals, decisions, contentDigests };
 }
 //# sourceMappingURL=approval-state.js.map

package/dist/activities/execute-cursor/approval-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA8BvE,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC;IAEtC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,kBAAkB;QAClB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,cAAuB,EACvB,MAAwB;IAExB,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc;QACd,eAAe;QACf,cAAc;QACd,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAa3C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA+B,CAAC;YAC9D,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAsBD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,sCAAsC,CAAC;AA8B9C,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAwFD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAoB;IACxE,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,cAA8B,EAC9B,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,yBAAyB;YACzB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;gBACtC,aAAa,EAAE,UAAU;gBACzB,mBAAmB,EAAE,qBAAqB;gBAC1C,WAAW,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC,EACtC,cAAoC;IAEpC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE;YACvD,gBAAgB,EAAE,EAAE,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,YAAqB,EACrB,gBAA+C,EAC/C,MAAwB,EACxB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,YAAY,GAAG,IAAI;IAEnB,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,eAAe;QACf,cAAc;QACd,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/F,WAAW;QACX,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAwB3C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAmB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6D,CAAC;YAC5F,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAwB1C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,sEAAsE;YACtE,qEAAqE;YACrE,qCAAqC;YACrC,cAAc,CAAC,GAAG,CAChB,EAAE,CAAC,EAAE,EACL,EAAE,CAAC,qBAAqB;gBACtB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,IAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;YACF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC"}

package/dist/activities/execute-cursor/capture-flow.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Cursor adapter over the harness-agnostic capture-mode orchestration
+ * ({@link ../../shared/filereview/capture.js}).
+ *
+ * The substrate (git snapshot/restore) and the orchestration (baseline/candidate/
+ * reconcile authoring) live in `shared/filereview/` so the Cursor and deep-agent
+ * harnesses author IDENTICAL ledger entries. This adapter binds the Cursor
+ * specifics:
+ *  - `harnessId = "cursor"` (stamped on the BASELINE payload the projection reads);
+ *  - the Cursor gate files written into the workspace, excluded from the captured
+ *    diff (`CURSOR_RUNNER_OWNED_PATHS`);
+ *  - stamping the streamed file-edit transcript rows that flowed this turn with
+ *    the change set id (`stampFlowedFileEditRows`) — the rows stay visible as
+ *    observational/audit records at their transcript positions, while
+ *    `file_change_sets` remains the single DECISION surface.
+ *
+ * The three turn-boundary functions keep their original signatures so the
+ * activity wiring (index.ts) and the cutover tests are unchanged.
+ */
+import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { FileChangeSet, TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+import { type CaptureResumeResult } from "../../shared/filereview/capture.js";
+import type { GitSubstrateChange as GitCapturedChange } from "../../shared/filereview/git-substrate.js";
+import type { ArtifactStorage } from "../../shared/artifact-storage.js";
+export type { CaptureResumeResult };
+export { deriveCaptureMode } from "../../shared/filereview/capture.js";
+/**
+ * Turn start: pin the pre-turn working tree behind the baseline ref and author
+ * BASELINE_CAPTURED (harnessId "cursor"). Returns the baseline tree sha for the
+ * turn-end diff.
+ */
+export declare function captureBaselineToLedger(opts: {
+    readonly status: AgentExecutionStatus;
+    readonly gitRoot: string;
+    readonly executionId: string;
+    readonly changeSetId: string;
+    /** True (default) for a git work tree; false for a CAS-only non-git workspace. */
+    readonly gitWorkspace?: boolean;
+}): Promise<string>;
+/**
+ * Turn end: capture the change set + author CANDIDATE_CAPTURED, then stamp the
+ * streamed file-edit rows that flowed this turn with the change set id — the
+ * rows stay visible in place as observational records while `file_change_sets`
+ * remains the single decision surface. The working tree is LEFT applied
+ * (Cursor parity).
+ *
+ * The change set is HYBRID (git tree) or CAS-only (non-git): the hook-staged
+ * writes from the cas-observations sidecar this turn ({@link readCasObservations})
+ * — the Cursor analog of deep-agent's `buildCasTurnCaptures` — composed with the
+ * git-tracked diff when `gitWorkspace`. Non-secret staged paths become
+ * `GIT_IGNORED_CAPTURED` (git tree) or `NON_GIT_CAS` (non-git) CAS captures
+ * (before-bytes from the sidecar, after-bytes re-read from disk);
+ * secret-blocked paths become content-less `DIFF_UNREVIEWABLE` entries. The
+ * boundary re-runs {@link partitionIgnoredPathsBySecret} as a fail-closed
+ * backstop, so a secret that ever slipped into the captured set still has its
+ * bytes withheld from durable storage.
+ *
+ * `deniedTokens` are the identities the hook gated this turn (shell/MCP, or a
+ * gitignored delete). A streamed file-edit row whose identity is in that set is
+ * left for the deny-gate reconcile path — it did NOT flow. A flowed gitignored
+ * write is NOT in that set (the hook allowed it), so it is stamped like any
+ * other flowed edit and its captured delta surfaces as a CAS entry in the set.
+ *
+ * `hitlDir`/`storage` are omitted only by callers with no artifact storage
+ * (captureIgnored off); the CAS half is then skipped and this is a git-only
+ * capture exactly as before.
+ *
+ * Mutates `messages` and `status` in place. Returns the captured git changes.
+ */
+export declare function captureTurnToLedger(opts: {
+    readonly status: AgentExecutionStatus;
+    readonly gitRoot: string;
+    readonly executionId: string;
+    readonly changeSetId: string;
+    readonly baselineTree: string;
+    readonly messages: AgentMessage[];
+    readonly deniedTokens: ReadonlySet<string>;
+    readonly hitlDir?: string;
+    readonly storage?: ArtifactStorage;
+    /**
+     * Sub-agent tool-call ids that existed BEFORE this turn's stream (the seeded
+     * prior sub-agents). Sub-agent edit rows created this turn are stamped with the
+     * parent change set id; rows in this set are skipped so a resume never
+     * re-stamps a prior turn's sub-agent rows. Omit when there are no prior
+     * sub-agents.
+     */
+    readonly priorSubAgentToolCallIds?: ReadonlySet<string>;
+    /**
+     * True (default) for a git work tree — the candidate is the git diff composed
+     * with the gitignored CAS captures (`GIT_IGNORED_CAPTURED`). False for a non-git
+     * workspace (Slice 2c): there is no git diff, so the whole change set is the CAS
+     * captures the hook staged for EVERY touched path (`NON_GIT_CAS`).
+     */
+    readonly gitWorkspace?: boolean;
+    /**
+     * The approved-command turn facts (DD-28), derived by the caller from the
+     * turn's tool calls ({@link ../command-provenance.js}). Present only when the
+     * turn qualifies; carried verbatim to the CANDIDATE event.
+     */
+    readonly commandProvenance?: TurnCommandProvenance;
+}): Promise<readonly GitCapturedChange[]>;
+/**
+ * Resume: reconcile the working tree to the change set's DECIDED decisions
+ * (keep approved "after" bytes, snap rejected/undecided back to baseline,
+ * hash-verified), author RECONCILED / FAILED, and release the refs. Delegates to
+ * the shared orchestration with the Cursor harness id + exclude paths.
+ *
+ * `storage` threads the CAS blob store + reader so gitignored (CAS) files in the
+ * change set reconcile from the durable manifest — approved after-blobs written
+ * (hash-verified), rejected files snapped back to their before-blobs. Omit for a
+ * git-only harness/turn; the shared CAS branch is then skipped. The read path is
+ * the same one `exact-apply` already uses (`ArtifactStorage.download`).
+ */
+export declare function applyCaptureDecisions(opts: {
+    readonly status: AgentExecutionStatus;
+    readonly gitRoot: string;
+    readonly executionId: string;
+    readonly changeSet: FileChangeSet;
+    readonly storage?: ArtifactStorage;
+    /**
+     * True (default) for a git work tree; false for a CAS-only non-git workspace
+     * (Slice 2c). When false the reconcile never consults git refs — it is driven
+     * entirely by the durable CAS manifest.
+     */
+    readonly gitWorkspace?: boolean;
+}): Promise<CaptureResumeResult>;