@stigmer/runner 3.1.3 → 3.1.4

package/src/activities/execute-cursor/capture-flow.ts

@@ -36,9 +36,15 @@ import {
   type CaptureResumeResult,
 } from "../../shared/filereview/capture.js";
 import {
-  captureFileChangeProgress,
-  type ProgressCaptureState,
+  createGitProgressSubstrate,
+  createHybridProgressSubstrate,
+  type ProgressSubstrate,
 } from "../../shared/filereview/progress.js";
+import {
+  createCasProgressSubstrate,
+  type CasTouchedReader,
+  type CasTouchedSnapshot,
+} from "../../shared/filereview/cas-progress.js";
 import { hasCandidateCaptured } from "../../shared/filereview/events.js";
 import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
 import { casBlobReader, type CasPathCapture } from "../../shared/filereview/cas-substrate.js";
@@ -202,31 +208,71 @@ export async function captureTurnToLedger(opts: {
 }
 
 /**
- * Mid-run: attach the live "N files changed so far" snapshot onto
- * `status.file_change_progress` (DD-32), throttled by the floor + tree-sha
- * short-circuit inside {@link captureFileChangeProgress}. The Cursor adapter binds
- * `CURSOR_RUNNER_OWNED_PATHS` so the progress diff excludes the gate's own files —
- * the SAME exclusion {@link captureTurnToLedger} uses for the turn-boundary
- * candidate, so the live count and the reviewed set agree. Content-free and
- * secret-safe; a no-op when nothing changed since the last capture.
+ * Choose the mid-run progress substrate for this turn's workspace shape (DD-32 /
+ * DD-33), returning `undefined` when there is nothing to observe (not capture
+ * mode, or no workspace). Built ONCE per turn — the substrate owns its own
+ * short-circuit cache across the loop's persists; the floor lives in the caller's
+ * `ProgressCaptureState`. The live count and the turn-boundary reviewed set agree
+ * by construction: the git slice binds the SAME `CURSOR_RUNNER_OWNED_PATHS`
+ * exclusion {@link captureTurnToLedger} uses, and the CAS slice reads the SAME
+ * hook sidecar ({@link readCasObservations}) the boundary reads.
+ *
+ *  - git tree, no storage      -> git substrate only (tracked-file `--numstat`);
+ *  - git tree, storage (HYBRID) -> git + CAS (the gitignored writes the hook staged);
+ *  - non-git workspace          -> CAS only (every tool-mediated write is CAS-staged).
+ *
+ * The CAS slice needs the hook sidecar, which exists only when `captureIgnored`
+ * is on (storage configured). A non-git capture already required storage
+ * (`deriveCaptureMode`), so its sidecar is always present; a git tree with no
+ * storage simply gets the git-only substrate (parity with the pre-DD-33 behavior).
  */
-export async function captureProgressToStatus(opts: {
-  readonly status: AgentExecutionStatus;
-  readonly gitRoot: string;
+export function buildCursorProgressSubstrate(opts: {
+  readonly captureMode: boolean;
+  readonly gitWorkspace: boolean;
+  readonly workspaceRoot: string | undefined;
+  readonly baselineTree: string | undefined;
   readonly executionId: string;
-  readonly changeSetId: string;
-  readonly baselineTree: string;
-  readonly state: ProgressCaptureState;
-}): Promise<void> {
-  await captureFileChangeProgress({
-    status: opts.status,
-    gitRoot: opts.gitRoot,
-    executionId: opts.executionId,
-    changeSetId: opts.changeSetId,
-    baselineTree: opts.baselineTree,
-    excludePaths: CURSOR_RUNNER_OWNED_PATHS,
-    state: opts.state,
-  });
+  readonly hitlDir: string | undefined;
+  readonly storage: ArtifactStorage | undefined;
+}): ProgressSubstrate | undefined {
+  const { captureMode, gitWorkspace, workspaceRoot, baselineTree, executionId, hitlDir, storage } = opts;
+  if (!captureMode || !workspaceRoot) return undefined;
+
+  const casReader: CasTouchedReader | undefined =
+    hitlDir && storage ? createSidecarTouchedReader(hitlDir) : undefined;
+
+  if (gitWorkspace) {
+    if (!baselineTree) return undefined;
+    const git = createGitProgressSubstrate({
+      workspaceRoot,
+      executionId,
+      baselineTree,
+      excludePaths: CURSOR_RUNNER_OWNED_PATHS,
+    });
+    return casReader
+      ? createHybridProgressSubstrate(git, createCasProgressSubstrate({ workspaceRoot, read: casReader }))
+      : git;
+  }
+
+  // Non-git: every tool-mediated write is CAS-staged; there is no git slice.
+  return casReader ? createCasProgressSubstrate({ workspaceRoot, read: casReader }) : undefined;
+}
+
+/**
+ * A {@link CasTouchedReader} over the Cursor hook's on-disk sidecar. Each capture
+ * reads the current observations ({@link readCasObservations}) and maps them to
+ * the substrate's snapshot shape. Reads are bounded by the caller's capture floor
+ * (default 2s), and the sidecar is small (one small marker + before-blob per
+ * touched gitignored path), so re-reading per capture is cheap and always
+ * reflects sub-agent writes staged since the last one.
+ */
+function createSidecarTouchedReader(hitlDir: string): CasTouchedReader {
+  return async (): Promise<CasTouchedSnapshot> => {
+    const { captured, secretPaths } = await readCasObservations(hitlDir);
+    const before = new Map<string, Uint8Array | null>();
+    for (const c of captured) before.set(c.path, c.before);
+    return { before, blockedSecretPaths: new Set(secretPaths) };
+  };
 }
 
 /**

package/src/activities/execute-cursor/command-provenance.ts

@@ -1,54 +1,21 @@
 /**
- * Approved-command turn provenance (DD-28): the runner-owned qualification for
- * the auto-keep policy.
+ * Approved-command turn provenance (DD-28) — the CURSOR harness adapter over the
+ * shared qualification rule ({@link qualifyTurnCommandProvenance}).
  *
- * A turn whose ONLY mutation source was shell commands the human had already
- * authorized should not re-gate its file effects at the turn-boundary review —
- * the user consented to the command, and the command's file effects are the
- * consented outcome. The server cannot derive this itself (tool calls carry no
- * turn marker), so the runner — the only component that owns turn scoping —
- * derives the facts here and attaches them to the CANDIDATE_CAPTURED event as
- * {@link TurnCommandProvenance}.
+ * The Cursor harness scopes a turn POSITIONALLY (messages from the turn's first
+ * streamed index onward) and maps an executed command to its consent row through
+ * the reinvocation grant tokens the deny-gate minted. Both mappings are Cursor's
+ * own; the DD-28 rule they feed lives in `shared/filereview/command-provenance.ts`
+ * so the Cursor and deep-agent qualifications cannot drift.
  *
- * TRUST BOUNDARY. This module asserts turn FACTS (which tools ran this turn),
- * the same trust level as the captured bytes themselves. It never asserts
- * CONSENT: `consentToolCallIds` merely POINT at transcript rows whose
- * `approval_action` was authored by the server's SubmitApproval (and is
- * preserved against runner writes) — the backend re-verifies every claimed row
- * against that server-owned record before authoring the policy decision, so a
- * runner cannot mint authorization it was never given.
- *
- * FAIL-CLOSED. Every uncertainty disqualifies (returns undefined → the set
- * reviews manually, exactly as before DD-28): a file-tool call, an MCP tool, a
- * sub-agent delegation, an unrecognized tool name, or an executed shell command
- * with no provable consent source. Being conservative here costs only an extra
- * review; being permissive would silently waive one.
+ * (Trust boundary + fail-closed contract: see the shared module.)
  */
 
-import { create } from "@bufbuild/protobuf";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import { TurnCommandProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
 import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
-import { ApprovalAction, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { classifyTool, toolApprovalCategory } from "../../shared/tool-kind.js";
-import { isToolCallRowHidden } from "../../shared/tool-row.js";
+import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
 import { toolCallIdentityToken } from "./message-translator.js";
 
-/**
- * Tool kinds that can never mutate the workspace: their presence in a turn is
- * irrelevant to change-set provenance. Everything OUTSIDE this set is either a
- * consent-mapped shell command or a disqualifier — never silently ignored.
- */
-const NON_MUTATING_KINDS: ReadonlySet<ToolKind> = new Set([
-  ToolKind.FILE_READ,
-  ToolKind.SEARCH,
-  ToolKind.LIST,
-  ToolKind.FETCH,
-  ToolKind.WEB_SEARCH,
-  ToolKind.THINK,
-  ToolKind.TODO,
-]);
-
 export interface CommandProvenanceInputs {
   /**
    * The full transcript at capture time. Turn scoping is positional: messages
@@ -79,90 +46,28 @@ export interface CommandProvenanceInputs {
 
 /**
  * Derive the {@link TurnCommandProvenance} for the turn, or undefined when the
- * turn does not qualify (any non-shell mutation-capable call, any unknown tool,
- * any executed command without a provable consent source, or no executed
- * consented command at all).
+ * turn does not qualify. Scopes this turn's tool calls positionally, resolves
+ * consent through the deny-gate grant tokens, and delegates the DD-28 rule to
+ * {@link qualifyTurnCommandProvenance}.
  */
 export function deriveTurnCommandProvenance(
   inputs: CommandProvenanceInputs,
 ): TurnCommandProvenance | undefined {
   const { messages, turnStartIndex, deniedTokens, grantTokenToConsentId, globalBypass } = inputs;
 
-  const consentIds = new Set<string>();
-  let authorizedByAutoApproveAll = false;
-  let executedCommandCount = 0;
-
-  for (let i = turnStartIndex; i < messages.length; i++) {
-    for (const tc of messages[i].toolCalls) {
-      // A hidden row is a collapsed twin/reaction — it never executed.
-      if (isToolCallRowHidden(tc)) continue;
-
-      const kind = classifyTool(tc.name, tc.mcpServerSlug);
-      if (NON_MUTATING_KINDS.has(kind)) continue;
-
-      if (kind !== ToolKind.SHELL) {
-        // A file tool (mixed turn), a sub-agent (unattributable mutations), an
-        // MCP tool (opaque side effects), or an unrecognized name — the turn's
-        // mutations cannot be attributed to consented commands. Fail closed.
-        return undefined;
-      }
+  // This turn's tool calls are the positional tail from the first message this
+  // turn's stream produced; everything before was seeded from prior turns.
+  const turnToolCalls = messages.slice(turnStartIndex).flatMap((m) => m.toolCalls);
 
-      const token = toolCallIdentityToken(tc);
-      if (deniedTokens.has(token)) {
-        // This turn's pending gate — denied by the hook, never executed.
-        continue;
-      }
-      executedCommandCount++;
-
-      const consentId = grantTokenToConsentId.get(token);
-      if (consentId) {
-        consentIds.add(consentId);
-        continue;
-      }
-      const leaseConsentId = findLeaseConsentId(messages, tc.name);
-      if (leaseConsentId) {
-        consentIds.add(leaseConsentId);
-        continue;
-      }
-      if (globalBypass) {
-        authorizedByAutoApproveAll = true;
-        continue;
-      }
-      // An executed shell command with no grant, no lease, and no bypass should
-      // be impossible (the hook gates every un-consented shell); if it ever
-      // happens, the honest answer is a manual review, not a waived one.
-      return undefined;
-    }
-  }
-
-  // A turn that executed no consented command has nothing to attribute the
-  // change set to — whatever changed came from somewhere else. Manual review.
-  if (executedCommandCount === 0) return undefined;
-
-  return create(TurnCommandProvenanceSchema, {
-    consentToolCallIds: [...consentIds],
-    authorizedByAutoApproveAll,
+  return qualifyTurnCommandProvenance({
+    turnToolCalls,
+    messages,
+    // A shell whose identity token is in the denial ledger was denied by the
+    // hook — this turn's pending gate, never executed.
+    isExecutedCommand: (tc) => !deniedTokens.has(toolCallIdentityToken(tc)),
+    // A grant token maps back to the consent row (the row carrying the
+    // server-authored approval_action) that authorized this reinvocation.
+    resolveDirectConsent: (tc) => grantTokenToConsentId.get(toolCallIdentityToken(tc)),
+    globalBypass,
   });
 }
-
-/**
- * Find the transcript row whose APPROVE_ALL authored the run-lifetime lease
- * covering `toolName`'s category — the consent row a lease-executed command
- * cites. Searched across the whole transcript (a lease usually originates in a
- * prior turn); the first (earliest) APPROVE_ALL of the category is the lease's
- * origin. Returns undefined when no lease row exists for the category.
- */
-function findLeaseConsentId(
-  messages: readonly AgentMessage[],
-  toolName: string,
-): string | undefined {
-  const category = toolApprovalCategory(toolName);
-  if (!category) return undefined;
-  for (const msg of messages) {
-    for (const tc of msg.toolCalls) {
-      if (tc.approvalAction !== ApprovalAction.APPROVE_ALL) continue;
-      if (toolApprovalCategory(tc.name) === category) return tc.id;
-    }
-  }
-  return undefined;
-}