@stigmer/runner 3.1.3 → 3.1.5

package/dist/activities/execute-cursor/turn-stream.js

@@ -0,0 +1,249 @@
+/**
+ * The Cursor harness's stream phase — the single per-event consumption loop that
+ * turns a live Cursor SDK run into the streamed transcript, mid-run progress, and
+ * the flags that decide how the turn ends.
+ *
+ * Extracted from the activity entry point (index.ts) so that BOTH the primary
+ * turn and the two recovery retries (poisoned-handle / transport-timeout) drive
+ * the exact same code. The retries previously re-implemented a stripped "bare"
+ * loop that dropped live persist, DD-32/DD-33 mid-run progress, sub-agent
+ * tracking, the first-denial early stop, and correct pause/stall handling — so a
+ * retry froze the UI and mis-handled a mid-retry pause. One loop removes that
+ * drift by construction.
+ *
+ * This mirrors the deep-agent harness's `streamExecution` seam
+ * (execute-deep-agent/streaming.ts): injected `heartbeat`/`isCancelled` so it
+ * runs without Temporal, a structural `StreamableRun` so it runs without the live
+ * SDK, and a result (the terminal reason) instead of internal terminal mapping.
+ * The one deliberate difference: this consumer REPORTS why the stream ended and
+ * leaves the terminal MAPPING to the activity, because Cursor's mapping is
+ * entangled with worker-shutdown-vs-pause disambiguation, the turn boundary,
+ * structured output, and recovery retries — all of which must stay in index.ts.
+ */
+import { create } from "@bufbuild/protobuf";
+import { CancelledFailure } from "@temporalio/activity";
+import { ExecutionControlSignal } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { StreamingUsageSummarySchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/usage_pb";
+import { startStallWatchdog, StallTimeoutError, } from "../../shared/stall-watchdog.js";
+import { shouldPersistStreamingStatus } from "./persist-decision.js";
+import { readDenialLedger } from "./approval-state.js";
+import { captureFileChangeProgress, } from "../../shared/filereview/progress.js";
+export function newTurnStreamState() {
+    return {
+        pauseDetected: false,
+        stallDetected: false,
+        stallError: undefined,
+        firstDenialDetected: false,
+        denialLedgerDirty: false,
+        denialCancelSettled: undefined,
+        platformStopSignaled: false,
+        streamErrorMessage: undefined,
+        lastToolName: undefined,
+        eventCount: 0,
+        firstTurnAttributionLogged: false,
+        stallWatchdog: undefined,
+    };
+}
+/**
+ * Build the shared onDelta callback. The Cursor SDK's fine-grained delta channel
+ * carries token usage, live shell output, and precise tool-call timings; it also
+ * fires far more often than discrete stream events, so it is where the stall
+ * timer is reset during a long model generation. A heartbeat CancelledFailure
+ * here flags the pause so the loop and epilogue treat it as a user pause (the
+ * bare retry loops swallowed this — the cause of the mid-retry mislabel).
+ */
+export function makeCursorTurnOnDelta(deps) {
+    const { usageAccumulator, deltaEnricher, heartbeat, promptEstimatedTokens, executionId, state } = deps;
+    return ({ update }) => {
+        // Reset the stall timer on the delta channel too: a long model generation
+        // emits token deltas but few discrete stream events, so resetting only in the
+        // stream loop would false-positive a stall.
+        state.stallWatchdog?.recordActivity();
+        if (update.type === "turn-ended" && update.usage) {
+            usageAccumulator.addTurn(update.usage);
+            if (!state.firstTurnAttributionLogged) {
+                state.firstTurnAttributionLogged = true;
+                const sdkInputTokens = update.usage.inputTokens ?? 0;
+                const cursorOverhead = Math.max(0, sdkInputTokens - promptEstimatedTokens);
+                console.log(`ExecuteCursor context attribution (first turn): execution=${executionId}, ` +
+                    `sdkInputTokens=${sdkInputTokens}, stigmerPreamble=${promptEstimatedTokens}, ` +
+                    `cursorOverhead=${cursorOverhead} (estimated)`);
+            }
+        }
+        deltaEnricher.processDelta(update);
+        try {
+            heartbeat();
+        }
+        catch (hbErr) {
+            if (hbErr instanceof CancelledFailure) {
+                state.pauseDetected = true;
+                return;
+            }
+            throw hbErr;
+        }
+    };
+}
+/**
+ * Consume a Cursor SDK run to completion (or to a clean early stop), driving the
+ * transcript, todos, sub-agent tracking, live persist, and DD-32/DD-33 mid-run
+ * progress, and reporting WHY the stream ended.
+ *
+ * Arms + stops its own stall watchdog (stored on `state.stallWatchdog` so the
+ * shared onDelta can reset it and the activity's finally can stop it as a
+ * backstop). Mutates `deps.status` + `deps.state` in place. The caller owns the
+ * post-stream finalize and the terminal mapping.
+ */
+export async function consumeCursorTurnStream(run, deps) {
+    const { status, accumulator, todoTracker, deltaEnricher, eventRecorder, scheduler, usageAccumulator, progressSubstrate, progressState, changeSetId, hitlDir, executionId, stallTimeoutMs, persist, heartbeat, isCancelled, state, } = deps;
+    // Arm the stall watchdog now that the run exists. The activity's periodic
+    // heartbeat proves the process is alive, not that the agent is progressing: if
+    // the stream wedges (a tool call or model connection that never returns), no
+    // event/delta arrives and the turn would hang forever. On stall we end the run
+    // cleanly via the SDK's run.cancel() (guarded by supports("cancel")), which
+    // unblocks the for-await; the caller then reports EXECUTION_FAILED with a
+    // recognizable, actionable message.
+    state.stallWatchdog = startStallWatchdog(stallTimeoutMs, (idleMs) => {
+        state.stallDetected = true;
+        state.stallError = new StallTimeoutError(idleMs, state.lastToolName ? `last tool: ${state.lastToolName}` : undefined);
+        console.warn(`ExecuteCursor stall detected: execution=${executionId}, idleMs=${idleMs}, lastTool=${state.lastToolName ?? "none"}`);
+        if (run.supports?.("cancel")) {
+            void run.cancel().catch((cancelErr) => {
+                console.warn(`ExecuteCursor run.cancel() after stall failed (non-fatal): execution=${executionId}, ` +
+                    `error=${cancelErr instanceof Error ? cancelErr.message : cancelErr}`);
+            });
+        }
+    });
+    try {
+        for await (const event of run.stream()) {
+            if (state.pauseDetected || isCancelled()) {
+                state.pauseDetected = true;
+                break;
+            }
+            if (state.stallDetected)
+                break;
+            // Progress: reset the stall timer on every stream event.
+            state.stallWatchdog.recordActivity();
+            if (event.type === "tool_call" && typeof event.name === "string") {
+                state.lastToolName = event.name;
+            }
+            eventRecorder?.record(event, state.eventCount);
+            accumulator.processEvent(event);
+            todoTracker.processEvent(event);
+            if (event.type === "tool_call" && event.name === "task") {
+                accumulator.trackSubAgentExecution(event);
+            }
+            // First-denial stop (HITL clean pause). In CAPTURE mode this fires only for
+            // an IRREVERSIBLE tool the hook still gates (shell, MCP, or a gitignored
+            // write/delete) — file edits flow freely and are captured at the turn
+            // boundary, so they never enter the ledger. In the deny-gate FALLBACK
+            // (non-git workspace) it fires for every gated file edit too. Either way:
+            // the preToolUse hook appends to the denial ledger the instant it gates a
+            // tool — before Cursor surfaces the failure to the model — and the fs
+            // watcher flips denialLedgerDirty the moment that write lands. Confirming
+            // the flag with a read on the very next event (of ANY type — thinking
+            // deltas arrive within milliseconds) ends the turn before the model's
+            // reaction can persist: waiting for the next tool_call event let the full
+            // post-denial reaction (thinking, narration, a workaround shell) stream and
+            // persist live (production case aex_01kwj07f7g23c3wp9sn8496z5g). The
+            // tool_call-event read stays as the backstop for platforms where fs.watch
+            // is unreliable; the current event was already accumulated above, so the
+            // anchor's own row is always present for the turn-boundary gate overlay.
+            if (!state.firstDenialDetected && hitlDir && (state.denialLedgerDirty || event.type === "tool_call")) {
+                state.denialLedgerDirty = false;
+                const denials = await readDenialLedger(hitlDir);
+                if (denials.length > 0) {
+                    state.firstDenialDetected = true;
+                    console.log(`ExecuteCursor first denial detected (${denials.length} ledger ` +
+                        `entr${denials.length === 1 ? "y" : "ies"}); stopping turn to pause ` +
+                        `cleanly for approval: execution=${executionId}`);
+                    if (run.supports?.("cancel")) {
+                        // Kept (not fire-and-forget): awaited timeboxed by the turn boundary
+                        // so the ledger read and tree capture see a stopped agent.
+                        state.denialCancelSettled = run.cancel().then(() => { }, (cancelErr) => {
+                            console.warn(`ExecuteCursor run.cancel() after first denial failed (non-fatal): ` +
+                                `execution=${executionId}, ` +
+                                `error=${cancelErr instanceof Error ? cancelErr.message : cancelErr}`);
+                        });
+                    }
+                    break;
+                }
+            }
+            deltaEnricher.applyEnrichments(status.messages);
+            state.eventCount++;
+            if (event.type === "status") {
+                console.log(`ExecuteCursor stream status: execution=${executionId}, status=${JSON.stringify(event)}`);
+                const statusEvent = event;
+                if (statusEvent.status === "ERROR" && statusEvent.message) {
+                    state.streamErrorMessage = statusEvent.message;
+                }
+            }
+            const shouldPersist = shouldPersistStreamingStatus({
+                deltaEnricherDirty: deltaEnricher.isDirty,
+                todosDirty: todoTracker.isDirty,
+                contentDirty: accumulator.isDirty,
+            }, scheduler, state.eventCount);
+            if (usageAccumulator.hasTurns) {
+                status.streamingUsage = create(StreamingUsageSummarySchema, usageAccumulator.snapshot());
+            }
+            if (shouldPersist) {
+                // Sync sub-agent executions into status before every persist so the live
+                // UI reflects delegation (including the IN_PROGRESS state) while the
+                // parent is still running — matching the native harness.
+                status.subAgentExecutions = accumulator.subAgentExecutions;
+                // Mid-run live capture (DD-32 / DD-33): attach the "N files changed so
+                // far" snapshot onto status.file_change_progress, throttled internally by
+                // the floor. Never authoritative — the turn-boundary candidate remains
+                // the reviewed diff.
+                if (progressSubstrate) {
+                    await captureFileChangeProgress({
+                        status,
+                        changeSetId,
+                        substrate: progressSubstrate,
+                        state: progressState,
+                    });
+                }
+                const signal = await persist(status);
+                deltaEnricher.markPersisted();
+                todoTracker.markPersisted();
+                accumulator.markPersisted();
+                scheduler.markUpdateSent(state.eventCount);
+                heartbeat();
+                if (signal === ExecutionControlSignal.STOP) {
+                    state.platformStopSignaled = true;
+                    console.warn(`ExecuteCursor platform stop signal received: execution=${executionId}`);
+                }
+            }
+            if (state.platformStopSignaled) {
+                console.log(`ExecuteCursor stopping stream due to platform stop signal: execution=${executionId}`);
+                break;
+            }
+        }
+    }
+    catch (streamErr) {
+        // run.cancel() — from the stall watchdog or the first-denial stop — can make
+        // the stream iterator reject as it tears down; that is the expected teardown
+        // for both, so swallow it and fall through. Anything else is a genuine stream
+        // failure — rethrow it to the activity's error handler.
+        if (!state.stallDetected && !state.firstDenialDetected)
+            throw streamErr;
+        console.warn(`ExecuteCursor stream ended via cancel: execution=${executionId}, ` +
+            `stall=${state.stallDetected}, firstDenial=${state.firstDenialDetected}`);
+    }
+    finally {
+        state.stallWatchdog.stop();
+    }
+    // Report why the stream ended, in the same precedence the activity's epilogue
+    // applies: a stall (an EXECUTION_FAILED terminal) outranks everything; a
+    // platform stop and a first denial are distinct proceed/return outcomes; a
+    // pause is the fallback for a cancellation with no other cause.
+    if (state.stallDetected)
+        return "stalled";
+    if (state.platformStopSignaled)
+        return "platform-stop";
+    if (state.firstDenialDetected)
+        return "first-denial";
+    if (state.pauseDetected || isCancelled())
+        return "paused";
+    return "completed";
+}
+//# sourceMappingURL=turn-stream.js.map

package/dist/activities/execute-cursor/turn-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-stream.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/turn-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8DAA8D,CAAC;AACtG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+DAA+D,CAAC;AAE5G,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EACL,yBAAyB,GAG1B,MAAM,qCAAqC,CAAC;AAuE7C,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,SAAS;QACrB,mBAAmB,EAAE,KAAK;QAC1B,iBAAiB,EAAE,KAAK;QACxB,mBAAmB,EAAE,SAAS;QAC9B,oBAAoB,EAAE,KAAK;QAC3B,kBAAkB,EAAE,SAAS;QAC7B,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,CAAC;QACb,0BAA0B,EAAE,KAAK;QACjC,aAAa,EAAE,SAAS;KACzB,CAAC;AACJ,CAAC;AAmCD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAqB;IAErB,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,KAAK,EAAE,GAC7F,IAAI,CAAC;IACP,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACpB,0EAA0E;QAC1E,8EAA8E;QAC9E,4CAA4C;QAC5C,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEvC,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,CAAC;gBACtC,KAAK,CAAC,0BAA0B,GAAG,IAAI,CAAC;gBACxC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;gBACrD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC,CAAC;gBAC3E,OAAO,CAAC,GAAG,CACT,6DAA6D,WAAW,IAAI;oBAC1E,kBAAkB,cAAc,qBAAqB,qBAAqB,IAAI;oBAC9E,kBAAkB,cAAc,cAAc,CACjD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC3B,OAAO;YACT,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAkB,EAClB,IAA0B;IAE1B,MAAM,EACJ,MAAM,EACN,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,OAAO,EACP,WAAW,EACX,cAAc,EACd,OAAO,EACP,SAAS,EACT,WAAW,EACX,KAAK,GACN,GAAG,IAAI,CAAC;IAET,0EAA0E;IAC1E,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,0EAA0E;IAC1E,oCAAoC;IACpC,KAAK,CAAC,aAAa,GAAG,kBAAkB,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE;QAClE,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,UAAU,GAAG,IAAI,iBAAiB,CACtC,MAAM,EACN,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACF,OAAO,CAAC,IAAI,CACV,2CAA2C,WAAW,YAAY,MAAM,cAAc,KAAK,CAAC,YAAY,IAAI,MAAM,EAAE,CACrH,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;gBACpC,OAAO,CAAC,IAAI,CACV,wEAAwE,WAAW,IAAI;oBACrF,SAAS,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CACxE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,aAAa,IAAI,WAAW,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,aAAa;gBAAE,MAAM;YAE/B,yDAAyD;YACzD,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC;YAClC,CAAC;YAED,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAE/C,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAChC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAEhC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxD,WAAW,CAAC,sBAAsB,CAAC,KAAmD,CAAC,CAAC;YAC1F,CAAC;YAED,4EAA4E;YAC5E,yEAAyE;YACzE,sEAAsE;YACtE,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,sEAAsE;YACtE,0EAA0E;YAC1E,4EAA4E;YAC5E,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,CAAC,KAAK,CAAC,mBAAmB,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBACrG,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC;gBAChC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,GAAG,CACT,wCAAwC,OAAO,CAAC,MAAM,UAAU;wBAC9D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,4BAA4B;wBACrE,mCAAmC,WAAW,EAAE,CACnD,CAAC;oBACF,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC7B,qEAAqE;wBACrE,2DAA2D;wBAC3D,KAAK,CAAC,mBAAmB,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAC3C,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,SAAkB,EAAE,EAAE;4BACrB,OAAO,CAAC,IAAI,CACV,oEAAoE;gCAClE,aAAa,WAAW,IAAI;gCAC5B,SAAS,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CACxE,CAAC;wBACJ,CAAC,CACF,CAAC;oBACJ,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;YAED,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,KAAK,CAAC,UAAU,EAAE,CAAC;YAEnB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CACT,0CAA0C,WAAW,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACzF,CAAC;gBACF,MAAM,WAAW,GAAG,KAA8C,CAAC;gBACnE,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;oBAC1D,KAAK,CAAC,kBAAkB,GAAG,WAAW,CAAC,OAAO,CAAC;gBACjD,CAAC;YACH,CAAC;YAED,MAAM,aAAa,GAAG,4BAA4B,CAChD;gBACE,kBAAkB,EAAE,aAAa,CAAC,OAAO;gBACzC,UAAU,EAAE,WAAW,CAAC,OAAO;gBAC/B,YAAY,EAAE,WAAW,CAAC,OAAO;aAClC,EACD,SAAS,EACT,KAAK,CAAC,UAAU,CACjB,CAAC;YACF,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;gBAC9B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,yEAAyE;gBACzE,qEAAqE;gBACrE,yDAAyD;gBACzD,MAAM,CAAC,kBAAkB,GAAG,WAAW,CAAC,kBAAkB,CAAC;gBAC3D,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,qBAAqB;gBACrB,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,yBAAyB,CAAC;wBAC9B,MAAM;wBACN,WAAW;wBACX,SAAS,EAAE,iBAAiB;wBAC5B,KAAK,EAAE,aAAa;qBACrB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrC,aAAa,CAAC,aAAa,EAAE,CAAC;gBAC9B,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC5B,WAAW,CAAC,aAAa,EAAE,CAAC;gBAC5B,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC3C,SAAS,EAAE,CAAC;gBACZ,IAAI,MAAM,KAAK,sBAAsB,CAAC,IAAI,EAAE,CAAC;oBAC3C,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,0DAA0D,WAAW,EAAE,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YAED,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CACT,wEAAwE,WAAW,EAAE,CACtF,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,mBAAmB;YAAE,MAAM,SAAS,CAAC;QACxE,OAAO,CAAC,IAAI,CACV,oDAAoD,WAAW,IAAI;YACjE,SAAS,KAAK,CAAC,aAAa,iBAAiB,KAAK,CAAC,mBAAmB,EAAE,CAC3E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,KAAK,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,oBAAoB;QAAE,OAAO,eAAe,CAAC;IACvD,IAAI,KAAK,CAAC,mBAAmB;QAAE,OAAO,cAAc,CAAC;IACrD,IAAI,KAAK,CAAC,aAAa,IAAI,WAAW,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC1D,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/activities/execute-deep-agent/command-provenance.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
+ * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
+ *
+ * The deep-agent's consent model differs from Cursor's in exactly two ways, and
+ * this adapter is precisely those two differences:
+ *
+ * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
+ *    index its stream started at. The deep-agent cannot: an approved command
+ *    executes IN PLACE at its seeded transcript position (it was proposed in a
+ *    prior segment, seeded into this segment, and updated to COMPLETED by
+ *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
+ *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
+ *    snapshot, and "executed" is a COMPLETED status.
+ *
+ * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
+ *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
+ *    same row, and the row keeps its id + `approval_action` when it executes on
+ *    resume. So the executed command IS its own consent row — cite its own id.
+ *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
+ *    across the status write regardless of its new status, so the backend's
+ *    verification finds it.)
+ *
+ * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
+ * sub-agents"). A sub-agent's writes fold into the parent turn's change set
+ * (DD-19) but are not attributable to a consented top-level command. The
+ * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
+ * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
+ * the (currently-impossible under the replace-per-turn model) case of a sub-agent
+ * that mutates across a turn boundary without a fresh top-level `task` row.
+ *
+ * (Trust boundary + fail-closed contract: see the shared module.)
+ */
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+export interface DeepAgentCommandProvenanceInputs {
+    /** The status at capture time — top-level messages + sub-agent executions. */
+    readonly status: AgentExecutionStatus;
+    /**
+     * The top-level tool-call ids that had already SETTLED before this turn's
+     * stream (from {@link collectSettledToolCallIds}). A top-level call whose id is
+     * absent is this-turn's; the shared rule then keeps only the COMPLETED ones.
+     */
+    readonly priorSettledToolCallIds: ReadonlySet<string>;
+    /**
+     * The sub-agent tool-call ids that existed before this turn's stream (from
+     * {@link collectSubAgentToolCallIds}). Any growth means a sub-agent acted this
+     * turn → fail closed.
+     */
+    readonly priorSubAgentToolCallIds: ReadonlySet<string>;
+    /** True when the pre-armed spec.auto_approve_all bypassed the gate. */
+    readonly globalBypass: boolean;
+}
+/**
+ * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
+ * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
+ * resolves consent from the row's own server-authored `approval_action`, fails
+ * closed on any sub-agent activity, and delegates the DD-28 rule to
+ * {@link qualifyTurnCommandProvenance}.
+ */
+export declare function deriveTurnCommandProvenance(inputs: DeepAgentCommandProvenanceInputs): TurnCommandProvenance | undefined;

package/dist/activities/execute-deep-agent/command-provenance.js

@@ -0,0 +1,72 @@
+/**
+ * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
+ * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
+ *
+ * The deep-agent's consent model differs from Cursor's in exactly two ways, and
+ * this adapter is precisely those two differences:
+ *
+ * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
+ *    index its stream started at. The deep-agent cannot: an approved command
+ *    executes IN PLACE at its seeded transcript position (it was proposed in a
+ *    prior segment, seeded into this segment, and updated to COMPLETED by
+ *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
+ *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
+ *    snapshot, and "executed" is a COMPLETED status.
+ *
+ * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
+ *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
+ *    same row, and the row keeps its id + `approval_action` when it executes on
+ *    resume. So the executed command IS its own consent row — cite its own id.
+ *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
+ *    across the status write regardless of its new status, so the backend's
+ *    verification finds it.)
+ *
+ * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
+ * sub-agents"). A sub-agent's writes fold into the parent turn's change set
+ * (DD-19) but are not attributable to a consented top-level command. The
+ * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
+ * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
+ * the (currently-impossible under the replace-per-turn model) case of a sub-agent
+ * that mutates across a turn boundary without a fresh top-level `task` row.
+ *
+ * (Trust boundary + fail-closed contract: see the shared module.)
+ */
+import { ApprovalAction, ToolCallStatus, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
+import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+/**
+ * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
+ * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
+ * resolves consent from the row's own server-authored `approval_action`, fails
+ * closed on any sub-agent activity, and delegates the DD-28 rule to
+ * {@link qualifyTurnCommandProvenance}.
+ */
+export function deriveTurnCommandProvenance(inputs) {
+    const { status, priorSettledToolCallIds, priorSubAgentToolCallIds, globalBypass } = inputs;
+    // DD-28 D1 cond 2: any sub-agent activity this turn disqualifies. A sub-agent
+    // that ran this turn contributes at least one tool-call id absent from the
+    // pre-stream snapshot.
+    for (const id of collectSubAgentToolCallIds(status.subAgentExecutions)) {
+        if (!priorSubAgentToolCallIds.has(id))
+            return undefined;
+    }
+    const messages = status.messages;
+    // This turn's top-level calls: those not already settled before the stream.
+    const turnToolCalls = messages
+        .flatMap((m) => m.toolCalls)
+        .filter((tc) => !priorSettledToolCallIds.has(tc.id));
+    return qualifyTurnCommandProvenance({
+        turnToolCalls,
+        messages,
+        // A deep-agent command executed iff its row reached COMPLETED this turn.
+        isExecutedCommand: (tc) => tc.status === ToolCallStatus.TOOL_CALL_COMPLETED,
+        // The gated command carries its own server-authored approval_action, written
+        // in place by SubmitApproval and preserved when the row executes on resume.
+        resolveDirectConsent: (tc) => tc.approvalAction === ApprovalAction.APPROVE ||
+            tc.approvalAction === ApprovalAction.APPROVE_ALL
+            ? tc.id
+            : undefined,
+        globalBypass,
+    });
+}
+//# sourceMappingURL=command-provenance.js.map

package/dist/activities/execute-deep-agent/command-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-provenance.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/command-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,8DAA8D,CAAC;AAGtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAqBtE;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwC;IAExC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAE3F,8EAA8E;IAC9E,2EAA2E;IAC3E,uBAAuB;IACvB,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,4EAA4E;IAC5E,MAAM,aAAa,GAAG,QAAQ;SAC3B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvD,OAAO,4BAA4B,CAAC;QAClC,aAAa;QACb,QAAQ;QACR,yEAAyE;QACzE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,mBAAmB;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3B,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,OAAO;YAC5C,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;YAC9C,CAAC,CAAC,EAAE,CAAC,EAAE;YACP,CAAC,CAAC,SAAS;QACf,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/activities/execute-deep-agent/index.js

@@ -19,6 +19,7 @@ import { activityStarted, activityFinished } from "../../idle-watchdog.js";
 import { normalizeActivityInput } from "../../shared/activity-input.js";
 import { persistStatus, reportSetupProgress, slimStatus, utcTimestamp } from "../../shared/status.js";
 import { acquireWorkspaceLock, WorkspaceLockCancelledError, WorkspaceLockTimeoutError, } from "../../shared/workspace/workspace-lock.js";
+import { ensureStigmerSymlink, removeStigmerSymlink, } from "../../shared/workspace/stigmer-link.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { classifyTool } from "../../shared/tool-kind.js";
 import { POLICY_ENGINE_VERSION, toProtoPolicySource, } from "../../shared/approval-policy.js";
@@ -33,12 +34,14 @@ import { processPostStream } from "./post-stream.js";
 import { resolveResumeInput } from "./hitl.js";
 import { captureApprovalArtifacts } from "./approval-file-change.js";
 import { applyCaptureDecisions, captureBaselineToLedger, captureCandidateToLedger, } from "../../shared/filereview/capture.js";
-import { captureFileChangeProgress, newProgressCaptureState, } from "../../shared/filereview/progress.js";
+import { captureFileChangeProgress, createGitProgressSubstrate, createHybridProgressSubstrate, newProgressCaptureState, } from "../../shared/filereview/progress.js";
+import { createCasProgressSubstrate, } from "../../shared/filereview/cas-progress.js";
 import { hasCandidateCaptured } from "../../shared/filereview/events.js";
 import { casBlobReader } from "../../shared/filereview/cas-substrate.js";
 import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
-import { collectSubAgentToolCallIds, withholdSecretContentFromMessages } from "../../shared/tool-row.js";
+import { collectSettledToolCallIds, collectSubAgentToolCallIds, withholdSecretContentFromMessages, } from "../../shared/tool-row.js";
 import { stampFlowedFileEditRows, stampFlowedSubAgentFileEditRows } from "./stamp-flowed-rows.js";
+import { deriveTurnCommandProvenance } from "./command-provenance.js";
 /** The harness id stamped on the deep-agent's file-review ledger events. */
 const DEEP_AGENT_HARNESS_ID = "deep-agent";
 export function createDeepAgentActivities(config) {
@@ -170,6 +173,21 @@ export function createDeepAgentActivities(config) {
                     }
                     throw lockErr;
                 }
+                // Bridge the workspace to the session's platform dir so the agent's
+                // file tools can read platform-mounted content (`.stigmer/inputs/…`
+                // attachments incl. the approved plan, `.stigmer/skills/…`) — the
+                // deepagents FilesystemBackend resolves paths against the workspace
+                // root and knows nothing of the LocalWorkspaceBackend's `.stigmer`
+                // routing. Two ordering invariants (see shared/workspace/stigmer-link.ts):
+                //  - AFTER the lock: the link is a tree mutation; sessions sharing one
+                //    attached directory must not re-point it under a running turn.
+                //  - BEFORE the baseline capture below: present in both the baseline
+                //    and candidate trees, the link cancels out of the file-review diff
+                //    even when the workspace's git excludes do not list `.stigmer`.
+                // Removed in cleanup() (the finally below), before the lock releases.
+                if (setup.workspaceBackend.platformDir) {
+                    await ensureStigmerSymlink(gitRoot, setup.workspaceBackend.platformDir);
+                }
                 // (1) Capture-mode resume — reconcile any DECIDED change set FIRST (this
                 // drops the per-execution refs), before the next baseline re-pins them
                 // (refs are executionId-keyed). Then (2) short-circuit a pure file-review
@@ -254,8 +272,10 @@ export function createDeepAgentActivities(config) {
                     }
                 }
                 // Turn start (capture mode): pin the pre-turn tree + author BASELINE. Taken
-                // AFTER any reconcile above and AFTER performSetup's workspace writes, so
-                // the baseline absorbs the reconciled state and the runner-owned files.
+                // AFTER any reconcile above and AFTER performSetup's workspace writes and
+                // the `.stigmer` symlink above, so the baseline absorbs the reconciled
+                // state and the runner-owned files (the symlink then cancels out of the
+                // baseline→candidate diff).
                 let captureBaselineTree = "";
                 // Snapshot the sub-agent tool-call ids that exist BEFORE this turn's
                 // stream, so the turn-boundary stamp scopes itself to sub-agent rows
@@ -263,6 +283,12 @@ export function createDeepAgentActivities(config) {
                 // seeds prior sub-agents — but computed, not assumed, so it stays correct
                 // if that ever changes; see collectSubAgentToolCallIds).
                 const priorSubAgentToolCallIds = collectSubAgentToolCallIds(initialStatus.subAgentExecutions);
+                // Snapshot the top-level tool-call ids already SETTLED before this turn's
+                // stream, so the approved-command provenance (DD-28) scopes itself to THIS
+                // turn's executed commands by identity. The deep-agent's approved shell
+                // executes in place at its seeded position, so the Cursor positional scope
+                // would miss it — see execute-deep-agent/command-provenance.ts.
+                const priorSettledToolCallIds = collectSettledToolCallIds(initialStatus.messages);
                 if (setup.captureMode) {
                     captureBaselineTree = await captureBaselineToLedger({
                         status: initialStatus,
@@ -273,14 +299,31 @@ export function createDeepAgentActivities(config) {
                         gitWorkspace: setup.gitWorkspace,
                     });
                 }
-                // Per-turn state for mid-run live capture (DD-32): the last progress tree
-                // sha (short-circuit) + last capture time (floor), threaded across the
-                // streaming loop's persists via the beforePersist hook below. The capture
-                // flags are hoisted so the deferred hook does not depend on `setup`
-                // (non-null here, but not narrowable inside a later-invoked closure).
+                // Per-turn state + substrate for mid-run live capture (DD-32 / DD-33). The
+                // floor lives in progressState; the substrate is chosen for this turn's
+                // workspace shape and owns its own short-circuit cache. An atomic snapshot
+                // of the shared observer feeds the CAS/HYBRID substrates — copied
+                // synchronously so a concurrent sub-agent write cannot mutate it mid-read.
                 const progressState = newProgressCaptureState();
-                const progressCaptureMode = setup.captureMode;
-                const progressGitWorkspace = setup.gitWorkspace;
+                const casObserver = setup.casObserver;
+                const readObserverTouched = () => ({
+                    before: new Map(casObserver.before),
+                    blockedSecretPaths: new Set(casObserver.blockedSecretPaths),
+                });
+                // Git tree -> hybrid (numstat for tracked + observer for gitignored);
+                // non-git -> cas over the observer (no baseline tree needed). Undefined
+                // outside capture mode (writes are deny-gated, nothing is captured).
+                const progressSubstrate = !setup.captureMode
+                    ? undefined
+                    : setup.gitWorkspace
+                        ? captureBaselineTree
+                            ? createHybridProgressSubstrate(createGitProgressSubstrate({
+                                workspaceRoot: gitRoot,
+                                executionId,
+                                baselineTree: captureBaselineTree,
+                            }), createCasProgressSubstrate({ workspaceRoot: gitRoot, read: readObserverTouched }))
+                            : undefined
+                        : createCasProgressSubstrate({ workspaceRoot: gitRoot, read: readObserverTouched });
                 const cancellationSignal = Context.current().cancellationSignal;
                 const result = await streamExecution({
                     agentGraph: setup.agentGraph,
@@ -305,20 +348,21 @@ export function createDeepAgentActivities(config) {
                         globalBypass: setup.globalBypass,
                     },
                     streamVersion: setup.streamVersion,
-                    // Mid-run live capture (DD-32): attach file_change_progress before each
-                    // scheduled persist. Git capture mode only (a pinned baseline exists);
-                    // deep-agent writes no runner-owned gate files into the tree, so no
-                    // excludePaths — matching its turn-boundary candidate capture.
+                    // Mid-run live capture (DD-32 / DD-33): attach file_change_progress
+                    // before each scheduled persist, throttled by the floor inside
+                    // captureFileChangeProgress. The substrate (git / non-git CAS / hybrid)
+                    // was chosen for this turn above; the deep-agent's only runner-owned
+                    // tree entry is the `.stigmer` symlink, created before the baseline
+                    // so it appears identically in every capture and cancels out of the
+                    // diff — the git slice therefore needs no excludePaths, matching its
+                    // turn-boundary candidate capture.
                     beforePersist: async (status) => {
-                        if (!progressCaptureMode || !progressGitWorkspace || !captureBaselineTree) {
+                        if (!progressSubstrate)
                             return;
-                        }
                         await captureFileChangeProgress({
                             status,
-                            gitRoot,
-                            executionId,
                             changeSetId,
-                            baselineTree: captureBaselineTree,
+                            substrate: progressSubstrate,
                             state: progressState,
                         });
                     },
@@ -366,6 +410,23 @@ export function createDeepAgentActivities(config) {
                         ? FileCaptureClass.GIT_IGNORED_CAPTURED
                         : FileCaptureClass.NON_GIT_CAS;
                     const { casCaptures, unreviewablePaths } = await buildCasTurnCaptures(setup.casObserver, gitRoot, casCaptureClass);
+                    // Approved-command turn facts (DD-28): when every mutation-capable call
+                    // this turn was a consented shell command, attach the provenance so the
+                    // backend can verify the cited consent rows and auto-keep the set
+                    // instead of arming a second review gate. Fail-closed: any non-qualifying
+                    // turn attaches nothing and reviews manually exactly as before. Attached
+                    // only when captureCandidateToLedger actually authors a CANDIDATE.
+                    const commandProvenance = deriveTurnCommandProvenance({
+                        status: initialStatus,
+                        priorSettledToolCallIds,
+                        priorSubAgentToolCallIds,
+                        globalBypass: setup.globalBypass,
+                    });
+                    if (commandProvenance) {
+                        console.log(`[ExecuteDeepAgent] capture: turn qualifies for approved-command auto-keep ` +
+                            `(consent rows: ${commandProvenance.consentToolCallIds.join(",") || "(auto_approve_all)"}); ` +
+                            `attaching provenance to candidate (execution=${executionId})`);
+                    }
                     await captureCandidateToLedger({
                         status: initialStatus,
                         gitRoot,
@@ -378,6 +439,7 @@ export function createDeepAgentActivities(config) {
                         unreviewablePaths,
                         unreviewableCaptureClass: casCaptureClass,
                         gitWorkspace: setup.gitWorkspace,
+                        commandProvenance,
                     });
                     // Review is pending iff a CANDIDATE was actually authored (the seam
                     // drops no-op captures), so a turn that only touched-then-unchanged an
@@ -736,5 +798,11 @@ async function cleanup(setup) {
             console.warn("[ExecuteDeepAgent] MCP connection cleanup failed:", err);
         }
     }
+    // Drop the workspace→platform `.stigmer` symlink so an attached repo is
+    // left untouched between turns (issue #173 semantics; a multi-turn session
+    // recreates it next turn). Runs in the activity finally, BEFORE the
+    // workspace lock releases, so the next queued turn baselines a clean tree.
+    // Best-effort and symlink-only: a real `.stigmer` directory is never removed.
+    await removeStigmerSymlink(setup.workspaceBackend.rootDir);
 }
 //# sourceMappingURL=index.js.map