@stigmer/runner 3.0.9-dev.20260616060535 → 3.1.0

package/dist/activities/execute-cursor/command-provenance.js

@@ -0,0 +1,128 @@
+/**
+ * Approved-command turn provenance (DD-28): the runner-owned qualification for
+ * the auto-keep policy.
+ *
+ * A turn whose ONLY mutation source was shell commands the human had already
+ * authorized should not re-gate its file effects at the turn-boundary review —
+ * the user consented to the command, and the command's file effects are the
+ * consented outcome. The server cannot derive this itself (tool calls carry no
+ * turn marker), so the runner — the only component that owns turn scoping —
+ * derives the facts here and attaches them to the CANDIDATE_CAPTURED event as
+ * {@link TurnCommandProvenance}.
+ *
+ * TRUST BOUNDARY. This module asserts turn FACTS (which tools ran this turn),
+ * the same trust level as the captured bytes themselves. It never asserts
+ * CONSENT: `consentToolCallIds` merely POINT at transcript rows whose
+ * `approval_action` was authored by the server's SubmitApproval (and is
+ * preserved against runner writes) — the backend re-verifies every claimed row
+ * against that server-owned record before authoring the policy decision, so a
+ * runner cannot mint authorization it was never given.
+ *
+ * FAIL-CLOSED. Every uncertainty disqualifies (returns undefined → the set
+ * reviews manually, exactly as before DD-28): a file-tool call, an MCP tool, a
+ * sub-agent delegation, an unrecognized tool name, or an executed shell command
+ * with no provable consent source. Being conservative here costs only an extra
+ * review; being permissive would silently waive one.
+ */
+import { create } from "@bufbuild/protobuf";
+import { TurnCommandProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+import { ApprovalAction, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { classifyTool, toolApprovalCategory } from "../../shared/tool-kind.js";
+import { isToolCallRowHidden } from "../../shared/tool-row.js";
+import { toolCallIdentityToken } from "./message-translator.js";
+/**
+ * Tool kinds that can never mutate the workspace: their presence in a turn is
+ * irrelevant to change-set provenance. Everything OUTSIDE this set is either a
+ * consent-mapped shell command or a disqualifier — never silently ignored.
+ */
+const NON_MUTATING_KINDS = new Set([
+    ToolKind.FILE_READ,
+    ToolKind.SEARCH,
+    ToolKind.LIST,
+    ToolKind.FETCH,
+    ToolKind.WEB_SEARCH,
+    ToolKind.THINK,
+    ToolKind.TODO,
+]);
+/**
+ * Derive the {@link TurnCommandProvenance} for the turn, or undefined when the
+ * turn does not qualify (any non-shell mutation-capable call, any unknown tool,
+ * any executed command without a provable consent source, or no executed
+ * consented command at all).
+ */
+export function deriveTurnCommandProvenance(inputs) {
+    const { messages, turnStartIndex, deniedTokens, grantTokenToConsentId, globalBypass } = inputs;
+    const consentIds = new Set();
+    let authorizedByAutoApproveAll = false;
+    let executedCommandCount = 0;
+    for (let i = turnStartIndex; i < messages.length; i++) {
+        for (const tc of messages[i].toolCalls) {
+            // A hidden row is a collapsed twin/reaction — it never executed.
+            if (isToolCallRowHidden(tc))
+                continue;
+            const kind = classifyTool(tc.name, tc.mcpServerSlug);
+            if (NON_MUTATING_KINDS.has(kind))
+                continue;
+            if (kind !== ToolKind.SHELL) {
+                // A file tool (mixed turn), a sub-agent (unattributable mutations), an
+                // MCP tool (opaque side effects), or an unrecognized name — the turn's
+                // mutations cannot be attributed to consented commands. Fail closed.
+                return undefined;
+            }
+            const token = toolCallIdentityToken(tc);
+            if (deniedTokens.has(token)) {
+                // This turn's pending gate — denied by the hook, never executed.
+                continue;
+            }
+            executedCommandCount++;
+            const consentId = grantTokenToConsentId.get(token);
+            if (consentId) {
+                consentIds.add(consentId);
+                continue;
+            }
+            const leaseConsentId = findLeaseConsentId(messages, tc.name);
+            if (leaseConsentId) {
+                consentIds.add(leaseConsentId);
+                continue;
+            }
+            if (globalBypass) {
+                authorizedByAutoApproveAll = true;
+                continue;
+            }
+            // An executed shell command with no grant, no lease, and no bypass should
+            // be impossible (the hook gates every un-consented shell); if it ever
+            // happens, the honest answer is a manual review, not a waived one.
+            return undefined;
+        }
+    }
+    // A turn that executed no consented command has nothing to attribute the
+    // change set to — whatever changed came from somewhere else. Manual review.
+    if (executedCommandCount === 0)
+        return undefined;
+    return create(TurnCommandProvenanceSchema, {
+        consentToolCallIds: [...consentIds],
+        authorizedByAutoApproveAll,
+    });
+}
+/**
+ * Find the transcript row whose APPROVE_ALL authored the run-lifetime lease
+ * covering `toolName`'s category — the consent row a lease-executed command
+ * cites. Searched across the whole transcript (a lease usually originates in a
+ * prior turn); the first (earliest) APPROVE_ALL of the category is the lease's
+ * origin. Returns undefined when no lease row exists for the category.
+ */
+function findLeaseConsentId(messages, toolName) {
+    const category = toolApprovalCategory(toolName);
+    if (!category)
+        return undefined;
+    for (const msg of messages) {
+        for (const tc of msg.toolCalls) {
+            if (tc.approvalAction !== ApprovalAction.APPROVE_ALL)
+                continue;
+            if (toolApprovalCategory(tc.name) === category)
+                return tc.id;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=command-provenance.js.map

package/dist/activities/execute-cursor/command-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-provenance.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/command-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,oEAAoE,CAAC;AAEjH,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,8DAA8D,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,kBAAkB,GAA0B,IAAI,GAAG,CAAC;IACxD,QAAQ,CAAC,SAAS;IAClB,QAAQ,CAAC,MAAM;IACf,QAAQ,CAAC,IAAI;IACb,QAAQ,CAAC,KAAK;IACd,QAAQ,CAAC,UAAU;IACnB,QAAQ,CAAC,KAAK;IACd,QAAQ,CAAC,IAAI;CACd,CAAC,CAAC;AA8BH;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA+B;IAE/B,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAE/F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,0BAA0B,GAAG,KAAK,CAAC;IACvC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAE7B,KAAK,IAAI,CAAC,GAAG,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YACvC,iEAAiE;YACjE,IAAI,mBAAmB,CAAC,EAAE,CAAC;gBAAE,SAAS;YAEtC,MAAM,IAAI,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC;YACrD,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE3C,IAAI,IAAI,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;gBAC5B,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,iEAAiE;gBACjE,SAAS;YACX,CAAC;YACD,oBAAoB,EAAE,CAAC;YAEvB,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnD,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,cAAc,EAAE,CAAC;gBACnB,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,0BAA0B,GAAG,IAAI,CAAC;gBAClC,SAAS;YACX,CAAC;YACD,0EAA0E;YAC1E,sEAAsE;YACtE,mEAAmE;YACnE,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,oBAAoB,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEjD,OAAO,MAAM,CAAC,2BAA2B,EAAE;QACzC,kBAAkB,EAAE,CAAC,GAAG,UAAU,CAAC;QACnC,0BAA0B;KAC3B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CACzB,QAAiC,EACjC,QAAgB;IAEhB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAC/D,IAAI,oBAAoB,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/activities/execute-cursor/exact-apply.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Resume-time exact-apply for approved whole-file writes (Cursor deny-only HITL).
+ *
+ * THE GUARANTEE THIS RESTORES
+ * ---------------------------
+ * A user must get "what you approve is what gets applied" — the contract the
+ * native LangGraph harness and Cursor's own IDE honor by pausing at the exact
+ * tool call and applying its exact args on approval. The Cursor deny-only
+ * harness cannot pause: it denies the tool, grants the RESOURCE (`write\n<path>`),
+ * and reinvokes the model, which REGENERATES content from scratch. So the bytes
+ * that land can differ from the bytes the gate showed (observed in production: a
+ * gate previewing one edit, an applied file carrying more).
+ *
+ * The fix turns an approved WHOLE-FILE write into a runner-executed action: the
+ * runner writes the EXACT approved bytes itself, marks the tool COMPLETED, and —
+ * crucially — issues NO resource grant for it. Any FURTHER write the model makes
+ * to that file on reinvocation is therefore re-gated, so the user sees and
+ * approves every change. This module owns the apply AND the grant-exclusion
+ * derivation ({@link excludeAppliedFromGrants}, the "issues NO grant" half); the
+ * caller wires the resulting grants and the prompt split (so the model is told
+ * the write is already applied and does not redo it).
+ *
+ * SCOPE — whole-file writes only. A hunk edit (`old_string`/`new_string`) is left
+ * on the grant + reinvocation path: applying a hunk would require locating the
+ * fragment in the file, which would make the runner a second source of truth for
+ * the edit result. Shell/MCP grants are already command-/name-specific, so their
+ * approved==applied property is already tight.
+ *
+ * SOURCE OF TRUTH — the approved whole-file bytes and target path are read from
+ * the gated tool call's `args` (the authoritative proposed content the deny-gate
+ * stamped from the hook input; see execute-cursor/message-translator.ts
+ * `applyGateInput`). This is the single copy — there is no separate captured
+ * `file_changes` mirror — so "what was shown == what is applied" holds by
+ * construction. (Phase 5 Slice 4 removed the redundant `ToolCall.file_changes`
+ * copy; `args` was always its source.)
+ *
+ * SAFETY — exact-apply writes ONLY a fully-resolved body. It never writes a
+ * truncated preview or the elision marker (which would silently corrupt the
+ * file); an unresolvable body or any write failure degrades to the existing
+ * grant + reinvocation path. Corruption is never an option — degradation to the
+ * prior behavior is.
+ *
+ * TESTING — the apply + grant-exclusion + re-gating composition is proven
+ * end-to-end (real workspace backend + the real deny-oracle hook) in
+ * `__tests__/deny-gate-exact-apply.test.ts`. That deterministic runner test is
+ * the achievable substitute for a pure-Go offline e2e, which is structurally
+ * infeasible (there is no offline Cursor agent driver — see DD-23).
+ */
+import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+import type { WorkspaceBackend } from "../../shared/workspace/types.js";
+/** Options for {@link applyApprovedWholeFileWrites}. */
+export interface ExactApplyOptions {
+    /** The (seeded) transcript whose approved tool calls are applied in place. */
+    readonly messages: AgentMessage[];
+    /** Workspace the files live in (local FS for OSS, sandbox in cloud). */
+    readonly workspaceBackend: WorkspaceBackend;
+    /** Configured workspace roots; a write is refused outside all of them. */
+    readonly workspaceDirs: readonly string[];
+    /** For structured logs. */
+    readonly executionId: string;
+}
+/**
+ * Apply every APPROVED whole-file write in `messages` to disk with its EXACT
+ * approved bytes, marking each applied tool call COMPLETED in place.
+ *
+ * Returns the set of tool-call ids that were exact-applied, so the caller can
+ * (a) exclude their resources from the approval grants — the key to re-gating a
+ * later write — and (b) describe them as "already applied" in the reinvocation
+ * prompt rather than asking the model to redo them.
+ *
+ * Idempotent: a call already COMPLETED (a Temporal activity retry re-runs this
+ * phase) is skipped, never written twice. Every uncertain case (no resolvable
+ * body, out-of-workspace target, write failure) is SKIPPED, leaving the call
+ * WAITING_APPROVAL so the existing grant + reinvocation path handles it — the
+ * conservative fallback that can never corrupt a file.
+ */
+export declare function applyApprovedWholeFileWrites(opts: ExactApplyOptions): Promise<Set<string>>;
+/**
+ * The adjudicated approvals MINUS the ones the runner already exact-applied — the
+ * set the caller turns into resource grants for the resumed agent.
+ *
+ * This is the "issues NO grant for an applied write" half of the guarantee: an
+ * exact-applied whole-file write is intentionally NOT granted, so if the
+ * reinvoked model writes to that same file again it is re-gated and the user
+ * reviews the new change (the deny-gate's "what you approve is what gets applied"
+ * property). Non-applied approvals (hunk edits, shell, MCP, and every reject /
+ * skip) pass through unchanged — they still need their grant to flow on resume.
+ *
+ * Pure and order-independent. Load-bearing because the caller computes the
+ * adjudicated set ONCE (before {@link applyApprovedWholeFileWrites} flips the
+ * applied calls to COMPLETED) and never re-derives it, so this exclusion is the
+ * only thing that keeps an applied write out of the grants.
+ */
+export declare function excludeAppliedFromGrants(adjudicatedApprovals: readonly PendingApproval[], appliedToolCallIds: ReadonlySet<string>): PendingApproval[];
+/**
+ * The exact approved bytes for a whole-file write, or `null` when they cannot be
+ * recovered (in which case the caller must fall back, never write).
+ *
+ * The bytes come from the gated call's `args` whole-file content — the single
+ * authoritative copy of the proposed body (the deny-gate stamped it from the
+ * hook input; see {@link isApprovedWholeFileWrite}). `args` is never offloaded to
+ * a ref (only dropped wholesale by the aggregate size backstop), so when present
+ * it is intact.
+ *
+ * It NEVER returns the elision marker: that is a lossy stand-in and writing it
+ * would corrupt the file. An `args` body equal to the marker is treated as
+ * unresolved, and the caller degrades to grant + reinvocation.
+ */
+export declare function resolveApprovedWholeFileContent(tc: ToolCall): string | null;

package/dist/activities/execute-cursor/exact-apply.js

@@ -0,0 +1,204 @@
+/**
+ * Resume-time exact-apply for approved whole-file writes (Cursor deny-only HITL).
+ *
+ * THE GUARANTEE THIS RESTORES
+ * ---------------------------
+ * A user must get "what you approve is what gets applied" — the contract the
+ * native LangGraph harness and Cursor's own IDE honor by pausing at the exact
+ * tool call and applying its exact args on approval. The Cursor deny-only
+ * harness cannot pause: it denies the tool, grants the RESOURCE (`write\n<path>`),
+ * and reinvokes the model, which REGENERATES content from scratch. So the bytes
+ * that land can differ from the bytes the gate showed (observed in production: a
+ * gate previewing one edit, an applied file carrying more).
+ *
+ * The fix turns an approved WHOLE-FILE write into a runner-executed action: the
+ * runner writes the EXACT approved bytes itself, marks the tool COMPLETED, and —
+ * crucially — issues NO resource grant for it. Any FURTHER write the model makes
+ * to that file on reinvocation is therefore re-gated, so the user sees and
+ * approves every change. This module owns the apply AND the grant-exclusion
+ * derivation ({@link excludeAppliedFromGrants}, the "issues NO grant" half); the
+ * caller wires the resulting grants and the prompt split (so the model is told
+ * the write is already applied and does not redo it).
+ *
+ * SCOPE — whole-file writes only. A hunk edit (`old_string`/`new_string`) is left
+ * on the grant + reinvocation path: applying a hunk would require locating the
+ * fragment in the file, which would make the runner a second source of truth for
+ * the edit result. Shell/MCP grants are already command-/name-specific, so their
+ * approved==applied property is already tight.
+ *
+ * SOURCE OF TRUTH — the approved whole-file bytes and target path are read from
+ * the gated tool call's `args` (the authoritative proposed content the deny-gate
+ * stamped from the hook input; see execute-cursor/message-translator.ts
+ * `applyGateInput`). This is the single copy — there is no separate captured
+ * `file_changes` mirror — so "what was shown == what is applied" holds by
+ * construction. (Phase 5 Slice 4 removed the redundant `ToolCall.file_changes`
+ * copy; `args` was always its source.)
+ *
+ * SAFETY — exact-apply writes ONLY a fully-resolved body. It never writes a
+ * truncated preview or the elision marker (which would silently corrupt the
+ * file); an unresolvable body or any write failure degrades to the existing
+ * grant + reinvocation path. Corruption is never an option — degradation to the
+ * prior behavior is.
+ *
+ * TESTING — the apply + grant-exclusion + re-gating composition is proven
+ * end-to-end (real workspace backend + the real deny-oracle hook) in
+ * `__tests__/deny-gate-exact-apply.test.ts`. That deterministic runner test is
+ * the achievable substitute for a pure-Go offline e2e, which is structurally
+ * infeasible (there is no offline Cursor agent driver — see DD-23).
+ */
+import { isAbsolute, relative, resolve } from "node:path";
+import { ApprovalAction, ToolCallStatus, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ELISION_MARKER } from "../../shared/status-offload.js";
+import { extractFilePath, extractWriteContent } from "../../shared/file-tools.js";
+import { resolveWorkspacePath } from "../../shared/file-change.js";
+import { utcTimestamp } from "../../shared/status.js";
+/**
+ * Apply every APPROVED whole-file write in `messages` to disk with its EXACT
+ * approved bytes, marking each applied tool call COMPLETED in place.
+ *
+ * Returns the set of tool-call ids that were exact-applied, so the caller can
+ * (a) exclude their resources from the approval grants — the key to re-gating a
+ * later write — and (b) describe them as "already applied" in the reinvocation
+ * prompt rather than asking the model to redo them.
+ *
+ * Idempotent: a call already COMPLETED (a Temporal activity retry re-runs this
+ * phase) is skipped, never written twice. Every uncertain case (no resolvable
+ * body, out-of-workspace target, write failure) is SKIPPED, leaving the call
+ * WAITING_APPROVAL so the existing grant + reinvocation path handles it — the
+ * conservative fallback that can never corrupt a file.
+ */
+export async function applyApprovedWholeFileWrites(opts) {
+    const applied = new Set();
+    for (const msg of opts.messages) {
+        for (const tc of msg.toolCalls) {
+            if (!isApprovedWholeFileWrite(tc))
+                continue;
+            const args = argsRecord(tc);
+            const rawPath = extractFilePath(args);
+            if (!rawPath) {
+                // A whole-file write always carries a path arg; a missing one is
+                // unexpected — do not guess a path, fall back.
+                logSkip(opts.executionId, tc, "no file path in tool args");
+                continue;
+            }
+            // Resolve against the workspace root with the same convention the gate used
+            // (Cursor: real paths, not virtual), so the applied path matches the one the
+            // user approved.
+            const { absolutePath: target } = resolveWorkspacePath(rawPath, opts.workspaceBackend.rootDir, 
+            /* virtualRoot */ false);
+            if (!isWithinWorkspace(target, opts.workspaceDirs)) {
+                logSkip(opts.executionId, tc, `target outside workspace: ${target}`);
+                continue;
+            }
+            const content = resolveApprovedWholeFileContent(tc);
+            if (content === null) {
+                logSkip(opts.executionId, tc, "exact approved bytes unresolvable");
+                continue;
+            }
+            try {
+                await opts.workspaceBackend.writeFile(target, content);
+            }
+            catch (err) {
+                logSkip(opts.executionId, tc, `write failed: ${err instanceof Error ? err.message : String(err)}`);
+                continue;
+            }
+            // The tool is now genuinely done: the runner applied exactly what the user
+            // approved (the same `args` bytes the gate showed). Mark COMPLETED in place
+            // (same id — the backend's append-only-at-identity guard accepts a status
+            // change). The approval_action is preserved as the audit trail; the status
+            // flip removes it from the server's pending_approvals projection (which
+            // keys on WAITING_APPROVAL).
+            tc.status = ToolCallStatus.TOOL_CALL_COMPLETED;
+            if (!tc.completedAt)
+                tc.completedAt = utcTimestamp();
+            tc.error = "";
+            applied.add(tc.id);
+            console.log(`ExecuteCursor exact-apply: wrote approved bytes to ${target} ` +
+                `(tool=${tc.id}); no resource grant issued, so a further change ` +
+                `re-gates. execution=${opts.executionId}`);
+        }
+    }
+    return applied;
+}
+/**
+ * The adjudicated approvals MINUS the ones the runner already exact-applied — the
+ * set the caller turns into resource grants for the resumed agent.
+ *
+ * This is the "issues NO grant for an applied write" half of the guarantee: an
+ * exact-applied whole-file write is intentionally NOT granted, so if the
+ * reinvoked model writes to that same file again it is re-gated and the user
+ * reviews the new change (the deny-gate's "what you approve is what gets applied"
+ * property). Non-applied approvals (hunk edits, shell, MCP, and every reject /
+ * skip) pass through unchanged — they still need their grant to flow on resume.
+ *
+ * Pure and order-independent. Load-bearing because the caller computes the
+ * adjudicated set ONCE (before {@link applyApprovedWholeFileWrites} flips the
+ * applied calls to COMPLETED) and never re-derives it, so this exclusion is the
+ * only thing that keeps an applied write out of the grants.
+ */
+export function excludeAppliedFromGrants(adjudicatedApprovals, appliedToolCallIds) {
+    return adjudicatedApprovals.filter((pa) => !appliedToolCallIds.has(pa.toolCallId));
+}
+/**
+ * The exact approved bytes for a whole-file write, or `null` when they cannot be
+ * recovered (in which case the caller must fall back, never write).
+ *
+ * The bytes come from the gated call's `args` whole-file content — the single
+ * authoritative copy of the proposed body (the deny-gate stamped it from the
+ * hook input; see {@link isApprovedWholeFileWrite}). `args` is never offloaded to
+ * a ref (only dropped wholesale by the aggregate size backstop), so when present
+ * it is intact.
+ *
+ * It NEVER returns the elision marker: that is a lossy stand-in and writing it
+ * would corrupt the file. An `args` body equal to the marker is treated as
+ * unresolved, and the caller degrades to grant + reinvocation.
+ */
+export function resolveApprovedWholeFileContent(tc) {
+    const content = extractWriteContent(argsRecord(tc));
+    if (content !== null && content !== ELISION_MARKER)
+        return content;
+    return null;
+}
+/**
+ * Whether `tc` is an approved, still-pending WHOLE-FILE write eligible for
+ * exact-apply. APPROVE and APPROVE_ALL both approve the clicked tool (the latter
+ * also leases the class, handled separately by the caller). A SKIP/REJECT, an
+ * edit-family call (`old_string`/`new_string`, which carries no whole-file body),
+ * and an already-applied (COMPLETED) call are all excluded.
+ *
+ * The whole-file predicate is `extractWriteContent(args) !== null` — the exact
+ * condition the removed field-22 capture used to classify a change WHOLE_FILE
+ * (a whole-file body present) vs HUNK_ONLY (an edit fragment). Reading it from
+ * `args` keeps eligibility on the single source of truth.
+ */
+function isApprovedWholeFileWrite(tc) {
+    if (tc.status !== ToolCallStatus.TOOL_CALL_WAITING_APPROVAL)
+        return false;
+    if (tc.approvalAction !== ApprovalAction.APPROVE &&
+        tc.approvalAction !== ApprovalAction.APPROVE_ALL) {
+        return false;
+    }
+    return extractWriteContent(argsRecord(tc)) !== null;
+}
+/** The gated tool call's structured args as a plain record (empty when absent). */
+function argsRecord(tc) {
+    return tc.args && typeof tc.args === "object"
+        ? tc.args
+        : {};
+}
+/** Whether `absTarget` resolves inside one of the configured workspace roots. */
+function isWithinWorkspace(absTarget, workspaceDirs) {
+    const target = resolve(absTarget);
+    return workspaceDirs.some((dir) => {
+        const root = resolve(dir);
+        if (target === root)
+            return true;
+        const rel = relative(root, target);
+        return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+    });
+}
+function logSkip(executionId, tc, reason) {
+    console.log(`ExecuteCursor exact-apply skipped (falling back to grant+reinvocation): ` +
+        `tool=${tc.id} reason="${reason}" execution=${executionId}`);
+}
+//# sourceMappingURL=exact-apply.js.map

package/dist/activities/execute-cursor/exact-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exact-apply.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/exact-apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,8DAA8D,CAAC;AAMtE,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AActD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBAAE,SAAS;YAE5C,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,iEAAiE;gBACjE,+CAA+C;gBAC/C,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,2BAA2B,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,4EAA4E;YAC5E,6EAA6E;YAC7E,iBAAiB;YACjB,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,oBAAoB,CACnD,OAAO,EACP,IAAI,CAAC,gBAAgB,CAAC,OAAO;YAC7B,iBAAiB,CAAC,KAAK,CACxB,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,6BAA6B,MAAM,EAAE,CAAC,CAAC;gBACrE,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAG,+BAA+B,CAAC,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,mCAAmC,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CACL,IAAI,CAAC,WAAW,EAChB,EAAE,EACF,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpE,CAAC;gBACF,SAAS;YACX,CAAC;YAED,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,wEAAwE;YACxE,6BAA6B;YAC7B,EAAE,CAAC,MAAM,GAAG,cAAc,CAAC,mBAAmB,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,WAAW;gBAAE,EAAE,CAAC,WAAW,GAAG,YAAY,EAAE,CAAC;YACrD,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,sDAAsD,MAAM,GAAG;gBAC7D,SAAS,EAAE,CAAC,EAAE,mDAAmD;gBACjE,uBAAuB,IAAI,CAAC,WAAW,EAAE,CAC5C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,oBAAgD,EAChD,kBAAuC;IAEvC,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,+BAA+B,CAAC,EAAY;IAC1D,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,wBAAwB,CAAC,EAAY;IAC5C,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;QAAE,OAAO,KAAK,CAAC;IAC1E,IACE,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,OAAO;QAC5C,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW,EAChD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,EAAY;IAC9B,OAAO,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;QAC3C,CAAC,CAAE,EAAE,CAAC,IAAgC;QACtC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CACxB,SAAiB,EACjB,aAAgC;IAEhC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,WAAmB,EAAE,EAAY,EAAE,MAAc;IAChE,OAAO,CAAC,GAAG,CACT,0EAA0E;QACxE,QAAQ,EAAE,CAAC,EAAE,YAAY,MAAM,eAAe,WAAW,EAAE,CAC9D,CAAC;AACJ,CAAC"}

package/dist/activities/execute-cursor/hook-script.d.ts

@@ -54,47 +54,76 @@
  * recorded here correlates to the streamed tool call, and an approval grant
  * matches the agent's re-attempt on reinvocation.
  *
+ * Content-exact identity (the sibling-hole fix): for a file edit the coarse
+ * (category, salient) is not enough — approving one edit to a file must not let
+ * a DIFFERENT edit to the SAME file ride through. So the hook ALSO computes a
+ * CONTENT token `base64(category \n salient \n contentDigest)`, where
+ * contentDigest is a sha256 over the edit content (mirror of file-tools.ts
+ * contentDigest; see buildContentDigestScript). It allows a built-in when EITHER
+ * the content token (a file edit approved with this exact content) OR the coarse
+ * token (shell/delete, or a content-less degrade) is granted, and records the
+ * content token as the denial identity. The runner grants the content token when
+ * it has the approved content (the persisted approval_content_digest), so a
+ * sibling edit re-gates; it degrades to the coarse grant only when the content is
+ * unrecoverable.
+ *
  * Policy evaluation order (first match wins). The model is "gate the dangerous
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll → allow
+ * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
+ *    spec.auto_approve_all global bypass) → allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
  *    b. otherwise → record denial, deny
- *    (auto-approved / unlisted MCP tools fall through → allow)
+ *    (auto-approved / unlisted MCP tools fall through → allow; a server-scoped
+ *     lease drops the server's tools from mcpToolPolicies, so they fall through)
  * 3. preToolUse event → gated built-in (category non-empty):
  *    a. identity token in approvedGrantTokens → allow (reinvocation grant)
- *    b. otherwise → record denial, deny
+ *    b. category in leasedCategories → allow (run-lifetime scoped lease)
+ *    c. otherwise → record denial, deny
  *    (read-only / ungated built-ins fall through → allow)
  */
 /**
- * Generates the bash hook script content.
+ * Generates the STABLE bash hook script content.
+ *
+ * The script is STABLE across executions in a runner process — its only inputs
+ * are the absolute path of the active-turn pointer (and the runner's Node
+ * binary), both constant for a given workspace. This is deliberate and
+ * load-bearing: the Cursor SDK loads `<workspace>/.cursor/hooks.json` (the hook
+ * script PATH) ONCE per runner process and caches it, ignoring later
+ * per-execution rewrites. A per-session script with per-session baked paths
+ * therefore gets cached at the FIRST execution and reused for every later one,
+ * recording their denials into the FIRST session's ledger while each later runner
+ * reads its own (empty) ledger and silently completes — the no-approval-button /
+ * "execution completed" regression. Keeping the script stable and resolving the
+ * CURRENT turn's artifacts from the pointer (which bash re-reads every
+ * invocation; see {@link ActiveTurnPointer}/writeActiveTurnPointer) makes a
+ * long-lived multi-session runner correct.
  *
- * The script reads a JSON state file written by the cursor-runner before
- * each agent.send() call. The state file is the single source of truth
- * for the dynamic approval inputs (autoApproveAll, mcpToolPolicies,
- * approvedGrantTokens). The static policy (which built-ins are gated and their
- * categories, and which arg fields are salient) is baked into the script at
- * generation time from approval-policy.ts.
+ * From the pointer the script reads the current turn's approval-state file (the
+ * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
+ * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * static policy (which built-ins are gated, their categories, the salient arg
+ * fields) is baked at generation time from approval-policy.ts.
  *
  * The identity token encoding (`base64(key \n salient)`) must stay byte-identical
  * to grantToken() in approval-state.ts.
  *
  * Scope guard (the crux of issue #173): the Cursor SDK loads project hooks from
- * `<workspace>/.cursor/hooks.json`, which is the SAME per-repo surface every
- * Cursor client reads. When a session runs against the user's real repo, the
- * user's own interactive Cursor IDE would otherwise load and run this hook too —
- * gating the IDE, polluting the denial ledger with the IDE's tool calls, and (in
- * multi-root windows) failing closed. We make the gate apply ONLY to the
- * runner's own agent by baking in the runner process PID and checking, on every
- * invocation, whether the runner is an ancestor of the hook process. The SDK
- * runs hooks in-process via child_process, so the runner's own agent (and its
- * delegated sub-agents) spawn the hook as a descendant of the runner; any other
- * Cursor client spawns it under a different process tree. A non-descendant
- * invocation is allowed immediately and never touches the ledger. This also
- * makes a leftover hooks.json self-neutralizing: once the runner exits, no
- * invocation can match its (now-dead) PID, so the gate is inert.
+ * `<workspace>/.cursor/hooks.json`, the SAME per-repo surface every Cursor client
+ * reads. When a session runs against the user's real repo, the user's own
+ * interactive Cursor IDE would otherwise load and run this hook too — gating the
+ * IDE, polluting the denial ledger, and (in multi-root windows) failing closed.
+ * We make the gate apply ONLY to the runner's own agent by checking, on every
+ * invocation, whether the runner PID (FROM THE POINTER) is an ancestor of the
+ * hook process. The SDK runs hooks in-process via child_process, so the runner's
+ * own agent (and its delegated sub-agents) spawn the hook as a descendant of the
+ * runner; any other Cursor client spawns it under a different process tree. A
+ * non-descendant invocation is allowed immediately and never touches the ledger.
+ * Combined with pointer teardown, a leftover hooks.json is self-neutralizing:
+ * once the turn ends (pointer removed) or the runner exits (PID dead), no
+ * invocation gates, so the gate is inert.
  */
-export declare function generateHookScript(stateFilePath: string, ledgerFilePath: string, runnerPid: number): string;
+export declare function generateHookScript(activePointerPath: string, workspaceRoot?: string): string;