@stigmer/runner 3.1.6 → 3.1.8

package/src/activities/execute-cursor/__tests__/turn-boundary.test.ts

@@ -17,7 +17,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { create } from "@bufbuild/protobuf";
+import { create, type JsonObject } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
   ToolCallSchema,
@@ -238,6 +238,133 @@ describe("runTurnBoundary", () => {
     expect(shellCall.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 
+  // ── Issue #205: unattributed hook blocks and the kind split ────────────────
+
+  /** A FAILED tool call carrying Cursor's generic hook-block error text. */
+  function hookBlockedCall(id: string, name: string, args: JsonObject) {
+    return create(ToolCallSchema, {
+      id,
+      name,
+      status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "Command blocked by a hook.",
+      args,
+    });
+  }
+
+  /** Append one entry to this turn's denial ledger. */
+  async function appendLedgerEntry(entry: Record<string, unknown>): Promise<void> {
+    await writeFile(denialLedgerPath(hitlDir), JSON.stringify(entry) + "\n", { flag: "a" });
+  }
+
+  it("reports a foreign hook block on a non-pausing turn (the #205 silent-complete shape)", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+    });
+
+    // A foreign .cursor/hooks.json hook denied the write: Cursor stamped its
+    // generic error, our ledger stayed empty, the tree is untouched. Before
+    // this fix the boundary reported a clean non-waiting turn and the run
+    // completed silently with the work undone.
+    const blocked = hookBlockedCall("tc-foreign", "edit", { path: "notes.md" });
+    status.messages.push(
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [blocked] }),
+    );
+
+    const result = await runTurnBoundary(
+      boundaryOpts(status, baseline, { foreignGatingHooks: ["./team-policy.sh"] }),
+    );
+
+    expect(result.waiting).toBe(false);
+    expect(result.unattributedHookBlocks).toEqual([
+      { toolCallId: "tc-foreign", toolName: "edit", error: "Command blocked by a hook." },
+    ]);
+    // The row itself is untouched — no gate was manufactured for a block no
+    // approval can lift; the caller fails the execution instead.
+    expect(blocked.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+  });
+
+  it("attributes a secret hard-block (kind:'secret'): no pause, no false foreign-hook report", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+    });
+
+    const secretRow = hookBlockedCall("tc-secret", "edit", { path: ".env" });
+    status.messages.push(
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [secretRow] }),
+    );
+    await writeFile(
+      denialLedgerPath(hitlDir),
+      JSON.stringify({
+        toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret",
+      }) + "\n",
+      "utf-8",
+    );
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    // Not a pause (the agent was told to move on), not a foreign block (our
+    // own kinded entry attributes it), and never a WAITING_APPROVAL overlay.
+    expect(result.waiting).toBe(false);
+    expect(result.deniedToolCallCount).toBe(0);
+    expect(result.unattributedHookBlocks).toEqual([]);
+    expect(secretRow.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+  });
+
+  it("mixed turn: pauses on our anchor while still reporting the foreign block", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+    });
+
+    const ourGated = create(ToolCallSchema, {
+      id: "tc-ours", name: "shell",
+      status: ToolCallStatus.TOOL_CALL_RUNNING,
+      args: { command: "rm -rf build" },
+    });
+    const foreign = hookBlockedCall("tc-theirs", "shell", { command: "terraform apply" });
+    status.messages.push(
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [ourGated, foreign] }),
+    );
+    await appendLedgerEntry({ toolName: "shell", token: toolCallIdentityToken(ourGated), kind: "approval" });
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    // The pause wins (a pausing turn is never silent); the foreign block is
+    // still surfaced so the caller can log it next to the approval.
+    expect(result.waiting).toBe(true);
+    expect(ourGated.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(result.unattributedHookBlocks.map((b) => b.toolCallId)).toEqual(["tc-theirs"]);
+  });
+
+  it("excludes a kinded (secret) deny from the flowed-edit stamp (full-ledger deniedTokens)", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status, gitRoot: repo, executionId: EXEC_ID, changeSetId: CHANGE_SET_ID,
+    });
+
+    // One edit genuinely flowed (tree changed + streamed row); one secret-like
+    // write was hard-blocked (FAILED row + kind:"secret" entry, tree untouched).
+    await write("notes.md", "original notes\nplus a real edit\n");
+    status.messages.push(streamedEdit("tc-flowed", "notes.md", "original notes\nplus a real edit\n"));
+    const secretRow = hookBlockedCall("tc-secret", "edit", { path: ".env" });
+    status.messages.push(
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [secretRow] }),
+    );
+    await appendLedgerEntry({ toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" });
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    // The flowed edit is captured + stamped; the secret-blocked row is NOT
+    // stamped into a change set that does not contain its file — every ledger
+    // kind means "this action did not execute", so the stamp uses the FULL set.
+    expect(result.waiting).toBe(true);
+    expect(result.capturedChangeCount).toBe(1);
+    expect(status.messages[0].toolCalls[0].fileChangeSetId).toBe(CHANGE_SET_ID);
+    expect(secretRow.fileChangeSetId).toBe("");
+  });
+
   it("waits for the denial-stop cancel to settle before reading the ledger", async () => {
     const status = newStatus();
     const baseline = await captureBaselineToLedger({

package/src/activities/execute-cursor/__tests__/workspace-setup.test.ts

@@ -216,6 +216,65 @@ describe("buildMergedConfig", () => {
   });
 });
 
+// ── Issue #205: foreign gating hook reporting ────────────────────────────────
+// The merge PRESERVES the user's own hooks (correct — never clobber their
+// config), but Cursor runs every configured hook and a deny from any of them
+// blocks the runner's tools without writing our denial ledger. buildMergedConfig
+// therefore reports the foreign commands left on the GATING events so the
+// runner can log the exposure and name the culprit when the turn boundary
+// detects an unattributed hook block.
+describe("buildMergedConfig — foreign gating hook reporting (issue #205)", () => {
+  const bothEvents = [
+    { event: "preToolUse", scriptPath: "/abs/hitl/stigmer-approval.sh" },
+    { event: "beforeMCPExecution", scriptPath: "/abs/hitl/stigmer-approval.sh" },
+  ];
+
+  it("reports no foreign hooks when no hooks.json exists", () => {
+    expect(buildMergedConfig(null, bothEvents).foreignGatingHooks).toEqual([]);
+  });
+
+  it("reports user commands on the gating events, ignoring non-gating events", () => {
+    const original = JSON.stringify({
+      version: 1,
+      hooks: {
+        preToolUse: [{ command: "./gate-writes.sh", failClosed: true }],
+        beforeMCPExecution: [{ command: "./gate-mcp.sh" }],
+        // postToolUse cannot deny a tool — it must not be reported.
+        postToolUse: [{ command: "./audit.sh" }],
+      },
+    });
+    const { foreignGatingHooks } = buildMergedConfig(original, bothEvents);
+    expect(foreignGatingHooks).toEqual(["./gate-writes.sh", "./gate-mcp.sh"]);
+  });
+
+  it("excludes Stigmer's own entries (current and legacy) from the report", () => {
+    const original = JSON.stringify({
+      version: 1,
+      hooks: {
+        preToolUse: [
+          { command: "/home/u/.stigmer/sessions/ses-1/hitl/stigmer-approval.sh" },
+          { command: ".cursor/hooks/stigmer-approval.sh" }, // pre-#173 legacy
+          { command: "./user.sh" },
+        ],
+      },
+    });
+    const { foreignGatingHooks } = buildMergedConfig(original, bothEvents);
+    expect(foreignGatingHooks).toEqual(["./user.sh"]);
+  });
+
+  it("ignores malformed entries without a string command", () => {
+    const original = JSON.stringify({
+      version: 1,
+      hooks: { preToolUse: [{ command: 42 }, { timeout: 5 }, null, "bare-string"] },
+    });
+    expect(buildMergedConfig(original, bothEvents).foreignGatingHooks).toEqual([]);
+  });
+
+  it("reports nothing for an unparseable hooks.json (replaced for the turn, so it cannot run)", () => {
+    expect(buildMergedConfig("{ not json", bothEvents).foreignGatingHooks).toEqual([]);
+  });
+});
+
 describe("installHitlGate / removeHitlGate", () => {
   const approvalState = buildApprovalState(new Map(), false, new Set());
 
@@ -290,6 +349,42 @@ describe("installHitlGate / removeHitlGate", () => {
     expect(existsSync(join(workspaceRoot, ".cursor", "hooks"))).toBe(false);
   });
 
+  it("surfaces the preserved foreign gating hooks on the install handle", async () => {
+    const { workspaceRoot, hitlDir } = dirs();
+    const cursorDir = join(workspaceRoot, ".cursor");
+    mkdirSync(cursorDir, { recursive: true });
+    writeFileSync(
+      join(cursorDir, "hooks.json"),
+      JSON.stringify({
+        version: 1,
+        hooks: {
+          preToolUse: [{ command: "./gate-writes.sh", failClosed: true }],
+          postToolUse: [{ command: "./audit.sh" }],
+        },
+      }),
+      "utf-8",
+    );
+
+    const handle = await installHitlGate({
+      workspaceRoot, hitlDir, approvalState, runnerPid: process.pid,
+    });
+    // The user's gating hook is preserved in the merged config AND reported on
+    // the handle (both registered events read the same preToolUse array here,
+    // so the report carries the one foreign command once per gating event it
+    // could fire on — preToolUse only, since beforeMCPExecution was absent).
+    expect(handle.foreignGatingHooks).toEqual(["./gate-writes.sh"]);
+    await removeHitlGate(handle);
+  });
+
+  it("reports no foreign hooks for a pristine workspace", async () => {
+    const { workspaceRoot, hitlDir } = dirs();
+    const handle = await installHitlGate({
+      workspaceRoot, hitlDir, approvalState, runnerPid: process.pid,
+    });
+    expect(handle.foreignGatingHooks).toEqual([]);
+    await removeHitlGate(handle);
+  });
+
   it("restores a pre-existing user hooks.json byte-for-byte after teardown", async () => {
     const { workspaceRoot, hitlDir } = dirs();
     const cursorDir = join(workspaceRoot, ".cursor");

package/src/activities/execute-cursor/approval-state.ts

@@ -56,14 +56,24 @@
  *
  * Denial ledger (hook → runner):
  * The state file is the runner's INPUT to the hook. Its symmetric OUTPUT is the
- * denial ledger (denials.jsonl): when the hook denies a tool, it appends
- * the call's identity token to this file. The runner reads the ledger after the
- * run to learn which tool calls were gated — the hook is the only component that
- * actually makes the per-call allow/deny decision, so its ledger is the
- * authoritative "what was denied this turn" signal (the cursor analog of the
- * native harness's LangGraph interrupts). The token uses the SAME identity space
- * as approvedGrantTokens, so a denial token approved this turn becomes a grant
- * token next turn.
+ * denial ledger (denials.jsonl): EVERY deny the hook issues appends the call's
+ * identity token to this file, tagged with a `kind` (see {@link DenialKind}) —
+ * so the ledger is the complete, authoritative record of what THIS hook blocked
+ * this turn (the cursor analog of the native harness's LangGraph interrupts).
+ * The kinds split by consumer semantics:
+ *
+ * - Only APPROVAL-kind entries pause the run (the first-denial stop and
+ *   reconcileDeniedToolCalls filter to them via {@link approvalDenials}); a
+ *   secret hard-block or a fail-closed deny must never surface an approval the
+ *   user cannot meaningfully grant.
+ * - The FULL ledger (all kinds) means "these actions did NOT execute": it feeds
+ *   capture stamping and DD-28 provenance, and it is the ATTRIBUTION set for
+ *   issue #205 — a hook-blocked tool call with NO ledger entry of any kind was
+ *   blocked by a FOREIGN hook (or a failed ledger append), an invariant
+ *   violation the turn boundary surfaces instead of completing silently.
+ *
+ * The token uses the SAME identity space as approvedGrantTokens, so a denial
+ * token approved this turn becomes a grant token next turn.
  */
 
 import { watch } from "node:fs";
@@ -433,12 +443,40 @@ export async function writeApprovalStateFile(
 
 const DENIAL_LEDGER_FILE = "denials.jsonl";
 
+/**
+ * The attribution taxonomy of a hook denial (mirrored byte-for-byte by the
+ * generated bash script — see hook-script.ts record_denial):
+ *
+ * - `approval`      — the normal gate: the runner surfaces it as a
+ *                     WAITING_APPROVAL pause. The ONLY kind that pauses.
+ * - `secret`        — DD-26 secret hard-block: intentional, non-pausing (the
+ *                     agent was told to move on), recorded content-free.
+ * - `capture-error` — CAS staging failed; the write stayed on the deny-gate.
+ *                     Content-free (the staging error means secret
+ *                     classification may never have run).
+ * - `fail-closed`   — the approval state file was missing, so everything gated
+ *                     denied. A turn-level "the gate itself was broken" fact.
+ *
+ * An unknown kind string is preserved as-is: it is treated as non-pausing (an
+ * unknown deny must never manufacture an approval) but still attributes the
+ * blocked call to our own hook.
+ */
+export type DenialKind = "approval" | "secret" | "capture-error" | "fail-closed";
+
+/** The one kind that pauses the run for user approval. */
+export const APPROVAL_DENIAL_KIND: DenialKind = "approval";
+
 /**
  * One denial recorded by the preToolUse hook. `token` is the call's identity in
  * the same space as grantToken() (base64 of `toolName \n salientArg`), used to
  * correlate the denial back to the streamed tool call. `toolName` is carried raw
  * for human-readable debugging of the ledger file.
  *
+ * `kind` is the attribution taxonomy entry (see {@link DenialKind}). Optional
+ * for tolerance: an entry written without one (the pre-kind ledger format, or a
+ * hand-built test fixture) is an approval-kind denial — see
+ * {@link denialKindOf}.
+ *
  * `input` is the authoritative pre-execution tool arguments the hook captured
  * from the Cursor `tool_input` payload (decoded from the ledger's base64 form).
  * It is the cursor analog of the native harness reading the AI-message tool-call
@@ -446,15 +484,33 @@ const DENIAL_LEDGER_FILE = "denials.jsonl";
  * proposed change is in hand before the tool runs. The runner overlays it onto
  * the gated tool call so the approval card can show the proposed content/diff
  * before the user approves. Absent when the hook ran its grep fallback (the Node
- * binary was unavailable), in which case the gate degrades to stream-recovered
- * args exactly as before.
+ * binary was unavailable) — the gate then degrades to stream-recovered args —
+ * and ALWAYS absent for non-approval kinds (DD-26: only an approval-kind entry
+ * may carry proposed content).
  */
 export interface DeniedLedgerEntry {
   toolName: string;
   token: string;
+  kind?: string;
   input?: Record<string, unknown>;
 }
 
+/** The effective kind of a ledger entry (absent → approval, the pre-kind format). */
+export function denialKindOf(entry: DeniedLedgerEntry): string {
+  return entry.kind || APPROVAL_DENIAL_KIND;
+}
+
+/**
+ * The entries that pause the run for user approval — the ONLY kind
+ * reconcileDeniedToolCalls may turn into WAITING_APPROVAL gates and the only
+ * kind the first-denial stop may cancel the run for. Every other consumer
+ * (capture stamping, DD-28 provenance, foreign-hook attribution) wants the FULL
+ * ledger: all kinds mean "this action did not execute".
+ */
+export function approvalDenials(entries: readonly DeniedLedgerEntry[]): DeniedLedgerEntry[] {
+  return entries.filter((e) => denialKindOf(e) === APPROVAL_DENIAL_KIND);
+}
+
 /**
  * Absolute path of the per-turn denial ledger the hook appends to, inside the
  * session's runner-owned HITL directory (never the user's workspace).
@@ -540,11 +596,19 @@ export async function readDenialLedger(
     const trimmed = line.trim();
     if (!trimmed) continue;
     try {
-      const obj = JSON.parse(trimmed) as { toolName?: unknown; token?: unknown; input?: unknown };
+      const obj = JSON.parse(trimmed) as {
+        toolName?: unknown;
+        token?: unknown;
+        kind?: unknown;
+        input?: unknown;
+      };
       if (typeof obj.token === "string" && obj.token) {
         entries.push({
           toolName: typeof obj.toolName === "string" ? obj.toolName : "",
           token: obj.token,
+          // A garbled/missing kind degrades to undefined → approval (the
+          // pre-kind format); see denialKindOf.
+          kind: typeof obj.kind === "string" && obj.kind ? obj.kind : undefined,
           input: decodeLedgerInput(obj.input),
         });
       }

package/src/activities/execute-cursor/env-resolver.ts

@@ -23,9 +23,16 @@ export async function resolveExecutionEnv(
   client: StigmerClient,
   executionId: string,
 ): Promise<EnvResult> {
+  // A desktop runner exchanges its bootstrap credential for a token scoped to
+  // this execution's session, so cloud's decrypt gate binds the read (#156).
+  // No-op for cloud sandbox and OSS runners.
+  const scopedToken = await client.acquireScopedRunnerToken({
+    agentExecutionId: executionId,
+  });
+
   let execCtx;
   try {
-    execCtx = await client.getExecutionContextByExecutionId(executionId);
+    execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
   } catch (err) {
     const code = (err as { code?: number })?.code;
     // NOT_FOUND (5) is expected for executions without env vars

package/src/activities/execute-cursor/hook-script.ts

@@ -19,11 +19,24 @@
  *    by event — gated built-in tools (preToolUse) or MCP require-approval
  *    policies (beforeMCPExecution)
  * 4. On a deny, appends the call's identity token to the denial ledger
- *    (stigmer-denials.jsonl) so the runner can mark the gated tool call as
- *    WAITING_APPROVAL — the hook is the only place the deny decision is made,
- *    so its ledger is the authoritative record of what was gated this turn
+ *    (denials.jsonl) — EVERY deny path records, each tagged with a `kind`
+ *    (see below), so the ledger is the complete, authoritative record of what
+ *    this hook blocked this turn. The runner marks approval-kind denials as
+ *    WAITING_APPROVAL; the full ledger is its attribution set for
+ *    distinguishing our denials from a FOREIGN hook's (issue #205): a
+ *    hook-blocked tool with NO ledger entry of any kind was not blocked by us.
  * 5. Returns { "permission": "allow" } or { "permission": "deny" } on stdout
  *
+ * Denial kinds (the attribution taxonomy, mirrored in approval-state.ts):
+ *   - "approval"      — the normal gate: pauses the run for user approval.
+ *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
+ *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
+ *   - "fail-closed"   — approval state file missing, everything gated denies.
+ * Only approval-kind records carry the captured tool_input: a secret write's
+ * content must never be persisted (DD-26), a capture-error's content is
+ * UNCLASSIFIED (the staging error means secret classification may never have
+ * run), and fail-closed has no state to classify against.
+ *
  * Identity extraction runs on the SAME Node.js binary as the runner (its
  * absolute path — process.execPath — is baked into the script at generation
  * time), because the identity token must be byte-identical to the one the
@@ -436,9 +449,47 @@ ${categoryCaseArms}
   INPUT_B64=""
   CONTENT_TOKEN=""
 fi
+# The single identity a deny is recorded under: content-exact when the input
+# carried edit content, else coarse — the same PRIMARY-token choice the runner
+# grants on approval (approval-state.ts primaryToken).
+if [ -n "$CONTENT_TOKEN" ]; then
+  PRIMARY_TOKEN="$CONTENT_TOKEN"
+else
+  PRIMARY_TOKEN="$TOKEN"
+fi
+
+# Append a denial record to the ledger: $1 = identity token, $2 = kind (the
+# attribution taxonomy — see the module doc in hook-script.ts). EVERY deny arm
+# below records, so the ledger is the complete record of what THIS hook blocked
+# and the runner can tell its own denials from a foreign hook's (issue #205).
+# Best-effort: a ledger write failure must never abort the decision (the deny
+# still goes out on stdout). ONLY approval-kind records carry the captured
+# tool_input (DD-26: secret / unclassified content must never be persisted);
+# input is base64(JSON(tool_input)) — the authoritative pre-execution args the
+# runner overlays for the approval preview (empty on the grep fallback path).
+# Written with printf (a builtin, so no ARG_MAX limit) because the input can be
+# a large multi-MB file body. Defined BEFORE the first deny arm: bash resolves
+# function calls at execution time, and under 'set -euo pipefail' with our
+# failClosed hooks.json registration a call-before-define would abort with no
+# decision and block EVERY tool.
+record_denial() {
+  if [ "$2" = "approval" ]; then
+    printf '{"toolName":"%s","token":"%s","kind":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$2" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
+  else
+    printf '{"toolName":"%s","token":"%s","kind":"%s"}\\n' "$TOOL_NAME" "$1" "$2" >> "$LEDGER_FILE" 2>/dev/null || true
+  fi
+}
 
 # --- Failsafe: missing state file → deny (fail-closed) ---
+# Recorded as kind "fail-closed" so the runner attributes the blocked call to
+# its own (broken) gate instead of misdiagnosing a foreign hook. The ledger
+# path comes from the POINTER, not the state file, so it is recordable here.
 if [ ! -f "$STATE_FILE" ]; then
+  if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
+    record_denial "$MCP_TOKEN" "fail-closed"
+  else
+    record_denial "$PRIMARY_TOKEN" "fail-closed"
+  fi
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi
@@ -494,12 +545,18 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
     echo '{"permission":"allow"}'
     exit 0
   elif [ "$OBS_RESULT" = "secret" ]; then
+    # Kind "secret": attributable but deliberately non-pausing (the agent moves
+    # on) and content-free (DD-26 — the token is the only identity recorded).
+    record_denial "$PRIMARY_TOKEN" "secret"
     echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written or captured for review."}'
     exit 0
   else
     # Node unavailable or a staging error: fail closed. A gitignored write we
     # cannot stage cannot be captured for review, so keep gating it (today's
-    # behavior) rather than letting unreviewable bytes flow.
+    # behavior) rather than letting unreviewable bytes flow. Kind
+    # "capture-error" and content-free: the staging error means secret
+    # classification may never have run, so the content is UNCLASSIFIED.
+    record_denial "$PRIMARY_TOKEN" "capture-error"
     echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
     exit 0
   fi
@@ -511,17 +568,6 @@ if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   exit 0
 fi
 
-# Append a denial record to the ledger. Best-effort: a ledger write failure must
-# never abort the decision (the deny still goes out on stdout). toolName is raw
-# for human-readable debugging; token drives correlation in the runner; input is
-# base64(JSON(tool_input)) — the authoritative pre-execution args the runner
-# overlays for the approval preview (empty on the grep fallback path). Written
-# with printf (a builtin, so no ARG_MAX limit) because the input can be a large
-# multi-MB file body.
-record_denial() {
-  printf '{"toolName":"%s","token":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
-}
-
 # --- 2. MCP tools (beforeMCPExecution event) ---
 # preToolUse does NOT enforce gating for MCP calls — beforeMCPExecution does — so
 # MCP is gated here and ONLY here (never double-recorded). mcpToolPolicies holds
@@ -542,7 +588,7 @@ if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
       if [ -z "$MSG" ]; then
         MSG="Tool requires approval: $TOOL_NAME"
       fi
-      record_denial "$MCP_TOKEN"
+      record_denial "$MCP_TOKEN" "approval"
       echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"'"$MSG"'"}'
       exit 0
     fi
@@ -583,6 +629,9 @@ if [ -n "$CATEGORY" ]; then
   if [ "$CATEGORY" = "write" ] && [ -n "$SALIENT" ]; then
     SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo ok)
     if [ "$SECRET_RESULT" = "secret" ]; then
+      # Kind "secret": attributable but non-pausing and content-free (DD-26 —
+      # only the identity token is recorded, never the proposed content).
+      record_denial "$PRIMARY_TOKEN" "secret"
       echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written."}'
       exit 0
     fi
@@ -606,11 +655,7 @@ if [ -n "$CATEGORY" ]; then
   fi
   # Record the PRIMARY token (content-exact when available, else coarse) so the
   # runner's denial correlation keys on the SAME identity it grants on approval.
-  if [ -n "$CONTENT_TOKEN" ]; then
-    record_denial "$CONTENT_TOKEN"
-  else
-    record_denial "$TOKEN"
-  fi
+  record_denial "$PRIMARY_TOKEN" "approval"
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi

package/src/activities/execute-cursor/index.ts

@@ -125,6 +125,7 @@ export function createCursorActivities(config: Config) {
     endpoint: config.stigmerBackendEndpoint,
     token: config.stigmerToken,
     tokenRef: config.stigmerTokenRef,
+    runnerTokenRef: config.stigmerRunnerTokenRef,
   });
 
   return {
@@ -714,6 +715,19 @@ async function executeCursorInner(
       await removeHitlGate(hitlGate);
       await removeStigmerSymlink(primaryWorkspaceDir);
     };
+    // Issue #205 diagnosability: the merge preserved the user's own hooks on
+    // the gating events, and Cursor runs every configured hook — so any of
+    // these can deny this turn's tools without writing our denial ledger. Log
+    // the exposure up front; the turn boundary uses the same list to name the
+    // likely culprit if it detects an unattributed hook block.
+    if (hitlGate.foreignGatingHooks.length > 0) {
+      console.warn(
+        `ExecuteCursor: workspace hooks.json carries ${hitlGate.foreignGatingHooks.length} ` +
+        `foreign gating hook(s) [${hitlGate.foreignGatingHooks.join(", ")}] — a deny from ` +
+        `any of them blocks the runner's tools outside Stigmer's approval flow ` +
+        `(execution=${executionId})`,
+      );
+    }
     // Arm the denial watcher as soon as the gate exists. The per-turn ledger
     // reset may flip the flag once before the run starts; the loop's read then
     // sees an empty ledger and clears it — harmless by construction.
@@ -1198,6 +1212,7 @@ async function executeCursorInner(
         artifactStorage,
         mergedPolicies,
         denialCancelSettled: denialSettled,
+        foreignGatingHooks: hitlGate.foreignGatingHooks,
       });
     // Pauses for review exactly like the native harness: the boundary mutated
     // the transcript in place; we flip the phase, persist, and RETURN to the
@@ -1212,6 +1227,41 @@ async function executeCursorInner(
       return slimStatus(status);
     };
 
+    // Issue #205: a tool was blocked by a hook Stigmer does not own (the merge
+    // preserves the user's own gating hooks, and Cursor runs every one), so no
+    // approval can unblock it — an approval grants a token only OUR hook reads,
+    // and the foreign hook would deny the re-attempt forever. Completing would
+    // be the silent-failure shape the issue describes; instead fail with a
+    // diagnosable reason naming the blocked tools and the likely culprit.
+    // Shared by the primary turn and both recovery retries.
+    const enterUnattributedHookBlockFailure = async (boundary: TurnBoundaryResult) => {
+      const blockedTools = [...new Set(boundary.unattributedHookBlocks.map((b) => b.toolName))]
+        .join(", ");
+      const culprit = hitlGate.foreignGatingHooks.length > 0
+        ? ` The workspace's .cursor/hooks.json registers hook(s) outside Stigmer's control ` +
+          `[${hitlGate.foreignGatingHooks.join(", ")}], which most likely denied it.`
+        : "";
+      status.phase = ExecutionPhase.EXECUTION_FAILED;
+      status.error =
+        `A Cursor hook outside Stigmer's approval gate blocked tool(s): ${blockedTools}.` +
+        culprit +
+        ` Stigmer cannot request approval on a foreign hook's behalf — remove or adjust ` +
+        `the hook in .cursor/hooks.json and retry.`;
+      status.completedAt = utcTimestamp();
+      status.messages.push(create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content: `Execution failed: ${status.error}`,
+        timestamp: utcTimestamp(),
+      }));
+      await persist(status);
+      try { resolution.agent.close(); } catch { /* best effort */ }
+      console.error(
+        `ExecuteCursor failed (unattributed hook block): execution=${executionId}, ` +
+        `tools=[${blockedTools}], foreignHooks=[${hitlGate.foreignGatingHooks.join(", ")}]`,
+      );
+      return slimStatus(status);
+    };
+
     // Re-enter the turn boundary for a recovery retry: author the retry's net
     // change set to the file_review ledger and overlay any denials as gates —
     // without this a retry's file edits silently escape review (production case
@@ -1285,8 +1335,13 @@ async function executeCursorInner(
       turnState.firstDenialDetected ? turnState.denialCancelSettled : undefined,
     );
     if (boundary.waiting) {
+      // A pausing turn is never silent, so an unattributed block alongside our
+      // own gate only warns (logged by the boundary) — the pause wins.
       return enterApprovalPause(boundary);
     }
+    if (boundary.unattributedHookBlocks.length > 0) {
+      return enterUnattributedHookBlockFailure(boundary);
+    }
 
     // Phase 13: Map final result
     const result = await run.wait();
@@ -1407,6 +1462,9 @@ async function executeCursorInner(
             );
             return enterApprovalPause(retryBoundary);
           }
+          if (retryBoundary && retryBoundary.unattributedHookBlocks.length > 0) {
+            return enterUnattributedHookBlockFailure(retryBoundary);
+          }
 
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;
@@ -1488,6 +1546,9 @@ async function executeCursorInner(
             );
             return enterApprovalPause(retryBoundary);
           }
+          if (retryBoundary && retryBoundary.unattributedHookBlocks.length > 0) {
+            return enterUnattributedHookBlockFailure(retryBoundary);
+          }
 
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;