@stigmer/runner 3.1.7 → 3.1.9

package/README.md

@@ -24,7 +24,7 @@ make build-runner
 
 This runs `npm run build` in `backend/services/runner` (`tsc -p tsconfig.build.json`) and then writes a build fingerprint (see [The stale-build guard](#the-stale-build-guard)). The compiled output lands in `dist/`, with a `stigmer-runner` CLI entry point at `dist/main.js`.
 
-Requires Node.js `>= 20`.
+Requires Node.js `>= 22.13` (the durable local checkpointer uses the built-in `node:sqlite`, unflagged from v22.13 / v23.4).
 
 ### The slim embedding artifact
 

package/dist/.build-fingerprint

@@ -1 +1 @@
-{"hash":"4c57edff0c688075","builtAt":"2026-07-07T15:43:06.051Z","fileCount":244}
+{"hash":"bdd01c2649288306","builtAt":"2026-07-13T08:24:09.134Z","fileCount":246}

package/dist/activities/discover-mcp-server.js

@@ -286,6 +286,7 @@ export function createDiscoverMcpServerActivities(config) {
         endpoint: config.stigmerBackendEndpoint,
         token: config.stigmerToken,
         tokenRef: config.stigmerTokenRef,
+        runnerTokenRef: config.stigmerRunnerTokenRef,
     });
     return {
         DiscoverMcpServerCapabilities: async (input) => {

package/dist/activities/discover-mcp-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"discover-mcp-server.js","sourceRoot":"","sources":["../../src/activities/discover-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,MAAM,uBAAuB,GAA2B;IACtD,sBAAsB,EAAE,6BAA6B;CACtD,CAAC;AAwDF,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAYD,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC3C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAmC,IAAI,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,aAAa;QACb,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB,CAC/B,eAA4B,EAC5B,OAA+B;IAE/B,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,IAAI,MAA0C,CAAC;IAE/C,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CACV,qBAAqB,SAAS,0CAA0C;gBACxE,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B,EAC7B,IAAkB;IAElB,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/B,OAAO,CAAC,GAAG,CACT,2DAA2D,WAAW,EAAE,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,WAAW,4BAA4B,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,aAAa,EACb,kBAAkB,IAAI,IAAI,CAC3B,CAAC;IAEF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG;QACxC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,wCAAwC;YAC3D,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,kBAAkB,CAC3D,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CACT,+CAA+C,IAAI,KAAK;QACxD,GAAG,KAAK,CAAC,MAAM,aAAa,iBAAiB,CAAC,MAAM,uBAAuB,CAC5E,CAAC;IAEF,OAAO;QACL,KAAK;QACL,iBAAiB;QACjB,wBAAwB,EAAE,aAAa,CAAC,WAAW;QACnD,qBAAqB,EAAE,aAAa,CAAC,aAAa;QAClD,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,aAAa,CAAC,KAAK;KACnC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,KAAK,UAAU,0BAA0B,CACvC,MAAqB,EACrB,kBAAiC;IAEjC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAC3D,kBAAkB,CACnB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CACV,yCAAyC,kBAAkB,cAAc;gBACzE,6DAA6D,CAC9D,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QACjC,CAAC;QAED,OAAO,CAAC,GAAG,CACT,gCAAgC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,cAAc;YACzE,0BAA0B,kBAAkB,GAAG,CAChD,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,2DAA2D,kBAAkB,KAAK;YAClF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,gBAAsD;IAKtD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAuC,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,wBAAwB,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;oBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAE,IAAI,CAAC,WAAuC;wBAC/C,CAAC,CAAC,IAAI;oBACR,sEAAsE;oBACtE,2DAA2D;oBAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAC;4BACE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;4BAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;yBAClD;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACvD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;oBAC5B,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,CAAC;oBAChE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;wBACpD,iBAAiB,CAAC,IAAI,CAAC;4BACrB,WAAW,EAAE,GAAG,CAAC,WAAW;4BAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;4BAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,qBAAqB;oBACxD,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC1E,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,KAAK;gBAC9D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAY,EACZ,gBAAsD;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,UAAkB,EAClB,EAAoB;IAEpB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CACd,eAAe,UAAU,2BAA2B;gBACpD,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,4CAA4C;gBACpE,iEAAiE;gBACjE,gDAAgD,CACjD,CAAC,CAAC;QACL,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,EAAE,EAAE;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;KACjC,CAAC,CAAC;IAEH,OAAO;QACL,6BAA6B,EAAE,KAAK,EAClC,KAA6B,EACK,EAAE;YACpC,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC3D,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"discover-mcp-server.js","sourceRoot":"","sources":["../../src/activities/discover-mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAExC,MAAM,uBAAuB,GAA2B;IACtD,sBAAsB,EAAE,6BAA6B;CACtD,CAAC;AAwDF,gFAAgF;AAChF,iEAAiE;AACjE,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,KAA6B;IAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,SAAS,GAAG,KAAK;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;SACjC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAYD,MAAM,UAAU,oBAAoB,CAAC,SAAoB;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAEtE,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,CAAC;IAC3C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,MAAM,GAAmC,IAAI,CAAC;YAClD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;YACD,SAAS,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACxC,aAAa;QACb,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAe;IAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF,MAAM,UAAU,iBAAiB,CAC/B,eAA4B,EAC5B,OAA+B;IAE/B,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAE/C,IAAI,MAA0C,CAAC;IAE/C,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO,CAAC,IAAI,CACV,qBAAqB,SAAS,0CAA0C;gBACxE,yCAAyC,CAC1C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B,EAC7B,IAAkB;IAElB,MAAM,EAAE,WAAW,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;IAClD,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAE/B,OAAO,CAAC,GAAG,CACT,2DAA2D,WAAW,EAAE,CACzE,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,eAAe,WAAW,4BAA4B,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,IAAI,WAAW,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAC9C,aAAa,EACb,kBAAkB,IAAI,IAAI,CAC3B,CAAC;IAEF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG;QACxC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,wCAAwC;YAC3D,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,kBAAkB,CAC3D,IAAI,EACJ,gBAAgB,CACjB,CAAC;IAEF,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEtC,OAAO,CAAC,GAAG,CACT,+CAA+C,IAAI,KAAK;QACxD,GAAG,KAAK,CAAC,MAAM,aAAa,iBAAiB,CAAC,MAAM,uBAAuB,CAC5E,CAAC;IAEF,OAAO;QACL,KAAK;QACL,iBAAiB;QACjB,wBAAwB,EAAE,aAAa,CAAC,WAAW;QACnD,qBAAqB,EAAE,aAAa,CAAC,aAAa;QAClD,mBAAmB,EAAE,KAAK;QAC1B,aAAa,EAAE,aAAa,CAAC,KAAK;KACnC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,KAAK,UAAU,0BAA0B,CACvC,MAAqB,EACrB,kBAAiC;IAEjC,IAAI,CAAC,kBAAkB;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAC3D,kBAAkB,CACnB,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,CAAC,IAAI,CACV,yCAAyC,kBAAkB,cAAc;gBACzE,6DAA6D,CAC9D,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;QACjC,CAAC;QAED,OAAO,CAAC,GAAG,CACT,gCAAgC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,cAAc;YACzE,0BAA0B,kBAAkB,GAAG,CAChD,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,2DAA2D,kBAAkB,KAAK;YAClF,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,gBAAsD;IAKtD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAuC,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,uBAAuB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,MAAM,CAAC,qBAAqB,EAAE,CAAC;YAErC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,wBAAwB,CACrE,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE;oBACnC,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAE,IAAI,CAAC,WAAuC;wBAC/C,CAAC,CAAC,IAAI;oBACR,sEAAsE;oBACtE,2DAA2D;oBAC3D,WAAW,EAAE,IAAI,CAAC,WAAW;wBAC3B,CAAC,CAAC;4BACE,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;4BAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,eAAe;yBAClD;wBACH,CAAC,CAAC,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBACvD,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;oBAC5B,MAAM,eAAe,GAAG,MAAM,SAAS,CAAC,qBAAqB,EAAE,CAAC;oBAChE,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,iBAAiB,EAAE,CAAC;wBACpD,iBAAiB,CAAC,IAAI,CAAC;4BACrB,WAAW,EAAE,GAAG,CAAC,WAAW;4BAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;4BAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE;yBAC7B,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,qBAAqB;oBACxD,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAClE,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC1E,IAAI,UAAU;YAAE,MAAM,UAAU,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,OAAO,CAAC,IAAI,CACV,qDAAqD,IAAI,KAAK;gBAC9D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB,CACrC,IAAY,EACZ,gBAAsD;IAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,UAAkB,EAClB,EAAoB;IAEpB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CACd,eAAe,UAAU,2BAA2B;gBACpD,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,4CAA4C;gBACpE,iEAAiE;gBACjE,gDAAgD,CACjD,CAAC,CAAC;QACL,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,EAAE,EAAE;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;QACtC,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;QAC1B,QAAQ,EAAE,MAAM,CAAC,eAAe;QAChC,cAAc,EAAE,MAAM,CAAC,qBAAqB;KAC7C,CAAC,CAAC;IAEH,OAAO;QACL,6BAA6B,EAAE,KAAK,EAClC,KAA6B,EACK,EAAE;YACpC,eAAe,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,OAAO,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC3D,CAAC;oBAAS,CAAC;gBACT,gBAAgB,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/activities/execute-cursor/__test-utils__/cursor-hook-harness.d.ts

@@ -31,12 +31,15 @@ export interface CursorHookHarness {
         raw: string;
     };
     /**
-     * The denial ledger entries the hook has appended this turn. `input` is the
-     * base64(JSON(tool_input)) the hook captures (decode + JSON.parse to inspect).
+     * The denial ledger entries the hook has appended this turn. `kind` is the
+     * attribution taxonomy (approval/secret/capture-error/fail-closed); `input`
+     * is the base64(JSON(tool_input)) the hook captures on APPROVAL-kind entries
+     * only (decode + JSON.parse to inspect).
      */
     ledger(): Array<{
         toolName: string;
         token: string;
+        kind?: string;
         input?: string;
     }>;
     /** Truncate the denial ledger (a fresh turn). */

package/dist/activities/execute-cursor/__test-utils__/cursor-hook-harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-hook-harness.js","sourceRoot":"","sources":["../../../../src/activities/execute-cursor/__test-utils__/cursor-hook-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAEvG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,wBAAwB,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAY,CAAC,GAAG,EAAE;IACpC,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAkEL;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC,EAAE;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACvD,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,gFAAgF;IAChF,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACzE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,aAAa,CACX,WAAW,EACX,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG;KACzC,CAAC,EACF,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE;YACb;gBACE,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,eAAe,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;gBAChC,MAAM,EAAE,oBAA6B;aACtC;SACF,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAC9B,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,IAAI,KAAK,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,CAAC,YAAY,IAAI,IAAI,CAC1B,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE;QACR,MAAM,CAAC,KAAa;YAClB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACpD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;oBACpC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM;YACJ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,WAAW;YACT,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,YAAY;YACV,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACrI,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,SAAS,GAAG,GAAG,EAAE,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACjM,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3G,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IACjC,eAAe,EAAE,KAAK;IACtB,OAAO,EAAE,gBAAgB;IACzB,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC"}
+{"version":3,"file":"cursor-hook-harness.js","sourceRoot":"","sources":["../../../../src/activities/execute-cursor/__test-utils__/cursor-hook-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAEvG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,wBAAwB,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAY,CAAC,GAAG,EAAE;IACpC,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAoEL;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC,EAAE;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACvD,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,gFAAgF;IAChF,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACzE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,aAAa,CACX,WAAW,EACX,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG;KACzC,CAAC,EACF,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE;YACb;gBACE,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,eAAe,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;gBAChC,MAAM,EAAE,oBAA6B;aACtC;SACF,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAC9B,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,IAAI,KAAK,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,CAAC,YAAY,IAAI,IAAI,CAC1B,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE;QACR,MAAM,CAAC,KAAa;YAClB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACpD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;oBACpC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM;YACJ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,WAAW;YACT,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,YAAY;YACV,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACrI,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,SAAS,GAAG,GAAG,EAAE,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACjM,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3G,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IACjC,eAAe,EAAE,KAAK;IACtB,OAAO,EAAE,gBAAgB;IACzB,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC"}

package/dist/activities/execute-cursor/approval-state.d.ts

@@ -56,14 +56,24 @@
  *
  * Denial ledger (hook → runner):
  * The state file is the runner's INPUT to the hook. Its symmetric OUTPUT is the
- * denial ledger (denials.jsonl): when the hook denies a tool, it appends
- * the call's identity token to this file. The runner reads the ledger after the
- * run to learn which tool calls were gated — the hook is the only component that
- * actually makes the per-call allow/deny decision, so its ledger is the
- * authoritative "what was denied this turn" signal (the cursor analog of the
- * native harness's LangGraph interrupts). The token uses the SAME identity space
- * as approvedGrantTokens, so a denial token approved this turn becomes a grant
- * token next turn.
+ * denial ledger (denials.jsonl): EVERY deny the hook issues appends the call's
+ * identity token to this file, tagged with a `kind` (see {@link DenialKind}) —
+ * so the ledger is the complete, authoritative record of what THIS hook blocked
+ * this turn (the cursor analog of the native harness's LangGraph interrupts).
+ * The kinds split by consumer semantics:
+ *
+ * - Only APPROVAL-kind entries pause the run (the first-denial stop and
+ *   reconcileDeniedToolCalls filter to them via {@link approvalDenials}); a
+ *   secret hard-block or a fail-closed deny must never surface an approval the
+ *   user cannot meaningfully grant.
+ * - The FULL ledger (all kinds) means "these actions did NOT execute": it feeds
+ *   capture stamping and DD-28 provenance, and it is the ATTRIBUTION set for
+ *   issue #205 — a hook-blocked tool call with NO ledger entry of any kind was
+ *   blocked by a FOREIGN hook (or a failed ledger append), an invariant
+ *   violation the turn boundary surfaces instead of completing silently.
+ *
+ * The token uses the SAME identity space as approvedGrantTokens, so a denial
+ * token approved this turn becomes a grant token next turn.
  */
 import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
@@ -273,12 +283,38 @@ export declare function buildApprovalState(mergedPolicies: Map<string, MergedToo
  * would break every lookup.
  */
 export declare function writeApprovalStateFile(hitlDir: string, state: ApprovalStateFile): Promise<string>;
+/**
+ * The attribution taxonomy of a hook denial (mirrored byte-for-byte by the
+ * generated bash script — see hook-script.ts record_denial):
+ *
+ * - `approval`      — the normal gate: the runner surfaces it as a
+ *                     WAITING_APPROVAL pause. The ONLY kind that pauses.
+ * - `secret`        — DD-26 secret hard-block: intentional, non-pausing (the
+ *                     agent was told to move on), recorded content-free.
+ * - `capture-error` — CAS staging failed; the write stayed on the deny-gate.
+ *                     Content-free (the staging error means secret
+ *                     classification may never have run).
+ * - `fail-closed`   — the approval state file was missing, so everything gated
+ *                     denied. A turn-level "the gate itself was broken" fact.
+ *
+ * An unknown kind string is preserved as-is: it is treated as non-pausing (an
+ * unknown deny must never manufacture an approval) but still attributes the
+ * blocked call to our own hook.
+ */
+export type DenialKind = "approval" | "secret" | "capture-error" | "fail-closed";
+/** The one kind that pauses the run for user approval. */
+export declare const APPROVAL_DENIAL_KIND: DenialKind;
 /**
  * One denial recorded by the preToolUse hook. `token` is the call's identity in
  * the same space as grantToken() (base64 of `toolName \n salientArg`), used to
  * correlate the denial back to the streamed tool call. `toolName` is carried raw
  * for human-readable debugging of the ledger file.
  *
+ * `kind` is the attribution taxonomy entry (see {@link DenialKind}). Optional
+ * for tolerance: an entry written without one (the pre-kind ledger format, or a
+ * hand-built test fixture) is an approval-kind denial — see
+ * {@link denialKindOf}.
+ *
  * `input` is the authoritative pre-execution tool arguments the hook captured
  * from the Cursor `tool_input` payload (decoded from the ledger's base64 form).
  * It is the cursor analog of the native harness reading the AI-message tool-call
@@ -286,14 +322,26 @@ export declare function writeApprovalStateFile(hitlDir: string, state: ApprovalS
  * proposed change is in hand before the tool runs. The runner overlays it onto
  * the gated tool call so the approval card can show the proposed content/diff
  * before the user approves. Absent when the hook ran its grep fallback (the Node
- * binary was unavailable), in which case the gate degrades to stream-recovered
- * args exactly as before.
+ * binary was unavailable) — the gate then degrades to stream-recovered args —
+ * and ALWAYS absent for non-approval kinds (DD-26: only an approval-kind entry
+ * may carry proposed content).
  */
 export interface DeniedLedgerEntry {
     toolName: string;
     token: string;
+    kind?: string;
     input?: Record<string, unknown>;
 }
+/** The effective kind of a ledger entry (absent → approval, the pre-kind format). */
+export declare function denialKindOf(entry: DeniedLedgerEntry): string;
+/**
+ * The entries that pause the run for user approval — the ONLY kind
+ * reconcileDeniedToolCalls may turn into WAITING_APPROVAL gates and the only
+ * kind the first-denial stop may cancel the run for. Every other consumer
+ * (capture stamping, DD-28 provenance, foreign-hook attribution) wants the FULL
+ * ledger: all kinds mean "this action did not execute".
+ */
+export declare function approvalDenials(entries: readonly DeniedLedgerEntry[]): DeniedLedgerEntry[];
 /**
  * Absolute path of the per-turn denial ledger the hook appends to, inside the
  * session's runner-owned HITL directory (never the user's workspace).

package/dist/activities/execute-cursor/approval-state.js

@@ -56,14 +56,24 @@
  *
  * Denial ledger (hook → runner):
  * The state file is the runner's INPUT to the hook. Its symmetric OUTPUT is the
- * denial ledger (denials.jsonl): when the hook denies a tool, it appends
- * the call's identity token to this file. The runner reads the ledger after the
- * run to learn which tool calls were gated — the hook is the only component that
- * actually makes the per-call allow/deny decision, so its ledger is the
- * authoritative "what was denied this turn" signal (the cursor analog of the
- * native harness's LangGraph interrupts). The token uses the SAME identity space
- * as approvedGrantTokens, so a denial token approved this turn becomes a grant
- * token next turn.
+ * denial ledger (denials.jsonl): EVERY deny the hook issues appends the call's
+ * identity token to this file, tagged with a `kind` (see {@link DenialKind}) —
+ * so the ledger is the complete, authoritative record of what THIS hook blocked
+ * this turn (the cursor analog of the native harness's LangGraph interrupts).
+ * The kinds split by consumer semantics:
+ *
+ * - Only APPROVAL-kind entries pause the run (the first-denial stop and
+ *   reconcileDeniedToolCalls filter to them via {@link approvalDenials}); a
+ *   secret hard-block or a fail-closed deny must never surface an approval the
+ *   user cannot meaningfully grant.
+ * - The FULL ledger (all kinds) means "these actions did NOT execute": it feeds
+ *   capture stamping and DD-28 provenance, and it is the ATTRIBUTION set for
+ *   issue #205 — a hook-blocked tool call with NO ledger entry of any kind was
+ *   blocked by a FOREIGN hook (or a failed ledger append), an invariant
+ *   violation the turn boundary surfaces instead of completing silently.
+ *
+ * The token uses the SAME identity space as approvedGrantTokens, so a denial
+ * token approved this turn becomes a grant token next turn.
  */
 import { watch } from "node:fs";
 import { writeFile, readFile, mkdir, rename, rm } from "node:fs/promises";
@@ -273,6 +283,22 @@ export async function writeApprovalStateFile(hitlDir, state) {
 // Denial ledger (hook → runner): the authoritative record of what the hook gated
 // ─────────────────────────────────────────────────────────────────────────────
 const DENIAL_LEDGER_FILE = "denials.jsonl";
+/** The one kind that pauses the run for user approval. */
+export const APPROVAL_DENIAL_KIND = "approval";
+/** The effective kind of a ledger entry (absent → approval, the pre-kind format). */
+export function denialKindOf(entry) {
+    return entry.kind || APPROVAL_DENIAL_KIND;
+}
+/**
+ * The entries that pause the run for user approval — the ONLY kind
+ * reconcileDeniedToolCalls may turn into WAITING_APPROVAL gates and the only
+ * kind the first-denial stop may cancel the run for. Every other consumer
+ * (capture stamping, DD-28 provenance, foreign-hook attribution) wants the FULL
+ * ledger: all kinds mean "this action did not execute".
+ */
+export function approvalDenials(entries) {
+    return entries.filter((e) => denialKindOf(e) === APPROVAL_DENIAL_KIND);
+}
 /**
  * Absolute path of the per-turn denial ledger the hook appends to, inside the
  * session's runner-owned HITL directory (never the user's workspace).
@@ -362,6 +388,9 @@ export async function readDenialLedger(hitlDir) {
                 entries.push({
                     toolName: typeof obj.toolName === "string" ? obj.toolName : "",
                     token: obj.token,
+                    // A garbled/missing kind degrades to undefined → approval (the
+                    // pre-kind format); see denialKindOf.
+                    kind: typeof obj.kind === "string" && obj.kind ? obj.kind : undefined,
                     input: decodeLedgerInput(obj.input),
                 });
             }

package/dist/activities/execute-cursor/approval-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,sCAAsC,CAAC;AA8B9C,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAwFD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAoB;IACxE,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,cAA8B,EAC9B,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,yBAAyB;YACzB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;gBACtC,aAAa,EAAE,UAAU;gBACzB,mBAAmB,EAAE,qBAAqB;gBAC1C,WAAW,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC,EACtC,cAAoC;IAEpC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE;YACvD,gBAAgB,EAAE,EAAE,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,YAAqB,EACrB,gBAA+C,EAC/C,MAAwB,EACxB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,YAAY,GAAG,IAAI;IAEnB,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,eAAe;QACf,cAAc;QACd,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/F,WAAW;QACX,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAwB3C;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAmB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6D,CAAC;YAC5F,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAwB1C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,sEAAsE;YACtE,qEAAqE;YACrE,qCAAqC;YACrC,cAAc,CAAC,GAAG,CAChB,EAAE,CAAC,EAAE,EACL,EAAE,CAAC,qBAAqB;gBACtB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,IAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;YACF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,sCAAsC,CAAC;AA8B9C,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAwFD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAoB;IACxE,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,cAA8B,EAC9B,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,yBAAyB;YACzB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;gBACtC,aAAa,EAAE,UAAU;gBACzB,mBAAmB,EAAE,qBAAqB;gBAC1C,WAAW,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC,EACtC,cAAoC;IAEpC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE;YACvD,gBAAgB,EAAE,EAAE,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,YAAqB,EACrB,gBAA+C,EAC/C,MAAwB,EACxB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,YAAY,GAAG,IAAI;IAEnB,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,eAAe;QACf,cAAc;QACd,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/F,WAAW;QACX,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAsB3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAe,UAAU,CAAC;AA+B3D,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAmB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAK7B,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,+DAA+D;oBAC/D,sCAAsC;oBACtC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACrE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAwB1C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,sEAAsE;YACtE,qEAAqE;YACrE,qCAAqC;YACrC,cAAc,CAAC,GAAG,CAChB,EAAE,CAAC,EAAE,EACL,EAAE,CAAC,qBAAqB;gBACtB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,IAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;YACF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC"}

package/dist/activities/execute-cursor/env-resolver.js

@@ -12,9 +12,15 @@
  * without any configured secrets or env vars).
  */
 export async function resolveExecutionEnv(client, executionId) {
+    // A desktop runner exchanges its bootstrap credential for a token scoped to
+    // this execution's session, so cloud's decrypt gate binds the read (#156).
+    // No-op for cloud sandbox and OSS runners.
+    const scopedToken = await client.acquireScopedRunnerToken({
+        agentExecutionId: executionId,
+    });
     let execCtx;
     try {
-        execCtx = await client.getExecutionContextByExecutionId(executionId);
+        execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
     }
     catch (err) {
         const code = err?.code;

package/dist/activities/execute-cursor/env-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EACrB,WAAmB;IAEnB,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyB,EAAE,IAAI,CAAC;QAC9C,4DAA4D;QAC5D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,2CAA2C,WAAW,KAAK;gBACzD,oCAAoC,CACvC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAEhC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,8CAA8C;QAC5C,cAAc,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI;QACtC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI;QAC5C,gBAAgB,UAAU,CAAC,IAAI,IAAI;QACnC,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"env-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EACrB,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyB,EAAE,IAAI,CAAC;QAC9C,4DAA4D;QAC5D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,2CAA2C,WAAW,KAAK;gBACzD,oCAAoC,CACvC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAEhC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,8CAA8C;QAC5C,cAAc,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI;QACtC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI;QAC5C,gBAAgB,UAAU,CAAC,IAAI,IAAI;QACnC,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}

package/dist/activities/execute-cursor/hook-script.d.ts

@@ -19,11 +19,24 @@
  *    by event — gated built-in tools (preToolUse) or MCP require-approval
  *    policies (beforeMCPExecution)
  * 4. On a deny, appends the call's identity token to the denial ledger
- *    (stigmer-denials.jsonl) so the runner can mark the gated tool call as
- *    WAITING_APPROVAL — the hook is the only place the deny decision is made,
- *    so its ledger is the authoritative record of what was gated this turn
+ *    (denials.jsonl) — EVERY deny path records, each tagged with a `kind`
+ *    (see below), so the ledger is the complete, authoritative record of what
+ *    this hook blocked this turn. The runner marks approval-kind denials as
+ *    WAITING_APPROVAL; the full ledger is its attribution set for
+ *    distinguishing our denials from a FOREIGN hook's (issue #205): a
+ *    hook-blocked tool with NO ledger entry of any kind was not blocked by us.
  * 5. Returns { "permission": "allow" } or { "permission": "deny" } on stdout
  *
+ * Denial kinds (the attribution taxonomy, mirrored in approval-state.ts):
+ *   - "approval"      — the normal gate: pauses the run for user approval.
+ *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
+ *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
+ *   - "fail-closed"   — approval state file missing, everything gated denies.
+ * Only approval-kind records carry the captured tool_input: a secret write's
+ * content must never be persisted (DD-26), a capture-error's content is
+ * UNCLASSIFIED (the staging error means secret classification may never have
+ * run), and fail-closed has no state to classify against.
+ *
  * Identity extraction runs on the SAME Node.js binary as the runner (its
  * absolute path — process.execPath — is baked into the script at generation
  * time), because the identity token must be byte-identical to the one the

package/dist/activities/execute-cursor/hook-script.js

@@ -19,11 +19,24 @@
  *    by event — gated built-in tools (preToolUse) or MCP require-approval
  *    policies (beforeMCPExecution)
  * 4. On a deny, appends the call's identity token to the denial ledger
- *    (stigmer-denials.jsonl) so the runner can mark the gated tool call as
- *    WAITING_APPROVAL — the hook is the only place the deny decision is made,
- *    so its ledger is the authoritative record of what was gated this turn
+ *    (denials.jsonl) — EVERY deny path records, each tagged with a `kind`
+ *    (see below), so the ledger is the complete, authoritative record of what
+ *    this hook blocked this turn. The runner marks approval-kind denials as
+ *    WAITING_APPROVAL; the full ledger is its attribution set for
+ *    distinguishing our denials from a FOREIGN hook's (issue #205): a
+ *    hook-blocked tool with NO ledger entry of any kind was not blocked by us.
  * 5. Returns { "permission": "allow" } or { "permission": "deny" } on stdout
  *
+ * Denial kinds (the attribution taxonomy, mirrored in approval-state.ts):
+ *   - "approval"      — the normal gate: pauses the run for user approval.
+ *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
+ *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
+ *   - "fail-closed"   — approval state file missing, everything gated denies.
+ * Only approval-kind records carry the captured tool_input: a secret write's
+ * content must never be persisted (DD-26), a capture-error's content is
+ * UNCLASSIFIED (the staging error means secret classification may never have
+ * run), and fail-closed has no state to classify against.
+ *
  * Identity extraction runs on the SAME Node.js binary as the runner (its
  * absolute path — process.execPath — is baked into the script at generation
  * time), because the identity token must be byte-identical to the one the
@@ -423,9 +436,47 @@ ${categoryCaseArms}
   INPUT_B64=""
   CONTENT_TOKEN=""
 fi
+# The single identity a deny is recorded under: content-exact when the input
+# carried edit content, else coarse — the same PRIMARY-token choice the runner
+# grants on approval (approval-state.ts primaryToken).
+if [ -n "$CONTENT_TOKEN" ]; then
+  PRIMARY_TOKEN="$CONTENT_TOKEN"
+else
+  PRIMARY_TOKEN="$TOKEN"
+fi
+
+# Append a denial record to the ledger: $1 = identity token, $2 = kind (the
+# attribution taxonomy — see the module doc in hook-script.ts). EVERY deny arm
+# below records, so the ledger is the complete record of what THIS hook blocked
+# and the runner can tell its own denials from a foreign hook's (issue #205).
+# Best-effort: a ledger write failure must never abort the decision (the deny
+# still goes out on stdout). ONLY approval-kind records carry the captured
+# tool_input (DD-26: secret / unclassified content must never be persisted);
+# input is base64(JSON(tool_input)) — the authoritative pre-execution args the
+# runner overlays for the approval preview (empty on the grep fallback path).
+# Written with printf (a builtin, so no ARG_MAX limit) because the input can be
+# a large multi-MB file body. Defined BEFORE the first deny arm: bash resolves
+# function calls at execution time, and under 'set -euo pipefail' with our
+# failClosed hooks.json registration a call-before-define would abort with no
+# decision and block EVERY tool.
+record_denial() {
+  if [ "$2" = "approval" ]; then
+    printf '{"toolName":"%s","token":"%s","kind":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$2" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
+  else
+    printf '{"toolName":"%s","token":"%s","kind":"%s"}\\n' "$TOOL_NAME" "$1" "$2" >> "$LEDGER_FILE" 2>/dev/null || true
+  fi
+}
 
 # --- Failsafe: missing state file → deny (fail-closed) ---
+# Recorded as kind "fail-closed" so the runner attributes the blocked call to
+# its own (broken) gate instead of misdiagnosing a foreign hook. The ledger
+# path comes from the POINTER, not the state file, so it is recordable here.
 if [ ! -f "$STATE_FILE" ]; then
+  if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
+    record_denial "$MCP_TOKEN" "fail-closed"
+  else
+    record_denial "$PRIMARY_TOKEN" "fail-closed"
+  fi
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi
@@ -481,12 +532,18 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
     echo '{"permission":"allow"}'
     exit 0
   elif [ "$OBS_RESULT" = "secret" ]; then
+    # Kind "secret": attributable but deliberately non-pausing (the agent moves
+    # on) and content-free (DD-26 — the token is the only identity recorded).
+    record_denial "$PRIMARY_TOKEN" "secret"
     echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written or captured for review."}'
     exit 0
   else
     # Node unavailable or a staging error: fail closed. A gitignored write we
     # cannot stage cannot be captured for review, so keep gating it (today's
-    # behavior) rather than letting unreviewable bytes flow.
+    # behavior) rather than letting unreviewable bytes flow. Kind
+    # "capture-error" and content-free: the staging error means secret
+    # classification may never have run, so the content is UNCLASSIFIED.
+    record_denial "$PRIMARY_TOKEN" "capture-error"
     echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
     exit 0
   fi
@@ -498,17 +555,6 @@ if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   exit 0
 fi
 
-# Append a denial record to the ledger. Best-effort: a ledger write failure must
-# never abort the decision (the deny still goes out on stdout). toolName is raw
-# for human-readable debugging; token drives correlation in the runner; input is
-# base64(JSON(tool_input)) — the authoritative pre-execution args the runner
-# overlays for the approval preview (empty on the grep fallback path). Written
-# with printf (a builtin, so no ARG_MAX limit) because the input can be a large
-# multi-MB file body.
-record_denial() {
-  printf '{"toolName":"%s","token":"%s","input":"%s"}\\n' "$TOOL_NAME" "$1" "$INPUT_B64" >> "$LEDGER_FILE" 2>/dev/null || true
-}
-
 # --- 2. MCP tools (beforeMCPExecution event) ---
 # preToolUse does NOT enforce gating for MCP calls — beforeMCPExecution does — so
 # MCP is gated here and ONLY here (never double-recorded). mcpToolPolicies holds
@@ -529,7 +575,7 @@ if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
       if [ -z "$MSG" ]; then
         MSG="Tool requires approval: $TOOL_NAME"
       fi
-      record_denial "$MCP_TOKEN"
+      record_denial "$MCP_TOKEN" "approval"
       echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"'"$MSG"'"}'
       exit 0
     fi
@@ -570,6 +616,9 @@ if [ -n "$CATEGORY" ]; then
   if [ "$CATEGORY" = "write" ] && [ -n "$SALIENT" ]; then
     SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo ok)
     if [ "$SECRET_RESULT" = "secret" ]; then
+      # Kind "secret": attributable but non-pausing and content-free (DD-26 —
+      # only the identity token is recorded, never the proposed content).
+      record_denial "$PRIMARY_TOKEN" "secret"
       echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written."}'
       exit 0
     fi
@@ -593,11 +642,7 @@ if [ -n "$CATEGORY" ]; then
   fi
   # Record the PRIMARY token (content-exact when available, else coarse) so the
   # runner's denial correlation keys on the SAME identity it grants on approval.
-  if [ -n "$CONTENT_TOKEN" ]; then
-    record_denial "$CONTENT_TOKEN"
-  else
-    record_denial "$TOKEN"
-  fi
+  record_denial "$PRIMARY_TOKEN" "approval"
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0
 fi

package/dist/activities/execute-cursor/hook-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;gDAc8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAiDzC,wBAAwB;iFACmB,wBAAwB;;;;;kDAKvD,4BAA4B;;;;;;kDAM5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDA2C7B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;oDAEtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDA4BhC,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}
+{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAoD8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAiDzC,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDAgC7B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;gDAwBhC,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}