@stigmer/runner 3.1.7 → 3.1.9

package/src/activities/execute-cursor/workspace-setup.ts

@@ -103,6 +103,19 @@ export interface HitlGateHandle {
    * gate is inert between turns.
    */
   gateDir: string;
+  /**
+   * Commands of FOREIGN (non-Stigmer) hooks registered on the gating events
+   * (preToolUse/beforeMCPExecution) in the workspace's pre-existing hooks.json.
+   * The merge deliberately PRESERVES them (they are the user's own config), but
+   * because Cursor runs every configured hook and a deny from ANY of them blocks
+   * the tool, a foreign hook can deny the runner's tools without writing our
+   * denial ledger — the issue #205 silent-failure trigger. Surfaced here so the
+   * runner can log the exposure at install and name the likely culprit when the
+   * turn boundary detects an unattributed hook block. Empty when the workspace
+   * had no hooks.json, only Stigmer entries, or an unparseable file (which is
+   * REPLACED for the turn, so its hooks cannot run against us).
+   */
+  foreignGatingHooks: readonly string[];
 }
 
 /** Absolute path + restore target for a single workspace file the gate manages. */
@@ -334,12 +347,12 @@ async function installWorkspaceHook(
     originalRaw = null;
   }
 
-  const { merged, restoreTo } = buildMergedConfig(originalRaw, registrations);
+  const { merged, restoreTo, foreignGatingHooks } = buildMergedConfig(originalRaw, registrations);
 
   await mkdir(cursorDir, { recursive: true });
   await writeFile(hooksJsonPath, merged, "utf-8");
 
-  return { hooksJsonPath, restoreTo };
+  return { hooksJsonPath, restoreTo, foreignGatingHooks };
 }
 
 /**
@@ -406,21 +419,35 @@ const STANDALONE_CONFIG = (registrations: HookRegistration[]): string =>
 /**
  * Merge our registrations into a hooks object: for each event, drop any stale
  * Stigmer entry, then append our fresh one. Returns the merged hooks object, the
- * cleaned (Stigmer-free) hooks for restore, and whether anything was stripped.
+ * cleaned (Stigmer-free) hooks for restore, whether anything was stripped, and
+ * the FOREIGN commands preserved on the gating events (see
+ * {@link HitlGateHandle.foreignGatingHooks} for why they matter).
  */
 function mergeHooks(
   existingHooks: Record<string, unknown>,
   registrations: HookRegistration[],
-): { hooks: Record<string, unknown>; cleaned: Record<string, unknown>; strippedStale: boolean } {
+): {
+  hooks: Record<string, unknown>;
+  cleaned: Record<string, unknown>;
+  strippedStale: boolean;
+  foreignGatingHooks: string[];
+} {
   const hooks: Record<string, unknown> = { ...existingHooks };
   const cleaned: Record<string, unknown> = { ...existingHooks };
   let strippedStale = false;
+  const foreignGatingHooks: string[] = [];
 
   for (const { event, scriptPath } of registrations) {
     const hadEvent = Array.isArray(existingHooks[event]);
     const existing = hadEvent ? (existingHooks[event] as unknown[]) : [];
     const userEntries = existing.filter((e) => !isStigmerHookEntry(e));
     if (userEntries.length !== existing.length) strippedStale = true;
+    // The user entries surviving on a GATING event are exactly the hooks that
+    // can deny the runner's tools without touching our denial ledger.
+    for (const entry of userEntries) {
+      const command = (entry as { command?: unknown } | null)?.command;
+      if (typeof command === "string" && command) foreignGatingHooks.push(command);
+    }
 
     hooks[event] = [...userEntries, buildHookEntry(scriptPath)];
     // Restore target keeps the event key only if the user originally had it, so
@@ -428,12 +455,12 @@ function mergeHooks(
     if (hadEvent) cleaned[event] = userEntries;
   }
 
-  return { hooks, cleaned, strippedStale };
+  return { hooks, cleaned, strippedStale, foreignGatingHooks };
 }
 
 /**
- * Compute the merged hooks.json to write for this turn and the content to
- * restore afterward.
+ * Compute the merged hooks.json to write for this turn, the content to restore
+ * afterward, and the foreign gating hooks the merge preserved.
  *
  * - No existing file → write our standalone config; restore by deleting (null).
  * - Existing, parseable file → append our entry to each registered event array,
@@ -448,19 +475,19 @@ function mergeHooks(
 export function buildMergedConfig(
   originalRaw: string | null,
   registrations: HookRegistration[],
-): { merged: string; restoreTo: string | null } {
+): { merged: string; restoreTo: string | null; foreignGatingHooks: string[] } {
   if (originalRaw === null) {
-    return { merged: STANDALONE_CONFIG(registrations), restoreTo: null };
+    return { merged: STANDALONE_CONFIG(registrations), restoreTo: null, foreignGatingHooks: [] };
   }
 
   let parsed: unknown;
   try {
     parsed = JSON.parse(originalRaw);
   } catch {
-    return { merged: STANDALONE_CONFIG(registrations), restoreTo: originalRaw };
+    return { merged: STANDALONE_CONFIG(registrations), restoreTo: originalRaw, foreignGatingHooks: [] };
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { merged: STANDALONE_CONFIG(registrations), restoreTo: originalRaw };
+    return { merged: STANDALONE_CONFIG(registrations), restoreTo: originalRaw, foreignGatingHooks: [] };
   }
 
   const root = parsed as Record<string, unknown>;
@@ -470,13 +497,14 @@ export function buildMergedConfig(
       : {};
   const version = typeof root.version === "number" ? root.version : 1;
 
-  const { hooks: mergedHooks, cleaned, strippedStale } = mergeHooks(hooks, registrations);
+  const { hooks: mergedHooks, cleaned, strippedStale, foreignGatingHooks } =
+    mergeHooks(hooks, registrations);
 
   const merged = JSON.stringify({ ...root, version, hooks: mergedHooks }, null, 2);
 
   // No stale Stigmer entry → restore the user's exact original bytes.
   if (!strippedStale) {
-    return { merged, restoreTo: originalRaw };
+    return { merged, restoreTo: originalRaw, foreignGatingHooks };
   }
 
   // We stripped a stale Stigmer entry, so never restore the original bytes (that
@@ -495,5 +523,5 @@ export function buildMergedConfig(
     ? null
     : JSON.stringify({ ...root, version, hooks: cleaned }, null, 2);
 
-  return { merged, restoreTo };
+  return { merged, restoreTo, foreignGatingHooks };
 }

package/src/activities/execute-deep-agent/__tests__/environment.test.ts

@@ -3,12 +3,15 @@ import { resolveEnvironment } from "../environment.js";
 
 function createMockClient(execContext: any) {
   return {
+    // No scoped token — the OSS/local shape (no runner credential to exchange).
+    acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
     getExecutionContextByExecutionId: vi.fn().mockResolvedValue(execContext),
   } as any;
 }
 
 function createNotFoundClient() {
   return {
+    acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
     getExecutionContextByExecutionId: vi.fn().mockRejectedValue(
       Object.assign(new Error("not found"), { code: 5 }),
     ),
@@ -81,6 +84,7 @@ describe("resolveEnvironment", () => {
 
   it("propagates non-NOT_FOUND errors", async () => {
     const client = {
+      acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
       getExecutionContextByExecutionId: vi.fn().mockRejectedValue(
         new Error("connection refused"),
       ),
@@ -92,6 +96,7 @@ describe("resolveEnvironment", () => {
 
   it("handles NOT_FOUND with lowercase code", async () => {
     const client = {
+      acquireScopedRunnerToken: vi.fn().mockResolvedValue(undefined),
       getExecutionContextByExecutionId: vi.fn().mockRejectedValue(
         Object.assign(new Error("not found"), { code: "not_found" }),
       ),

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -0,0 +1,314 @@
+/**
+ * REJECT semantics across both checkpointers (issue #197).
+ *
+ * These tests exercise the full ExecuteDeepAgent activity on the post-decision
+ * re-invocation after a user REJECTS a gated tool call, under BOTH the durable
+ * (http, cloud) and ephemeral (memory, OSS/desktop) checkpointers.
+ *
+ * The contract (deny-tool-and-continue): a rejected tool is NOT executed, the
+ * user's objection is fed back to the model, and the execution CONTINUES to
+ * EXECUTION_COMPLETED — identically on both checkpointers. The rejected tool
+ * call is terminalized (never left stuck at WAITING_APPROVAL) with
+ * approval_action=REJECT recorded for audit.
+ *
+ * Modeled on hitl-resume-history.test.ts (http) and sequential-gate-resume.test.ts
+ * (memory): performSetup + the agent graph are mocked so the assertions isolate
+ * the activity's resume orchestration and status reconciliation.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
+import { create, clone } from "@bufbuild/protobuf";
+import {
+  AgentExecutionStatusSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  ApprovalAction,
+  ExecutionPhase,
+  MessageType,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { V3ProtocolEvent } from "../v3-event-recorder.js";
+import type { Config } from "../../../config.js";
+import type { SetupResult } from "../setup.js";
+
+vi.mock("@temporalio/activity", () => ({
+  Context: {
+    current: () => ({
+      cancellationSignal: new AbortController().signal,
+      heartbeat: vi.fn(),
+    }),
+  },
+  CancelledFailure: class CancelledFailure extends Error {},
+}));
+
+vi.mock("../../../idle-watchdog.js", () => ({
+  activityStarted: vi.fn(),
+  activityFinished: vi.fn(),
+}));
+
+const { persistedStatuses } = vi.hoisted(() => ({
+  persistedStatuses: [] as AgentExecutionStatus[],
+}));
+
+vi.mock("../../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(() => ({
+    updateStatus: vi.fn(async (_id: string, status: AgentExecutionStatus) => {
+      persistedStatuses.push(clone(AgentExecutionStatusSchema, status));
+      return { signal: 0 };
+    }),
+    getExecution: vi.fn(),
+  })),
+}));
+
+vi.mock("../setup.js", () => ({ performSetup: vi.fn() }));
+
+import { createDeepAgentActivities } from "../index.js";
+import { performSetup } from "../setup.js";
+
+const GATED_TOOL_CALL_ID = "toolu_reject_01";
+const PRE_AI_TEXT = "I'll call the echo tool.";
+const POST_AI_TEXT = "Understood — I'll proceed without that tool.";
+const REJECT_COMMENT = "not this time";
+
+function v3Event(seq: number, method: string, data: unknown, namespace: string[] = []): V3ProtocolEvent {
+  return { type: "event", seq, method, params: { namespace, timestamp: Date.now(), data } };
+}
+
+/**
+ * A rejected tool does NOT execute, so the resumed stream carries only the
+ * model's follow-up assistant turn reacting to the rejection — no
+ * tool-started / tool-finished for the gated call.
+ */
+function postRejectAssistantTurn(): V3ProtocolEvent[] {
+  return [
+    v3Event(0, "messages", { event: "message-start", run_id: "r2" }),
+    v3Event(1, "messages", {
+      event: "content-block-delta",
+      index: 0,
+      delta: { type: "text-delta", text: POST_AI_TEXT },
+      run_id: "r2",
+    }),
+    v3Event(2, "messages", { event: "message-finish", run_id: "r2" }),
+  ];
+}
+
+function mockV3Run(events: V3ProtocolEvent[]) {
+  return {
+    [Symbol.asyncIterator]: async function* () {
+      for (const e of events) yield e;
+    },
+    output: Promise.resolve({ messages: [] }),
+    abort: vi.fn(),
+    signal: new AbortController().signal,
+  };
+}
+
+/** Run-1 transcript with the gated call carrying the user's REJECT decision. */
+function persistedRejectedStatus(): AgentExecutionStatus {
+  return create(AgentExecutionStatusSchema, {
+    phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    startedAt: "2026-06-15T00:00:00.000Z",
+    messages: [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        content: PRE_AI_TEXT,
+        timestamp: "2026-06-15T00:00:01.000Z",
+        toolCalls: [
+          create(ToolCallSchema, {
+            id: GATED_TOOL_CALL_ID,
+            name: "echo",
+            status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+            requiresApproval: true,
+            approvalMessage: "Execute echo tool",
+            approvalAction: ApprovalAction.REJECT,
+            mcpServerSlug: "test-mcp",
+          }),
+        ],
+      }),
+    ],
+  });
+}
+
+const approvalPolicies = new Map([
+  ["test-mcp/echo", {
+    toolName: "echo",
+    mcpServerSlug: "test-mcp",
+    requiresApproval: true,
+    approvalMessage: "Execute echo tool",
+  }],
+]);
+
+/** Durable (http) resume: getState reports a pending interrupt, then resolves. */
+function fakeHttpRejectSetup(): SetupResult {
+  let streamed = false;
+  const pendingInterruptState = {
+    values: { messages: [{ role: "assistant", content: PRE_AI_TEXT }] },
+    tasks: [{
+      id: "task-1",
+      interrupts: [{
+        value: {
+          tool_call_id: GATED_TOOL_CALL_ID,
+          tool_name: "echo",
+          mcp_server_slug: "test-mcp",
+          message: "Execute echo tool",
+        },
+        resumeValue: undefined,
+      }],
+    }],
+  };
+  const resolvedState = { values: { messages: [{ role: "assistant", content: PRE_AI_TEXT }] }, tasks: [] };
+
+  const agentGraph = {
+    getState: vi.fn(async () => (streamed ? resolvedState : pendingInterruptState)),
+    streamEvents: vi.fn(async () => {
+      streamed = true;
+      return mockV3Run(postRejectAssistantTurn());
+    }),
+  };
+
+  return {
+    agentGraph,
+    langgraphConfig: { configurable: { thread_id: "thread-reject-http" } },
+    langgraphInput: { messages: [{ role: "user", content: "Call echo" }] },
+    execution: {
+      spec: { message: "Call echo with 'hello'." },
+      status: persistedRejectedStatus(),
+    },
+    agent: {},
+    session: { spec: { workspaceEntries: [] } },
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-http" },
+    mcpConnection: null,
+    mergedEnvVars: {},
+    secretKeys: new Set<string>(),
+    modelName: "claude-sonnet",
+    gracefulStop: undefined,
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
+    provisionResults: [],
+    approvalPolicies,
+    toolServerMap: new Map([["echo", "test-mcp"]]),
+    leasedCategories: new Set(),
+    globalBypass: false,
+    hasStructuredOutput: false,
+    streamVersion: "v3",
+  } as unknown as SetupResult;
+}
+
+/** Memory resume: empty live checkpoint (replay), stream completes with a turn. */
+function fakeMemoryRejectSetup(): SetupResult {
+  const emptyState = { values: { messages: [] as unknown[] }, tasks: [] };
+  const agentGraph = {
+    getState: vi.fn(async () => emptyState),
+    streamEvents: vi.fn(async () => mockV3Run(postRejectAssistantTurn())),
+  };
+
+  return {
+    agentGraph,
+    langgraphConfig: { configurable: { thread_id: "thread-reject-mem" } },
+    langgraphInput: { messages: [{ role: "user", content: "Call echo" }] },
+    execution: {
+      spec: { message: "Call echo with 'hello'." },
+      status: persistedRejectedStatus(),
+    },
+    agent: {},
+    session: { spec: { workspaceEntries: [] } },
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-mem" },
+    mcpConnection: null,
+    mergedEnvVars: {},
+    secretKeys: new Set<string>(),
+    modelName: "claude-sonnet",
+    gracefulStop: undefined,
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
+    provisionResults: [],
+    approvalPolicies,
+    toolServerMap: new Map([["echo", "test-mcp"]]),
+    leasedCategories: new Set(),
+    globalBypass: false,
+    hasStructuredOutput: false,
+    streamVersion: "v3",
+  } as unknown as SetupResult;
+}
+
+const httpConfig: Config = {
+  taskQueue: "test-queue",
+  temporalAddress: "localhost:7233",
+  temporalNamespace: "default",
+  stigmerBackendEndpoint: "http://localhost:7234",
+  stigmerToken: null,
+  cursorApiKey: "",
+  workspaceRootDir: "/tmp/test",
+  mode: "cloud",
+  proxyEndpoint: "http://localhost:7234",
+  maxConcurrentActivities: 5,
+  idleTimeoutSeconds: null,
+  cloudModeEnabled: true,
+  checkpointerType: "http",
+  checkpointerProxyEndpoint: "http://localhost:7234",
+  primaryModel: "claude-sonnet",
+  cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
+};
+
+const memoryConfig: Config = {
+  ...httpConfig,
+  mode: "local",
+  proxyEndpoint: null,
+  cloudModeEnabled: false,
+  checkpointerType: "memory",
+  checkpointerProxyEndpoint: null,
+};
+
+function gatedToolCall(status: AgentExecutionStatus) {
+  return status.messages.flatMap(m => m.toolCalls).find(tc => tc.id === GATED_TOOL_CALL_ID);
+}
+
+describe("ExecuteDeepAgent — REJECT continues the execution (issue #197)", () => {
+  beforeEach(() => {
+    persistedStatuses.length = 0;
+  });
+
+  it("http checkpointer: reject denies the tool and the execution COMPLETES", async () => {
+    vi.mocked(performSetup).mockResolvedValue(fakeHttpRejectSetup());
+    const activities = createDeepAgentActivities(httpConfig);
+    await activities.ExecuteDeepAgent("exec-reject-http", "thread-reject-http");
+
+    const final = persistedStatuses.at(-1)!;
+    expect(final.phase, "rejected execution continues to COMPLETED").toBe(
+      ExecutionPhase.EXECUTION_COMPLETED,
+    );
+
+    const tc = gatedToolCall(final);
+    expect(tc, "the gated tool call is present").toBeDefined();
+    expect(
+      tc!.status,
+      "rejected tool call is terminalized (SKIPPED), never stuck at WAITING_APPROVAL",
+    ).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc!.approvalAction, "the REJECT decision is preserved for audit").toBe(
+      ApprovalAction.REJECT,
+    );
+  });
+
+  it("memory checkpointer: reject denies the tool and the execution COMPLETES", async () => {
+    vi.mocked(performSetup).mockResolvedValue(fakeMemoryRejectSetup());
+    const activities = createDeepAgentActivities(memoryConfig);
+    await activities.ExecuteDeepAgent("exec-reject-mem", "thread-reject-mem");
+
+    const final = persistedStatuses.at(-1)!;
+    expect(final.phase, "rejected execution continues to COMPLETED on memory too").toBe(
+      ExecutionPhase.EXECUTION_COMPLETED,
+    );
+
+    const tc = gatedToolCall(final);
+    expect(tc, "the gated tool call is present").toBeDefined();
+    expect(
+      tc!.status,
+      "rejected tool call is terminalized identically on memory",
+    ).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc!.approvalAction).toBe(ApprovalAction.REJECT);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl.test.ts

@@ -1,13 +1,12 @@
 import { describe, it, expect } from "vitest";
 import { Command } from "@langchain/langgraph";
-import { resolveResumeInput, reconcileToolCallStatuses } from "../hitl.js";
+import { resolveResumeInput, reconcileNonExecutingDecisions } from "../hitl.js";
 import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { create } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
   ToolCallSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import type { ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
@@ -78,7 +77,6 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(false);
-    expect(result.hasRejection).toBe(false);
     expect(result.graphInput).toEqual({
       messages: [{ role: "user", content: "hello" }],
     });
@@ -105,11 +103,10 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(false);
     expect(result.graphInput).toBeInstanceOf(Command);
   });
 
-  it("detects rejection when a decision is REJECT", () => {
+  it("builds a resume Command for a REJECT decision (denies the tool, does not fail the run)", () => {
     const execution = makeExecution([{
       id: "call-1",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
@@ -120,9 +117,12 @@ describe("resolveResumeInput", () => {
 
     const result = resolveResumeInput(execution, state, "hello");
 
+    // REJECT resumes the gate like any other decision — the gate returns a
+    // denial ToolMessage and the run continues. There is no execution-level
+    // "rejection" flag any more; the terminal tool status is set by
+    // reconcileNonExecutingDecisions.
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(true);
-    expect(result.rejectionReason).toContain("Rejected by user");
+    expect(result.graphInput).toBeInstanceOf(Command);
   });
 
   it("handles multiple interrupts with mixed decisions", () => {
@@ -147,7 +147,6 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(false);
   });
 
   it("skips already-resumed interrupts", () => {
@@ -167,56 +166,75 @@ describe("resolveResumeInput", () => {
   });
 });
 
-describe("reconcileToolCallStatuses", () => {
-  it("updates APPROVE to RUNNING", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-1",
-      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+describe("reconcileNonExecutingDecisions", () => {
+  function statusWith(
+    toolCalls: Array<{ id: string; status: ToolCallStatus; approvalAction: ApprovalAction }>,
+  ) {
+    return create(AgentExecutionStatusSchema, {
+      messages: [
+        create(AgentMessageSchema, {
+          toolCalls: toolCalls.map(tc =>
+            create(ToolCallSchema, {
+              id: tc.id,
+              name: "test_tool",
+              status: tc.status,
+              approvalAction: tc.approvalAction,
+            }),
+          ),
+        }),
+      ],
     });
-    const toolCalls = new Map<string, ToolCall>([["call-1", tc]]);
-    const decisions = new Map([
-      ["call-1", { action: ApprovalAction.APPROVE, comment: "" }],
-    ]);
-
-    reconcileToolCallStatuses(toolCalls, decisions);
-    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);
-  });
+  }
 
-  it("updates SKIP to SKIPPED", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-2",
+  it("terminalizes a REJECT decision to SKIPPED with a reason (does not FAIL)", () => {
+    const status = statusWith([{
+      id: "call-reject",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
-    });
-    const toolCalls = new Map<string, ToolCall>([["call-2", tc]]);
-    const decisions = new Map([
-      ["call-2", { action: ApprovalAction.SKIP, comment: "" }],
-    ]);
+      approvalAction: ApprovalAction.REJECT,
+    }]);
+
+    reconcileNonExecutingDecisions(status);
 
-    reconcileToolCallStatuses(toolCalls, decisions);
+    const tc = status.messages[0].toolCalls[0];
     expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.error).toContain("Rejected by user");
+    // The REJECT decision is preserved so the audit trail stays honest.
+    expect(tc.approvalAction).toBe(ApprovalAction.REJECT);
   });
 
-  it("updates REJECT to FAILED with error message", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-3",
+  it("terminalizes a SKIP decision to SKIPPED (fixes the stuck-WAITING for skip too)", () => {
+    const status = statusWith([{
+      id: "call-skip",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
-    });
-    const toolCalls = new Map<string, ToolCall>([["call-3", tc]]);
-    const decisions = new Map([
-      ["call-3", { action: ApprovalAction.REJECT, comment: "too risky" }],
-    ]);
+      approvalAction: ApprovalAction.SKIP,
+    }]);
 
-    reconcileToolCallStatuses(toolCalls, decisions);
-    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
-    expect(tc.error).toContain("too risky");
+    reconcileNonExecutingDecisions(status);
+
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
   });
 
-  it("ignores tool calls not in the map", () => {
-    const toolCalls = new Map<string, ToolCall>();
-    const decisions = new Map([
-      ["call-missing", { action: ApprovalAction.APPROVE, comment: "" }],
+  it("leaves APPROVE / APPROVE_ALL untouched (the tool executes)", () => {
+    const status = statusWith([
+      { id: "call-approve", status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL, approvalAction: ApprovalAction.APPROVE },
+      { id: "call-approve-all", status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL, approvalAction: ApprovalAction.APPROVE_ALL },
     ]);
 
-    expect(() => reconcileToolCallStatuses(toolCalls, decisions)).not.toThrow();
+    reconcileNonExecutingDecisions(status);
+
+    // Still WAITING — real tool events (not this reconciler) terminalize them.
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(status.messages[0].toolCalls[1].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+
+  it("is a no-op when there are no decided tool calls", () => {
+    const status = statusWith([{
+      id: "call-pending",
+      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+      approvalAction: ApprovalAction.UNSPECIFIED,
+    }]);
+
+    expect(() => reconcileNonExecutingDecisions(status)).not.toThrow();
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });

package/src/activities/execute-deep-agent/environment.ts

@@ -28,9 +28,16 @@ export async function resolveEnvironment(
   client: StigmerClient,
   executionId: string,
 ): Promise<EnvironmentResult> {
+  // A desktop runner exchanges its bootstrap credential for a token scoped to
+  // this execution's session, so cloud's decrypt gate binds the read (#156).
+  // No-op for cloud sandbox and OSS runners.
+  const scopedToken = await client.acquireScopedRunnerToken({
+    agentExecutionId: executionId,
+  });
+
   let execCtx;
   try {
-    execCtx = await client.getExecutionContextByExecutionId(executionId);
+    execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
   } catch (err: unknown) {
     // ConnectError uses numeric Code.NotFound (5); match the pattern
     // from execute-cursor/env-resolver.ts.