@stigmer/runner 3.1.7 → 3.1.8

package/src/activities/execute-cursor/env-resolver.ts

@@ -23,9 +23,16 @@ export async function resolveExecutionEnv(
   client: StigmerClient,
   executionId: string,
 ): Promise<EnvResult> {
+  // A desktop runner exchanges its bootstrap credential for a token scoped to
+  // this execution's session, so cloud's decrypt gate binds the read (#156).
+  // No-op for cloud sandbox and OSS runners.
+  const scopedToken = await client.acquireScopedRunnerToken({
+    agentExecutionId: executionId,
+  });
+
   let execCtx;
   try {
-    execCtx = await client.getExecutionContextByExecutionId(executionId);
+    execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
   } catch (err) {
     const code = (err as { code?: number })?.code;
     // NOT_FOUND (5) is expected for executions without env vars

package/src/activities/execute-cursor/hook-script.ts

@@ -19,11 +19,24 @@
  *    by event — gated built-in tools (preToolUse) or MCP require-approval
  *    policies (beforeMCPExecution)
  * 4. On a deny, appends the call's identity token to the denial ledger
- *    (stigmer-denials.jsonl) so the runner can mark the gated tool call as
- *    WAITING_APPROVAL — the hook is the only place the deny decision is made,
- *    so its ledger is the authoritative record of what was gated this turn
+ *    (denials.jsonl) — EVERY deny path records, each tagged with a `kind`
+ *    (see below), so the ledger is the complete, authoritative record of what
+ *    this hook blocked this turn. The runner marks approval-kind denials as
+ *    WAITING_APPROVAL; the full ledger is its attribution set for
+ *    distinguishing our denials from a FOREIGN hook's (issue #205): a
+ *    hook-blocked tool with NO ledger entry of any kind was not blocked by us.
  * 5. Returns { "permission": "allow" } or { "permission": "deny" } on stdout
  *
+ * Denial kinds (the attribution taxonomy, mirrored in approval-state.ts):
+ *   - "approval"      — the normal gate: pauses the run for user approval.
+ *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
+ *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
+ *   - "fail-closed"   — approval state file missing, everything gated denies.
+ * Only approval-kind records carry the captured tool_input: a secret write's
+ * content must never be persisted (DD-26), a capture-error's content is
+ * UNCLASSIFIED (the staging error means secret classification may never have
+ * run), and fail-closed has no state to classify against.
+ *
  * Identity extraction runs on the SAME Node.js binary as the runner (its
  * absolute path — process.execPath — is baked into the script at generation
  * time), because the identity token must be byte-identical to the one the
@@ -436,9 +449,47 @@ ${categoryCaseArms}
   INPUT_B64=""
   CONTENT_TOKEN=""
 fi
+# The single identity a deny is recorded under: content-exact when the input
+# carried edit content, else coarse — the same PRIMARY-token choice the runner
+# grants on approval (approval-state.ts primaryToken).
+if [ -n "$CONTENT_TOKEN" ]; then
+  PRIMARY_TOKEN="$CONTENT_TOKEN"
+else
+  PRIMARY_TOKEN="$TOKEN"
+fi
+
+# Append a denial record to the ledger: $1 = identity token, $2 = kind (the
+# attribution taxonomy — see the module doc in hook-script.ts). EVERY deny arm
+# below records, so the ledger is the complete record of what THIS hook blocked
+# and the runner can tell its own denials from a foreign hook's (issue #205).
+# Best-effort: a ledger write failure must never abort the decision (the deny
+# still goes out on stdout). ONLY approval-kind records carry the captured
+# tool_input (DD-26: secret / unclassified content must never be persisted);
+# input is base64(JSON(tool_input)) — the authoritative pre-execution args the
+# runner overlays for the approval preview (empty on the grep fallback path).
+# Written with printf (a builtin, so no ARG_MAX limit) because the input can be
+# a large multi-MB file body. Defined BEFORE the first deny arm: bash resolves
+# function calls at execution time, and under 'set -euo pipefail' with our
+# failClosed hooks.json registration a call-before-define would abort with no
+# decision and block EVERY tool.
+record_denial() {
+  if [ "$2" = "approval" ]; then
+    printf '{"toolName":"%s","token":"%s","kind":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$2" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
+  else
+    printf '{"toolName":"%s","token":"%s","kind":"%s"}\\n' "$TOOL_NAME" "$1" "$2" >> "$LEDGER_FILE" 2>/dev/null || true
+  fi
+}
 
 # --- Failsafe: missing state file → deny (fail-closed) ---
+# Recorded as kind "fail-closed" so the runner attributes the blocked call to
+# its own (broken) gate instead of misdiagnosing a foreign hook. The ledger
+# path comes from the POINTER, not the state file, so it is recordable here.
 if [ ! -f "$STATE_FILE" ]; then
+  if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
+    record_denial "$MCP_TOKEN" "fail-closed"
+  else
+    record_denial "$PRIMARY_TOKEN" "fail-closed"
+  fi
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi
@@ -494,12 +545,18 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
     echo '{"permission":"allow"}'
     exit 0
   elif [ "$OBS_RESULT" = "secret" ]; then
+    # Kind "secret": attributable but deliberately non-pausing (the agent moves
+    # on) and content-free (DD-26 — the token is the only identity recorded).
+    record_denial "$PRIMARY_TOKEN" "secret"
     echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written or captured for review."}'
     exit 0
   else
     # Node unavailable or a staging error: fail closed. A gitignored write we
     # cannot stage cannot be captured for review, so keep gating it (today's
-    # behavior) rather than letting unreviewable bytes flow.
+    # behavior) rather than letting unreviewable bytes flow. Kind
+    # "capture-error" and content-free: the staging error means secret
+    # classification may never have run, so the content is UNCLASSIFIED.
+    record_denial "$PRIMARY_TOKEN" "capture-error"
     echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
     exit 0
   fi
@@ -511,17 +568,6 @@ if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   exit 0
 fi
 
-# Append a denial record to the ledger. Best-effort: a ledger write failure must
-# never abort the decision (the deny still goes out on stdout). toolName is raw
-# for human-readable debugging; token drives correlation in the runner; input is
-# base64(JSON(tool_input)) — the authoritative pre-execution args the runner
-# overlays for the approval preview (empty on the grep fallback path). Written
-# with printf (a builtin, so no ARG_MAX limit) because the input can be a large
-# multi-MB file body.
-record_denial() {
-  printf '{"toolName":"%s","token":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
-}
-
 # --- 2. MCP tools (beforeMCPExecution event) ---
 # preToolUse does NOT enforce gating for MCP calls — beforeMCPExecution does — so
 # MCP is gated here and ONLY here (never double-recorded). mcpToolPolicies holds
@@ -542,7 +588,7 @@ if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
       if [ -z "$MSG" ]; then
         MSG="Tool requires approval: $TOOL_NAME"
       fi
-      record_denial "$MCP_TOKEN"
+      record_denial "$MCP_TOKEN" "approval"
       echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"'"$MSG"'"}'
       exit 0
     fi
@@ -583,6 +629,9 @@ if [ -n "$CATEGORY" ]; then
   if [ "$CATEGORY" = "write" ] && [ -n "$SALIENT" ]; then
     SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo ok)
     if [ "$SECRET_RESULT" = "secret" ]; then
+      # Kind "secret": attributable but non-pausing and content-free (DD-26 —
+      # only the identity token is recorded, never the proposed content).
+      record_denial "$PRIMARY_TOKEN" "secret"
       echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written."}'
       exit 0
     fi
@@ -606,11 +655,7 @@ if [ -n "$CATEGORY" ]; then
   fi
   # Record the PRIMARY token (content-exact when available, else coarse) so the
   # runner's denial correlation keys on the SAME identity it grants on approval.
-  if [ -n "$CONTENT_TOKEN" ]; then
-    record_denial "$CONTENT_TOKEN"
-  else
-    record_denial "$TOKEN"
-  fi
+  record_denial "$PRIMARY_TOKEN" "approval"
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi

package/src/activities/execute-cursor/index.ts

@@ -125,6 +125,7 @@ export function createCursorActivities(config: Config) {
     endpoint: config.stigmerBackendEndpoint,
     token: config.stigmerToken,
     tokenRef: config.stigmerTokenRef,
+    runnerTokenRef: config.stigmerRunnerTokenRef,
   });
 
   return {
@@ -714,6 +715,19 @@ async function executeCursorInner(
       await removeHitlGate(hitlGate);
       await removeStigmerSymlink(primaryWorkspaceDir);
     };
+    // Issue #205 diagnosability: the merge preserved the user's own hooks on
+    // the gating events, and Cursor runs every configured hook — so any of
+    // these can deny this turn's tools without writing our denial ledger. Log
+    // the exposure up front; the turn boundary uses the same list to name the
+    // likely culprit if it detects an unattributed hook block.
+    if (hitlGate.foreignGatingHooks.length > 0) {
+      console.warn(
+        `ExecuteCursor: workspace hooks.json carries ${hitlGate.foreignGatingHooks.length} ` +
+        `foreign gating hook(s) [${hitlGate.foreignGatingHooks.join(", ")}] — a deny from ` +
+        `any of them blocks the runner's tools outside Stigmer's approval flow ` +
+        `(execution=${executionId})`,
+      );
+    }
     // Arm the denial watcher as soon as the gate exists. The per-turn ledger
     // reset may flip the flag once before the run starts; the loop's read then
     // sees an empty ledger and clears it — harmless by construction.
@@ -1198,6 +1212,7 @@ async function executeCursorInner(
         artifactStorage,
         mergedPolicies,
         denialCancelSettled: denialSettled,
+        foreignGatingHooks: hitlGate.foreignGatingHooks,
       });
     // Pauses for review exactly like the native harness: the boundary mutated
     // the transcript in place; we flip the phase, persist, and RETURN to the
@@ -1212,6 +1227,41 @@ async function executeCursorInner(
       return slimStatus(status);
     };
 
+    // Issue #205: a tool was blocked by a hook Stigmer does not own (the merge
+    // preserves the user's own gating hooks, and Cursor runs every one), so no
+    // approval can unblock it — an approval grants a token only OUR hook reads,
+    // and the foreign hook would deny the re-attempt forever. Completing would
+    // be the silent-failure shape the issue describes; instead fail with a
+    // diagnosable reason naming the blocked tools and the likely culprit.
+    // Shared by the primary turn and both recovery retries.
+    const enterUnattributedHookBlockFailure = async (boundary: TurnBoundaryResult) => {
+      const blockedTools = [...new Set(boundary.unattributedHookBlocks.map((b) => b.toolName))]
+        .join(", ");
+      const culprit = hitlGate.foreignGatingHooks.length > 0
+        ? ` The workspace's .cursor/hooks.json registers hook(s) outside Stigmer's control ` +
+          `[${hitlGate.foreignGatingHooks.join(", ")}], which most likely denied it.`
+        : "";
+      status.phase = ExecutionPhase.EXECUTION_FAILED;
+      status.error =
+        `A Cursor hook outside Stigmer's approval gate blocked tool(s): ${blockedTools}.` +
+        culprit +
+        ` Stigmer cannot request approval on a foreign hook's behalf — remove or adjust ` +
+        `the hook in .cursor/hooks.json and retry.`;
+      status.completedAt = utcTimestamp();
+      status.messages.push(create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content: `Execution failed: ${status.error}`,
+        timestamp: utcTimestamp(),
+      }));
+      await persist(status);
+      try { resolution.agent.close(); } catch { /* best effort */ }
+      console.error(
+        `ExecuteCursor failed (unattributed hook block): execution=${executionId}, ` +
+        `tools=[${blockedTools}], foreignHooks=[${hitlGate.foreignGatingHooks.join(", ")}]`,
+      );
+      return slimStatus(status);
+    };
+
     // Re-enter the turn boundary for a recovery retry: author the retry's net
     // change set to the file_review ledger and overlay any denials as gates —
     // without this a retry's file edits silently escape review (production case
@@ -1285,8 +1335,13 @@ async function executeCursorInner(
       turnState.firstDenialDetected ? turnState.denialCancelSettled : undefined,
     );
     if (boundary.waiting) {
+      // A pausing turn is never silent, so an unattributed block alongside our
+      // own gate only warns (logged by the boundary) — the pause wins.
       return enterApprovalPause(boundary);
     }
+    if (boundary.unattributedHookBlocks.length > 0) {
+      return enterUnattributedHookBlockFailure(boundary);
+    }
 
     // Phase 13: Map final result
     const result = await run.wait();
@@ -1407,6 +1462,9 @@ async function executeCursorInner(
             );
             return enterApprovalPause(retryBoundary);
           }
+          if (retryBoundary && retryBoundary.unattributedHookBlocks.length > 0) {
+            return enterUnattributedHookBlockFailure(retryBoundary);
+          }
 
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;
@@ -1488,6 +1546,9 @@ async function executeCursorInner(
             );
             return enterApprovalPause(retryBoundary);
           }
+          if (retryBoundary && retryBoundary.unattributedHookBlocks.length > 0) {
+            return enterUnattributedHookBlockFailure(retryBoundary);
+          }
 
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;

package/src/activities/execute-cursor/message-translator.ts

@@ -45,7 +45,14 @@ import {
   resolveApprovalProvenance,
   toProtoPolicySource,
 } from "../../shared/approval-policy.js";
-import { grantToken, primaryToken, toolIdentity, type DeniedLedgerEntry } from "./approval-state.js";
+import {
+  approvalDenials,
+  denialKindOf,
+  grantToken,
+  primaryToken,
+  toolIdentity,
+  type DeniedLedgerEntry,
+} from "./approval-state.js";
 import { utcTimestamp } from "../../shared/status.js";
 import { hideToolCallRow, isToolCallRowHidden } from "../../shared/tool-row.js";
 import { classifyTool, toolApprovalCategory, type ToolApprovalCategory } from "../../shared/tool-kind.js";
@@ -316,6 +323,19 @@ function mapSubAgentStatus(cursorStatus: string): SubAgentStatus {
   }
 }
 
+/**
+ * Terminal for the MONOTONIC status guard in {@link mergeToolCallEvent}: once a
+ * row reaches one of these, a later event re-emit must not regress it.
+ *
+ * TOOL_CALL_INTERRUPTED is deliberately NOT here, even though it is terminal
+ * everywhere else (server, clients, provenance scoping — see the shared
+ * TERMINAL_TOOL_CALL_STATUSES in tool-row.ts). INTERRUPTED is server-authored
+ * when an execution terminalizes with the call in flight; if that FAILED
+ * execution is later RECOVERED, the harness checkpoint can re-execute the call
+ * under its original call id — and live execution evidence outranks the
+ * interruption marker, so the replayed event must advance the row to its true
+ * outcome (the enum's documented recovery supersede rule).
+ */
 function isTerminalToolStatus(status: ToolCallStatus): boolean {
   return (
     status === ToolCallStatus.TOOL_CALL_COMPLETED ||
@@ -1217,6 +1237,13 @@ export async function reconcileDeniedToolCalls(
   mergedPolicies?: Map<string, MergedToolPolicy>,
   workspaceBackend?: WorkspaceBackend,
 ): Promise<ToolCall[]> {
+  // Defense-in-depth: only APPROVAL-kind denials may become approval gates.
+  // The turn boundary already passes the filtered subset; re-filtering here
+  // makes it structurally impossible for a secret/capture-error/fail-closed
+  // entry to manufacture a pause the user cannot meaningfully grant, no matter
+  // what a future caller passes (an absent kind is the pre-kind format and
+  // counts as approval).
+  ledger = approvalDenials(ledger);
   if (ledger.length === 0) return [];
 
   // The workspace the gated files live in; its rootDir normalizes paths for the
@@ -1793,6 +1820,102 @@ export function clearProvisionalPostDenialNarration(
   return redacted;
 }
 
+/**
+ * Substrings of the error text Cursor stamps onto a tool call blocked by a
+ * `preToolUse`/`beforeMCPExecution` hook (its generic replacement for the
+ * hook's own agent_message — confirmed by the Phase 0 ground-truth capture in
+ * cursor_hitl_test.go). The SDK has NO structured "denied by hook" signal, so
+ * this marker family is the only stream-side trace of a hook block and is
+ * single-sourced here for every consumer (the issue #205 attribution detector
+ * below; tests). Matched case-insensitively against the FAILED call's error.
+ */
+export const HOOK_BLOCK_ERROR_MARKERS: readonly string[] = ["blocked by a hook"];
+
+/** True when a tool call's error text reads as a hook block. */
+function isHookBlockError(errorText: string): boolean {
+  if (!errorText) return false;
+  const lowered = errorText.toLowerCase();
+  return HOOK_BLOCK_ERROR_MARKERS.some((marker) => lowered.includes(marker));
+}
+
+/** One hook-blocked tool call that no ledger entry accounts for (issue #205). */
+export interface UnattributedHookBlock {
+  toolCallId: string;
+  toolName: string;
+  /** The hook-block error text Cursor stamped on the call. */
+  error: string;
+}
+
+/**
+ * Detect tool calls blocked by a hook that STIGMER'S OWN hook did not deny —
+ * the issue #205 invariant check "a blocked tool must never silently complete".
+ *
+ * Cursor runs EVERY hook registered in the workspace's `.cursor/hooks.json`
+ * and a deny from any of them blocks the tool. Our hook records every deny it
+ * issues to the denial ledger (all kinds — see {@link DeniedLedgerEntry}), so a
+ * FAILED tool call carrying Cursor's hook-block error text with NO matching
+ * ledger entry was blocked by a FOREIGN hook (a user/team `preToolUse` policy
+ * hook the merge deliberately preserves) — or, equally fatally, by our own
+ * hook whose best-effort ledger append failed. Either way the runner cannot
+ * pause for approval (an approval grants a token only OUR hook reads; the
+ * foreign hook would deny the re-attempt forever), so the caller surfaces an
+ * explicit failure instead of completing with the work silently undone.
+ *
+ * Attribution, in order:
+ *  1. Any `fail-closed` ledger entry → the gate itself was broken this turn and
+ *     denied EVERYTHING it saw; per-call correlation is meaningless, so every
+ *     hook block is attributed to our own (broken) gate. Nothing is reported.
+ *  2. Exact identity: the call's {@link toolCallIdentityToken} appears in the
+ *     ledger (any kind — approval gates were overlaid to WAITING_APPROVAL or
+ *     collapsed by the reconcile that runs first, so a still-FAILED row here is
+ *     typically a secret/capture-error deny, correctly attributed as ours).
+ *  3. Normalized-path fallback: the same abs-vs-rel drift the reconcile's
+ *     second pass handles — a FILE call matches a ledger entry by (category,
+ *     workspace-normalized path) even when the raw tokens differ.
+ *
+ * Scoped to THIS turn's messages (from `turnStartMessageIndex`): seeded
+ * prior-turn rows were already adjudicated and must never re-trigger.
+ * Deliberately conservative: an ordinary tool failure (no hook-block text)
+ * is never reported, and a foreign hook denying with fully custom text evades
+ * the marker match (the documented residual — the install-time
+ * foreignGatingHooks warning still fires for diagnosability).
+ */
+export function detectUnattributedHookBlocks(
+  messages: readonly AgentMessage[],
+  turnStartMessageIndex: number,
+  ledger: readonly DeniedLedgerEntry[],
+  workspaceRoot?: string,
+): UnattributedHookBlock[] {
+  if (ledger.some((e) => denialKindOf(e) === "fail-closed")) return [];
+
+  const ledgerTokens = new Set(ledger.map((e) => e.token));
+  const ledgerNormalizedSalients = new Set<string>();
+  if (workspaceRoot) {
+    for (const entry of ledger) {
+      const decoded = decodeIdentityToken(entry.token);
+      if (!decoded) continue;
+      const normalized = normalizedFileSalient(decoded.key, decoded.salient, workspaceRoot);
+      if (normalized) ledgerNormalizedSalients.add(normalized);
+    }
+  }
+
+  const blocks: UnattributedHookBlock[] = [];
+  for (const msg of messages.slice(Math.max(0, turnStartMessageIndex))) {
+    for (const tc of msg.toolCalls) {
+      if (tc.status !== ToolCallStatus.TOOL_CALL_FAILED) continue;
+      if (!isHookBlockError(tc.error)) continue;
+      if (ledgerTokens.has(toolCallIdentityToken(tc))) continue;
+      if (workspaceRoot) {
+        const id = toolIdentity(tc.name, tc.mcpServerSlug, toolCallArgs(tc));
+        const normalized = normalizedFileSalient(id.key, id.salient, workspaceRoot);
+        if (normalized && ledgerNormalizedSalients.has(normalized)) continue;
+      }
+      blocks.push({ toolCallId: tc.id, toolName: tc.name, error: tc.error });
+    }
+  }
+  return blocks;
+}
+
 /**
  * Compute a streamed tool call's identity token in the same canonical space the
  * preToolUse hook records denials in (see {@link toolIdentity} / primaryToken).

package/src/activities/execute-cursor/turn-boundary.ts

@@ -2,12 +2,17 @@
  * The Cursor harness's turn boundary — the single post-run pipeline that turns
  * a finished agent run into the durable review surfaces:
  *
- *  1. read the denial ledger the preToolUse hook appended this turn;
+ *  1. read the denial ledger the preToolUse hook appended this turn (ALL
+ *     kinds — every entry means "this action did not execute"; only the
+ *     approval-kind subset may pause, see approval-state.ts);
  *  2. derive the approved-command provenance (DD-28 auto-keep facts);
  *  3. capture the turn's net file change set to the file_review ledger
  *     (CANDIDATE_CAPTURED) and stamp the flowed edit rows;
- *  4. reconcile denied tool calls to WAITING_APPROVAL gate rows and redact the
- *     model's provisional post-denial narration.
+ *  4. reconcile denied (approval-kind) tool calls to WAITING_APPROVAL gate rows
+ *     and redact the model's provisional post-denial narration;
+ *  5. detect UNATTRIBUTED hook blocks (issue #205) — a tool blocked by a hook
+ *     with no ledger entry of any kind was denied by a FOREIGN hook the merge
+ *     preserved, and the caller fails the run rather than completing silently.
  *
  * Extracted from the activity entry point (index.ts Phase 12) so it is directly
  * unit-testable AND re-enterable: the poisoned-handle / transport-timeout
@@ -32,12 +37,20 @@ import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import type { ArtifactStorage } from "../../shared/artifact-storage.js";
 import type { MergedToolPolicy } from "../../shared/approval-policy.js";
-import { primaryToken, readDenialLedger, type ApprovalGrant } from "./approval-state.js";
+import {
+  approvalDenials,
+  denialKindOf,
+  primaryToken,
+  readDenialLedger,
+  type ApprovalGrant,
+} from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
 import { captureTurnToLedger } from "./capture-flow.js";
 import {
   clearProvisionalPostDenialNarration,
+  detectUnattributedHookBlocks,
   reconcileDeniedToolCalls,
+  type UnattributedHookBlock,
 } from "./message-translator.js";
 
 // How long the boundary waits for the first-denial-stop's run.cancel() to
@@ -96,6 +109,13 @@ export interface TurnBoundaryOptions {
    * normal completion path and the recovery retries, which have no early stop).
    */
   readonly denialCancelSettled?: Promise<void>;
+  /**
+   * Foreign (non-Stigmer) hook commands the gate install preserved on the
+   * gating events (see HitlGateHandle.foreignGatingHooks). Used only for
+   * diagnostics: when an unattributed hook block is detected, these name the
+   * likely culprit in the logs and the caller's failure message.
+   */
+  readonly foreignGatingHooks?: readonly string[];
 }
 
 export interface TurnBoundaryResult {
@@ -109,6 +129,15 @@ export interface TurnBoundaryResult {
   readonly capturedChangeCount: number;
   /** Denied tool calls reconciled to WAITING_APPROVAL gate rows this call. */
   readonly deniedToolCallCount: number;
+  /**
+   * Hook-blocked tool calls this turn that NO denial-ledger entry accounts for
+   * (issue #205): a foreign `.cursor/hooks.json` hook — or our own hook with a
+   * failed ledger append — denied them, and Stigmer cannot approve on its
+   * behalf. When the turn is not otherwise pausing, the caller must surface an
+   * explicit EXECUTION_FAILED instead of completing with the work silently
+   * undone (a pausing turn is not silent — the caller logs and pauses as usual).
+   */
+  readonly unattributedHookBlocks: readonly UnattributedHookBlock[];
 }
 
 /**
@@ -140,6 +169,7 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     artifactStorage,
     mergedPolicies,
     denialCancelSettled,
+    foreignGatingHooks,
   } = opts;
 
   // The timebox keeps a wedged cancel from hanging the pause; the reconcile
@@ -153,7 +183,13 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
       }),
     ]);
   }
+  // The FULL ledger (all kinds) vs its APPROVAL subset — the kind split:
+  // every ledger entry means "this action did NOT execute", so the full set
+  // feeds capture stamping, DD-28 provenance, and foreign-hook attribution;
+  // only approval-kind entries may become WAITING_APPROVAL gates (a secret
+  // hard-block or fail-closed deny is attributable but never pausable).
   const deniedLedger = await readDenialLedger(hitlDir ?? "");
+  const approvalLedger = approvalDenials(deniedLedger);
 
   // Capture mode: author the net change set to the file_review ledger as the
   // CANDIDATE_CAPTURED event (projected server-side to a file_change_set
@@ -230,7 +266,7 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
   const gateWorkspaceBackend = new LocalWorkspaceBackend(primaryWorkspaceDir);
   const deniedToolCalls = await reconcileDeniedToolCalls(
     status.messages,
-    deniedLedger,
+    approvalLedger,
     mergedPolicies,
     gateWorkspaceBackend,
   );
@@ -266,9 +302,46 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     }
   }
 
+  // Issue #205 invariant: a blocked tool must never silently complete. Match
+  // this turn's hook-blocked FAILED rows against the FULL ledger (all kinds) —
+  // anything left over was denied by a hook that is not ours (or by our hook
+  // with a failed ledger append). The reconcile above ran first, so our own
+  // approval gates are already WAITING_APPROVAL/collapsed and cannot appear
+  // here as false positives.
+  const unattributedHookBlocks = detectUnattributedHookBlocks(
+    status.messages,
+    turnStartMessageIndex,
+    deniedLedger,
+    primaryWorkspaceDir,
+  );
+  const waiting = deniedToolCalls.length > 0 || capturedChangeCount > 0;
+  if (unattributedHookBlocks.length > 0) {
+    const culprits = (foreignGatingHooks?.length ?? 0) > 0
+      ? ` — likely foreign workspace hook(s): ${foreignGatingHooks!.join(", ")}`
+      : "";
+    console.warn(
+      `ExecuteCursor turn boundary: ${unattributedHookBlocks.length} tool call(s) blocked ` +
+      `by a hook with NO matching denial-ledger entry ` +
+      `[${unattributedHookBlocks.map((b) => b.toolName).join(", ")}]${culprits} ` +
+      `(execution=${executionId})${waiting ? " — turn pauses anyway; not failing" : ""}`,
+    );
+  }
+  // Diagnosability for the broken-gate shape: fail-closed entries mean the
+  // approval state file was missing and the gate denied everything it saw.
+  // Attribution treats those blocks as ours (never a foreign-hook failure),
+  // but the condition itself deserves a loud log.
+  if (deniedLedger.some((e) => denialKindOf(e) === "fail-closed")) {
+    console.warn(
+      `ExecuteCursor turn boundary: fail-closed denial(s) in the ledger — the approval ` +
+      `state file was missing during this turn and gated tools were denied ` +
+      `(execution=${executionId})`,
+    );
+  }
+
   return {
-    waiting: deniedToolCalls.length > 0 || capturedChangeCount > 0,
+    waiting,
     capturedChangeCount,
     deniedToolCallCount: deniedToolCalls.length,
+    unattributedHookBlocks,
   };
 }

package/src/activities/execute-cursor/turn-stream.ts

@@ -33,7 +33,7 @@ import {
   type StallWatchdog,
 } from "../../shared/stall-watchdog.js";
 import { shouldPersistStreamingStatus } from "./persist-decision.js";
-import { readDenialLedger } from "./approval-state.js";
+import { approvalDenials, readDenialLedger } from "./approval-state.js";
 import {
   captureFileChangeProgress,
   type ProgressCaptureState,
@@ -305,7 +305,11 @@ export async function consumeCursorTurnStream(
       // anchor's own row is always present for the turn-boundary gate overlay.
       if (!state.firstDenialDetected && hitlDir && (state.denialLedgerDirty || event.type === "tool_call")) {
         state.denialLedgerDirty = false;
-        const denials = await readDenialLedger(hitlDir);
+        // APPROVAL-kind denials only: a secret hard-block or fail-closed deny
+        // also lands in the (kinded) ledger for attribution, but must never
+        // stop the run — the agent is told to continue past those, and there
+        // is no approval the user could meaningfully grant.
+        const denials = approvalDenials(await readDenialLedger(hitlDir));
         if (denials.length > 0) {
           state.firstDenialDetected = true;
           console.log(