@stigmer/runner 3.1.7 → 3.1.8

package/dist/shared/workspace/platform-dir.js

@@ -66,6 +66,29 @@ export async function ensureHitlGateDir(workspaceRoot) {
 export function getPlatformDir(sessionId) {
     return join(getSessionDir(sessionId), "platform");
 }
+/**
+ * Compute the durable-checkpoint database path for a session — the SQLite file
+ * backing the local LangGraph checkpointer (see shared/checkpointer/sqlite-saver.ts).
+ *
+ * Session-scoped by design: a session has exactly one LangGraph thread
+ * (`thread-{sessionId}`), so one DB per session keeps checkpoint lifetime bound
+ * to session lifetime (retention becomes "remove the session dir") and mirrors
+ * the sibling `platform/` and `hitl/` trees. Pure function — performs no I/O.
+ */
+export function getCheckpointDbPath(sessionId) {
+    return join(getSessionDir(sessionId), "checkpoints.db");
+}
+/**
+ * Ensure the session directory exists and return the checkpoint DB path.
+ *
+ * Creates the session directory tree if needed (the SQLite driver requires the
+ * parent directory to exist before opening the file). Idempotent — safe across
+ * executions, HITL reinvocations, and activity retries.
+ */
+export async function ensureCheckpointDbPath(sessionId) {
+    await mkdir(getSessionDir(sessionId), { recursive: true });
+    return getCheckpointDbPath(sessionId);
+}
 /**
  * Ensure the platform directory exists and return its path.
  *

package/dist/shared/workspace/platform-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-dir.js","sourceRoot":"","sources":["../../../src/shared/workspace/platform-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,qFAAqF;AACrF,SAAS,cAAc;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"platform-dir.js","sourceRoot":"","sources":["../../../src/shared/workspace/platform-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,qFAAqF;AACrF,SAAS,cAAc;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.1.7",
+  "version": "3.1.8",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": ">=22.13"
   },
   "bin": {
     "stigmer-runner": "./dist/main.js"
@@ -85,7 +85,7 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/protos": "3.1.7",
+    "@stigmer/protos": "3.1.8",
     "@temporalio/activity": "^1.11.0",
     "@temporalio/client": "^1.11.0",
     "@temporalio/common": "^1.11.0",

package/src/__test-utils__/mock-client.ts

@@ -21,6 +21,9 @@ export function mockStigmerClient(overrides: MockMethods = {}): StigmerClient {
     }),
     getExecution: vi.fn().mockResolvedValue({}),
     getExecutionContextByExecutionId: vi.fn().mockResolvedValue({}),
+    // No scoped token by default — the OSS/local shape (no runner credential).
+    acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
+    getRunnerScopedToken: vi.fn().mockResolvedValue(undefined),
     getSession: vi.fn().mockResolvedValue({}),
     updateSession: vi.fn().mockResolvedValue({}),
     getAgent: vi.fn().mockResolvedValue({}),

package/src/activities/__tests__/hydrate-workflow-execution.test.ts

@@ -57,6 +57,8 @@ function makeMockClient(opts: {
       : vi.fn().mockResolvedValue(opts.workflowInstance ?? {
           spec: { workflowId: "wfl_resolved-from-instance" },
         }),
+    // No scoped token — the OSS/local shape (no runner credential to exchange).
+    acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
     getExecutionContextByExecutionId: opts.executionContextError
       ? vi.fn().mockRejectedValue(opts.executionContextError)
       : vi.fn().mockResolvedValue(opts.executionContext ?? {

package/src/activities/discover-mcp-server.ts

@@ -447,6 +447,7 @@ export function createDiscoverMcpServerActivities(config: Config) {
     endpoint: config.stigmerBackendEndpoint,
     token: config.stigmerToken,
     tokenRef: config.stigmerTokenRef,
+    runnerTokenRef: config.stigmerRunnerTokenRef,
   });
 
   return {

package/src/activities/execute-cursor/__test-utils__/cursor-hook-harness.ts

@@ -45,10 +45,12 @@ export interface CursorHookHarness {
   /** Run the hook against a single hook-input payload and report its decision. */
   decide(input: object): { permission: string; raw: string };
   /**
-   * The denial ledger entries the hook has appended this turn. `input` is the
-   * base64(JSON(tool_input)) the hook captures (decode + JSON.parse to inspect).
+   * The denial ledger entries the hook has appended this turn. `kind` is the
+   * attribution taxonomy (approval/secret/capture-error/fail-closed); `input`
+   * is the base64(JSON(tool_input)) the hook captures on APPROVAL-kind entries
+   * only (decode + JSON.parse to inspect).
    */
-  ledger(): Array<{ toolName: string; token: string; input?: string }>;
+  ledger(): Array<{ toolName: string; token: string; kind?: string; input?: string }>;
   /** Truncate the denial ledger (a fresh turn). */
   resetLedger(): void;
   /**

package/src/activities/execute-cursor/__tests__/hitl-ledger.test.ts

@@ -52,8 +52,17 @@ import {
   buildApprovalGrants,
   grantToken,
   watchDenialLedger,
+  approvalDenials,
+  denialKindOf,
 } from "../approval-state.js";
-import { reconcileDeniedToolCalls, clearProvisionalPostDenialNarration, collapseRedundantToolCallTwins, toolCallIdentityToken } from "../message-translator.js";
+import {
+  reconcileDeniedToolCalls,
+  clearProvisionalPostDenialNarration,
+  collapseRedundantToolCallTwins,
+  toolCallIdentityToken,
+  detectUnattributedHookBlocks,
+  HOOK_BLOCK_ERROR_MARKERS,
+} from "../message-translator.js";
 import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
 import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
 import { generateHookScript } from "../hook-script.js";
@@ -162,6 +171,54 @@ describe("denial ledger reset/read", () => {
     expect(entries[1].input).toBeUndefined();
     expect(entries[2].input).toBeUndefined();
   });
+
+  it("parses the kind tag, defaulting an absent/garbled kind to approval", async () => {
+    const ws = makeWorkspace();
+    await resetDenialLedger(ws);
+    await writeFile(
+      denialLedgerPath(ws),
+      // 1) pre-kind format (no kind field), 2) explicit approval, 3) secret,
+      // 4) garbled kind (non-string), 5) unknown future kind.
+      `{"toolName":"Write","token":"${grantToken("write", "a.txt")}"}\n` +
+        `{"toolName":"Shell","token":"${grantToken("shell", "rm x")}","kind":"approval"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", ".env")}","kind":"secret"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", "b.txt")}","kind":42}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", "c.txt")}","kind":"quarantine"}\n`,
+      "utf-8",
+    );
+
+    const entries = await readDenialLedger(ws);
+    expect(entries.map((e) => denialKindOf(e))).toEqual([
+      "approval", // absent → the pre-kind format
+      "approval",
+      "secret",
+      "approval", // garbled (non-string) degrades to approval
+      "quarantine", // an unknown kind is preserved, not coerced
+    ]);
+  });
+
+  it("approvalDenials selects only the entries allowed to pause the run", async () => {
+    const ws = makeWorkspace();
+    await resetDenialLedger(ws);
+    await writeFile(
+      denialLedgerPath(ws),
+      `{"toolName":"Write","token":"${grantToken("write", "a.txt")}","kind":"approval"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", ".env")}","kind":"secret"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", "app.log")}","kind":"capture-error"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", "b.txt")}","kind":"fail-closed"}\n` +
+        // Pre-kind format counts as approval; an unknown kind must NOT pause.
+        `{"toolName":"Shell","token":"${grantToken("shell", "rm x")}"}\n` +
+        `{"toolName":"Write","token":"${grantToken("write", "c.txt")}","kind":"quarantine"}\n`,
+      "utf-8",
+    );
+
+    const entries = await readDenialLedger(ws);
+    expect(entries).toHaveLength(6);
+    expect(approvalDenials(entries).map((e) => e.token)).toEqual([
+      grantToken("write", "a.txt"),
+      grantToken("shell", "rm x"),
+    ]);
+  });
 });
 
 describe("reconcileDeniedToolCalls", () => {
@@ -1415,7 +1472,7 @@ describe("first-denial stop contract", () => {
     | {
         kind: "tool";
         tool: ToolCall;
-        denyToken?: { name: string; token: string };
+        denyToken?: { name: string; token: string; kind?: string };
         // When the hook's ledger append lands relative to the loop's read for
         // THIS event. "before-read" is the common case (the hook adjudicates as
         // the tool_call event surfaces); "after-read" reproduces the production
@@ -1426,9 +1483,11 @@ describe("first-denial stop contract", () => {
 
   // Faithfully mirrors the index.ts loop rule: process each event, then read
   // the denial ledger when the fs watcher flagged it dirty OR the event is a
-  // tool_call (the backstop) — the instant the ledger is non-empty, cancel the
-  // run and stop consuming the stream. The watcher is simulated by flipping the
-  // dirty flag as the append happens (the real fs.watch notification).
+  // tool_call (the backstop) — the instant an APPROVAL-kind denial appears,
+  // cancel the run and stop consuming the stream (non-approval kinds — a secret
+  // hard-block, a capture error — are attributable but never pause). The
+  // watcher is simulated by flipping the dirty flag as the append happens (the
+  // real fs.watch notification).
   async function runTurnWithFirstDenialStop(
     hitlDir: string,
     events: SimEvent[],
@@ -1438,12 +1497,13 @@ describe("first-denial stop contract", () => {
     let cancelled = false;
     let consumed = 0;
     let ledgerDirty = false;
-    let pendingAppend: { name: string; token: string } | undefined;
+    let pendingAppend: { name: string; token: string; kind?: string } | undefined;
 
-    const appendDenial = async (deny: { name: string; token: string }) => {
+    const appendDenial = async (deny: { name: string; token: string; kind?: string }) => {
+      const kindField = deny.kind ? `,"kind":"${deny.kind}"` : "";
       await writeFile(
         denialLedgerPath(hitlDir),
-        `{"toolName":"${deny.name}","token":"${deny.token}"}\n`,
+        `{"toolName":"${deny.name}","token":"${deny.token}"${kindField}}\n`,
         { flag: "a" },
       );
       ledgerDirty = true;
@@ -1470,7 +1530,7 @@ describe("first-denial stop contract", () => {
       }
       if (ledgerDirty || ev.kind === "tool") {
         ledgerDirty = false;
-        const denials = await readDenialLedger(hitlDir);
+        const denials = approvalDenials(await readDenialLedger(hitlDir));
         if (denials.length > 0) {
           cancelled = true;
           break;
@@ -1527,6 +1587,30 @@ describe("first-denial stop contract", () => {
     expect(consumed).toBe(3); // the whole turn is consumed
   });
 
+  it("does NOT stop on a non-approval denial (secret hard-block: the agent continues)", async () => {
+    // The kinded ledger now records a secret hard-block for attribution (issue
+    // #205), and the append fires the fs watcher — but the model was told to
+    // move on, so the run must NOT be cancelled and no approval may surface.
+    const ws = makeWorkspace();
+    const secretWrite = toolCall({
+      id: "c1", name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { path: ".env" },
+    });
+    const read = toolCall({ id: "c2", name: "read", status: ToolCallStatus.TOOL_CALL_COMPLETED, args: { path: "a.txt" } });
+
+    const { cancelled, consumed } = await runTurnWithFirstDenialStop(ws, [
+      { kind: "tool", tool: secretWrite, denyToken: { name: "Write", token: grantToken("write", ".env"), kind: "secret" } },
+      { kind: "text", content: "That file is protected — moving on." },
+      { kind: "tool", tool: read },
+    ]);
+
+    expect(cancelled).toBe(false);
+    expect(consumed).toBe(3); // the whole turn is consumed
+    // And the boundary reconcile manufactures no gate from it either.
+    const denied = await reconcileDeniedToolCalls([], await readDenialLedger(ws));
+    expect(denied).toEqual([]);
+  });
+
   it("stops on the NEXT event of any type when the denial lands after the tool_call read (the watcher rule)", async () => {
     // The production race (aex_01kwj07f7g23c3wp9sn8496z5g): the hook's ledger
     // append landed just after the gated tool's own tool_call-event read, so the
@@ -1594,8 +1678,173 @@ describe("watchDenialLedger", () => {
   });
 });
 
+// Issue #205: a FOREIGN `.cursor/hooks.json` hook (preserved by the merge) can
+// deny the runner's tools without writing our denial ledger; the SDK has no
+// structured "denied by hook" signal, so the only stream trace is Cursor's
+// generic hook-block error text on the FAILED call. The detector matches this
+// turn's hook-blocked FAILED rows against the FULL ledger (all kinds) and
+// reports the leftovers — which the activity surfaces as EXECUTION_FAILED
+// instead of the silent completion the issue describes. These pin the whole
+// attribution matrix.
+describe("detectUnattributedHookBlocks (issue #205)", () => {
+  // Cursor's generic replacement text for a hook deny (Phase 0 ground truth).
+  const HOOK_BLOCK = "Command blocked by a hook. Check the hooks configuration.";
+
+  const failedShell = (id: string, command: string, error: string = HOOK_BLOCK) =>
+    toolCall({ id, name: "shell", status: ToolCallStatus.TOOL_CALL_FAILED, error, args: { command } });
+  const failedEdit = (id: string, path: string, error: string = HOOK_BLOCK) =>
+    toolCall({ id, name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED, error, args: { path } });
+
+  it("detects a hook-blocked call when the ledger is EMPTY (the reproduce-first #205 shape)", () => {
+    const edit = failedEdit("f1", "notes.md");
+    const blocks = detectUnattributedHookBlocks([aiMessageWith([edit])], 0, []);
+    expect(blocks).toEqual([{ toolCallId: "f1", toolName: "edit", error: HOOK_BLOCK }]);
+  });
+
+  it("matches the marker case-insensitively (single-sourced marker family)", () => {
+    expect(HOOK_BLOCK_ERROR_MARKERS).toContain("blocked by a hook");
+    const edit = failedEdit("f1", "notes.md", "Tool was Blocked By A Hook.");
+    expect(detectUnattributedHookBlocks([aiMessageWith([edit])], 0, [])).toHaveLength(1);
+  });
+
+  it("attributes our own denial by exact token — not reported", () => {
+    const shell = failedShell("s1", "rm -rf build");
+    const ledger = [{ toolName: "Shell", token: toolCallIdentityToken(shell), kind: "approval" }];
+    expect(detectUnattributedHookBlocks([aiMessageWith([shell])], 0, ledger)).toEqual([]);
+  });
+
+  it("attributes a secret hard-block via its kind:'secret' entry — not reported", () => {
+    // The agent continues past a secret block; its FAILED row must never be
+    // misdiagnosed as a foreign hook (the false positive the kinded ledger
+    // exists to prevent).
+    const secretWrite = failedEdit("e1", ".env");
+    const ledger = [{ toolName: "Write", token: toolCallIdentityToken(secretWrite), kind: "secret" }];
+    expect(detectUnattributedHookBlocks([aiMessageWith([secretWrite])], 0, ledger)).toEqual([]);
+  });
+
+  it("attributes a capture-error deny via its kind:'capture-error' entry — not reported", () => {
+    const write = failedEdit("e1", "app.log");
+    const ledger = [{ toolName: "Write", token: toolCallIdentityToken(write), kind: "capture-error" }];
+    expect(detectUnattributedHookBlocks([aiMessageWith([write])], 0, ledger)).toEqual([]);
+  });
+
+  it("attributes across abs-vs-rel path drift via the workspace-normalized salient", () => {
+    // The hook records the RAW absolute path Cursor handed it; the stream row
+    // carries the relative one. Exact tokens differ; the normalized (category,
+    // path) must still attribute — the same drift reconcile's second pass heals.
+    const edit = failedEdit("e1", "notes.md");
+    const ledger = [{ toolName: "Write", token: grantToken("write", `${ROOT}/notes.md`), kind: "secret" }];
+    // Without a workspace root the raw tokens cannot be reconciled…
+    expect(detectUnattributedHookBlocks([aiMessageWith([edit])], 0, ledger)).toHaveLength(1);
+    // …with it, the normalized pass attributes the block to our own entry.
+    expect(detectUnattributedHookBlocks([aiMessageWith([edit])], 0, ledger, ROOT)).toEqual([]);
+  });
+
+  it("treats a fail-closed turn as attributed — the broken gate denied everything it saw", () => {
+    // With the state file missing, EVERY gated tool was denied by OUR OWN
+    // (broken) hook; per-call correlation is meaningless and none of it is a
+    // foreign hook. The boundary logs the broken-gate condition separately.
+    const shell = failedShell("s1", "make build");
+    const edit = failedEdit("e1", "other.txt");
+    const ledger = [{ toolName: "Shell", token: grantToken("shell", "make build"), kind: "fail-closed" }];
+    expect(
+      detectUnattributedHookBlocks([aiMessageWith([shell, edit])], 0, ledger),
+    ).toEqual([]);
+  });
+
+  it("scopes to THIS turn only — seeded prior-turn rows never re-trigger", () => {
+    const priorTurnRow = failedShell("old-1", "yarn deploy");
+    const thisTurnRow = failedShell("new-1", "yarn build");
+    const messages = [aiMessageWith([priorTurnRow]), aiMessageWith([thisTurnRow])];
+    const blocks = detectUnattributedHookBlocks(messages, 1, []);
+    expect(blocks.map((b) => b.toolCallId)).toEqual(["new-1"]);
+  });
+
+  it("mixed turn: reports the foreign block even when our own anchor denial is present", () => {
+    // The caller pauses on the anchor (a pausing turn is never silent) and only
+    // logs this — but the detector itself must still see the foreign block.
+    const ourEdit = failedEdit("ours", "gated.txt");
+    const foreignShell = failedShell("theirs", "terraform apply");
+    const ledger = [{ toolName: "Write", token: toolCallIdentityToken(ourEdit), kind: "approval" }];
+    const blocks = detectUnattributedHookBlocks(
+      [aiMessageWith([ourEdit, foreignShell])], 0, ledger,
+    );
+    expect(blocks.map((b) => b.toolCallId)).toEqual(["theirs"]);
+  });
+
+  it("ignores ordinary tool failures without hook-block text", () => {
+    const failed = failedShell("s1", "make test", "exit code 2: tests failed");
+    const noError = toolCall({ id: "s2", name: "shell", status: ToolCallStatus.TOOL_CALL_FAILED, error: "", args: { command: "ls" } });
+    expect(detectUnattributedHookBlocks([aiMessageWith([failed, noError])], 0, [])).toEqual([]);
+  });
+
+  it("ignores non-FAILED rows even when their output mentions the marker", () => {
+    // Adversarial: the marker appearing in a tool's legitimate RESULT (e.g. the
+    // agent grepped these very words) must never trigger — only a FAILED row's
+    // error text reads as a hook block.
+    const completed = toolCall({
+      id: "c1", name: "shell", status: ToolCallStatus.TOOL_CALL_COMPLETED,
+      result: 'found "blocked by a hook" in docs/hitl.md', args: { command: "grep -r hook docs" },
+    });
+    const waiting = toolCall({
+      id: "w1", name: "edit", status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL, args: { path: "gated.txt" },
+    });
+    expect(detectUnattributedHookBlocks([aiMessageWith([completed, waiting])], 0, [])).toEqual([]);
+  });
+
+  it("reports every distinct foreign block in the turn", () => {
+    const one = failedEdit("f1", "a.txt");
+    const two = failedShell("f2", "rm -rf build");
+    const blocks = detectUnattributedHookBlocks([aiMessageWith([one]), aiMessageWith([two])], 0, []);
+    expect(blocks.map((b) => b.toolCallId)).toEqual(["f1", "f2"]);
+  });
+});
+
+// The reconcile itself must never manufacture a pause from a non-approval
+// denial, regardless of caller discipline (defense-in-depth for the kind split).
+describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
+  it("returns no gates and leaves the transcript untouched for secret/capture-error/fail-closed entries", async () => {
+    const secretRow = toolCall({
+      id: "e1", name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { path: ".env" },
+    });
+    const messages = [aiMessageWith([secretRow])];
+    const denied = await reconcileDeniedToolCalls(messages, [
+      { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },
+      { toolName: "Write", token: grantToken("write", "app.log"), kind: "capture-error" },
+      { toolName: "Shell", token: grantToken("shell", "make"), kind: "fail-closed" },
+    ]);
+    expect(denied).toEqual([]);
+    // No overlay, no collapse, no synthesized placeholder appended.
+    expect(secretRow.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+    expect(messages).toHaveLength(1);
+    expect(messages[0].toolCalls).toHaveLength(1);
+  });
+
+  it("gates the approval entry while ignoring a non-approval sibling in the same ledger", async () => {
+    const gated = toolCall({
+      id: "g1", name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { path: "gated.txt" },
+    });
+    const secretRow = toolCall({
+      id: "e1", name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { path: ".env" },
+    });
+    const messages = [aiMessageWith([gated, secretRow])];
+    const denied = await reconcileDeniedToolCalls(messages, [
+      // Ledger order puts the secret FIRST: the anchor must still be the first
+      // APPROVAL entry, never a non-approval kind.
+      { toolName: "Write", token: toolCallIdentityToken(secretRow), kind: "secret" },
+      { toolName: "Write", token: toolCallIdentityToken(gated), kind: "approval" },
+    ]);
+    expect(denied).toHaveLength(1);
+    expect(gated.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(secretRow.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+  });
+});
+
 describe("generateHookScript ledger wiring", () => {
-  it("bakes the active-turn pointer, derives the ledger from it, and records denials in both deny branches", () => {
+  it("bakes the active-turn pointer, derives the ledger from it, and records on EVERY deny arm", () => {
     const script = generateHookScript("/gate/active.json");
 
     // Stable script: it bakes the pointer path (not per-turn state/ledger), and
@@ -1604,9 +1853,18 @@ describe("generateHookScript ledger wiring", () => {
     expect(script).not.toContain('LEDGER_FILE="/');
     expect(script).toContain('>> "$LEDGER_FILE"');
     expect(script).toContain("record_denial()");
-    // One definition + a call in the gated-built-in branch + a call in the MCP
-    // branch = 3 occurrences.
-    const occurrences = script.split("record_denial").length - 1;
-    expect(occurrences).toBeGreaterThanOrEqual(3);
+    // Every deny arm records a kind-tagged entry (issue #205 attribution):
+    // the approval gates (built-in + MCP), both secret hard-block arms, the
+    // CAS staging-error fail-closed deny, and the missing-state-file failsafe.
+    expect(script).toContain('record_denial "$PRIMARY_TOKEN" "approval"');
+    expect(script).toContain('record_denial "$MCP_TOKEN" "approval"');
+    expect(script.split('"secret"').length - 1).toBeGreaterThanOrEqual(2);
+    expect(script).toContain('record_denial "$PRIMARY_TOKEN" "capture-error"');
+    expect(script).toContain('record_denial "$PRIMARY_TOKEN" "fail-closed"');
+    expect(script).toContain('record_denial "$MCP_TOKEN" "fail-closed"');
+    // The hoisting guard: under `set -euo pipefail` with our failClosed
+    // hooks.json registration, a call-before-define would emit no decision and
+    // block EVERY tool — so the definition must precede the first call.
+    expect(script.indexOf("record_denial()")).toBeLessThan(script.indexOf('record_denial "'));
   });
 });