@stigmer/runner 3.10.0 → 3.11.0

package/src/activities/execute-cursor/hook-script.ts

@@ -32,6 +32,8 @@
  *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
  *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
  *   - "fail-closed"   — approval state file missing, everything gated denies.
+ *   - "disabled"      — enabled_tools manifest exclusion (issue #350): the
+ *                       agent continues, no pause, permanent for the run.
  * Only approval-kind records carry the captured tool_input: a secret write's
  * content must never be persisted (DD-26), a capture-error's content is
  * UNCLASSIFIED (the staging error means secret classification may never have
@@ -84,8 +86,16 @@
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
- *    spec.auto_approve_all global bypass) → allow
+ * 1. Missing state file → deny (fail-closed)
+ * 1a. beforeMCPExecution event → tool excluded by the server's
+ *     mcpServerEnabledTools allow-list → record kind "disabled", deny.
+ *     Deliberately BEFORE autoApproveAll and the grant checks: enabled_tools
+ *     is a capability manifest, not an approval gate (issue #350) — no bypass
+ *     may resurrect a disabled tool, and no human may be offered "approve" on
+ *     one. Server-scoped via the payload's mcp_server_name; an absent slug in
+ *     the map means unrestricted.
+ * 1b. autoApproveAll (the pre-armed spec.auto_approve_all global bypass) →
+ *     allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
@@ -155,6 +165,23 @@ const SECRET_BLOCKED_AGENT_MESSAGE =
   "hooks. Do not retry this write or attempt a workaround; the write will not be " +
   "applied. Continue with the rest of the task.";
 
+// Shown to the model when an MCP tool call is denied because the agent's
+// enabled_tools manifest excludes the tool (issue #350). Like
+// SECRET_BLOCKED_AGENT_MESSAGE this must NOT promise a resume — the exclusion
+// is permanent for the run and mode-independent (it is a capability manifest,
+// not an approval, so nothing can be granted). Same embedding constraint
+// (single-quoted bash echo of a JSON object): no double quotes, apostrophes,
+// or backslashes.
+const DISABLED_TOOL_AGENT_MESSAGE =
+  "This tool is not enabled for this agent: the MCP server exposes it, but the " +
+  "agent manifest (enabled_tools) excludes it. This is the platform capability " +
+  "manifest working as intended — it is not an error and not a Cursor " +
+  "misconfiguration, so never tell the user to change Cursor settings or enable " +
+  "hooks. Do not retry this tool or attempt a workaround; it will stay " +
+  "unavailable for this entire run. Use a different tool or adapt your plan, " +
+  "and if the task cannot proceed without it, tell the user plainly what was " +
+  "unavailable.";
+
 /**
  * Build the bash `case` arms that map an incoming hook `tool_name` to its
  * canonical approval category. Generated from approval-policy.ts so the hook and
@@ -209,14 +236,17 @@ function buildContentDigestScript(): string {
  * Build the inline Node.js identity extractor embedded in the hook script.
  *
  * Parses the hook's stdin JSON properly (the bash fallback's grep truncates
- * string values at the first escaped quote) and emits SEVEN lines: tool_name,
+ * string values at the first escaped quote) and emits NINE lines: tool_name,
  * canonical category, coarse identity token, MCP name-token, hook_event_name
  * (the event discriminator: `preToolUse` for built-ins, `beforeMCPExecution`
  * for MCP), base64(JSON(tool_input)) — the authoritative pre-execution args the
- * runner overlays onto the gated tool call for the approval preview — and the
+ * runner overlays onto the gated tool call for the approval preview — the
  * CONTENT token (base64(category \n salient \n contentDigest), empty when the
- * tool has no edit content). The token encodings must stay byte-identical to
- * grantToken()/contentToken() in approval-state.ts.
+ * tool has no edit content), base64(salient), and mcp_server_name (the MCP
+ * server slug the beforeMCPExecution payload carries; empty for built-ins) —
+ * the server scope for the enabled_tools manifest arm. The token encodings
+ * must stay byte-identical to grantToken()/contentToken() in
+ * approval-state.ts.
  *
  * Authored as a single-quoted bash string, so the JS must not contain single
  * quotes. The category map, salient field list, and edit/content field lists are
@@ -247,6 +277,7 @@ function buildNodeIdentityScript(): string {
     // is "" for a non-edit tool, in which case the content token (line 7) is "".
     buildContentDigestScript(),
     `const ev=typeof t.hook_event_name==="string"?t.hook_event_name:"";`,
+    `const srv=typeof t.mcp_server_name==="string"?t.mcp_server_name:"";`,
     // Line 6 is base64(JSON(tool_input)): the AUTHORITATIVE pre-execution args
     // the runner overlays onto the gated tool call so the approval card can show
     // the proposed change before the user approves. Base64 keeps the bash side
@@ -255,8 +286,10 @@ function buildNodeIdentityScript(): string {
     // grant the runner authorizes for a file edit. Line 8 is base64(salient) —
     // the raw resource value (file path / command) capture mode needs to run
     // `git check-ignore` on a file path; base64 keeps newlines/quotes out of the
-    // line-oriented bash parse.
-    `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s));`,
+    // line-oriented bash parse. Line 9 is mcp_server_name — the server scope
+    // the enabled_tools manifest arm matches against mcpServerEnabledTools
+    // (a bare slug, never quoted/escaped, so it rides as a plain line).
+    `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s)+"\\n"+srv);`,
   ].join("");
 }
 
@@ -279,7 +312,8 @@ function buildNodeIdentityScript(): string {
  *
  * From the pointer the script reads the current turn's approval-state file (the
  * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
- * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * mcpToolPolicies, mcpServerEnabledTools, approvedGrantTokens), denial ledger,
+ * and runner PID. The
  * static policy (which built-ins are gated, their categories, the salient arg
  * fields) is baked at generation time from approval-policy.ts.
  *
@@ -440,6 +474,9 @@ if [ -n "$IDENTITY" ]; then
   # Raw salient (base64) — the file path / command. Capture mode decodes it to
   # run git check-ignore on a file path.
   SALIENT=$(printf '%s\\n' "$IDENTITY" | sed -n 8p | base64 -d 2>/dev/null || true)
+  # MCP server slug (beforeMCPExecution payloads only; empty for built-ins) —
+  # the server scope for the enabled_tools manifest arm.
+  MCP_SERVER=$(printf '%s\\n' "$IDENTITY" | sed -n 9p)
 else
   # Fallback when the Node binary cannot run: grep/cut extraction. Best-effort
   # only — '"field":"[^"]*"' truncates at the first JSON-escaped quote, so the
@@ -449,6 +486,10 @@ else
   # would otherwise abort the script and emit no decision.
   TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   HOOK_EVENT=$(echo "$INPUT" | grep -o '"hook_event_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
+  # Server slugs are plain identifiers (no JSON-escaped quotes), so the grep
+  # fallback extracts mcp_server_name reliably — the manifest arm keeps its
+  # full precision even without the Node binary.
+  MCP_SERVER=$(echo "$INPUT" | grep -o '"mcp_server_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   SALIENT=""
   for field in ${salientFields}; do
     v=$(echo "$INPUT" | grep -o "\\"$field\\":\\"[^\\"]*\\"" | head -1 | cut -d'"' -f4 || true)
@@ -588,7 +629,30 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
   fi
 fi
 
-# --- 1. Auto-approve all ---
+# --- 1a. MCP capability manifest: enabled_tools (issue #350) ---
+# Runs BEFORE the auto-approve-all shortcut and every grant check because
+# enabled_tools is a capability manifest, not an approval gate: no bypass may
+# resurrect a disabled tool and no human may be offered approval on one.
+# mcpServerEnabledTools holds ONLY restricted servers (an absent slug means
+# unrestricted, so this arm is inert for the common case). Matching is
+# server-scoped via the payload's mcp_server_name — equal tool names on
+# different servers cannot cross-grant — and the quoted-name membership check
+# is exact, never a substring match. Kind "disabled": attributable,
+# non-pausing (the model adapts, same consumer semantics as "secret"), and
+# permanent for the run.
+if [ "$HOOK_EVENT" = "beforeMCPExecution" ] && [ -n "$MCP_SERVER" ] && [ -n "$TOOL_NAME" ]; then
+  ENABLED_MAP=$(echo "$STATE" | grep -o '"mcpServerEnabledTools":{[^}]*}' | head -1 || true)
+  if [ -n "$ENABLED_MAP" ]; then
+    SERVER_ENABLED=$(echo "$ENABLED_MAP" | grep -o "\\"$MCP_SERVER\\":\\[[^]]*\\]" | head -1 || true)
+    if [ -n "$SERVER_ENABLED" ] && ! echo "$SERVER_ENABLED" | grep -qF "\\"$TOOL_NAME\\""; then
+      record_denial "$MCP_TOKEN" "disabled"
+      echo '{"permission":"deny","agent_message":"${DISABLED_TOOL_AGENT_MESSAGE}","user_message":"Tool not enabled for this agent: '"$TOOL_NAME"'"}'
+      exit 0
+    fi
+  fi
+fi
+
+# --- 1b. Auto-approve all ---
 if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   echo '{"permission":"allow"}'
   exit 0

package/src/activities/execute-cursor/index.ts

@@ -84,6 +84,7 @@ import {
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
+import { enabledToolsBySlug } from "../../shared/mcp-enabled-tools.js";
 import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
@@ -139,7 +140,7 @@ import { StreamingUsageSummarySchema } from "@stigmer/protos/ai/stigmer/agentic/
 import { activityStarted, activityFinished } from "../../idle-watchdog.js";
 import { normalizeActivityInput, type ExecuteActivityInput } from "../../shared/activity-input.js";
 import { getCapturedRejection, clearCapturedRejection } from "./rejection-capture.js";
-import { synthesizeError, formatClassifiedError, shouldRetryWithFreshAgent } from "./error-classifier.js";
+import { synthesizeError, formatClassifiedError, shouldRetryWithFreshAgent, extractRunErrorSources } from "./error-classifier.js";
 import type { ClassifiedError } from "./error-classifier.js";
 import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
@@ -644,9 +645,21 @@ async function executeCursorInner(
     // the messaging reach; undefined lets a cloud sandbox runner's
     // ambient session-scoped token or OSS's no-auth apply). The
     // attachment header falls back to the ambient credential where no
-    // exchange happens.
-    const exchangedRunnerToken =
-      await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
+    // exchange happens. Unlike the env read (which hard-fails on a broken
+    // exchange — secrets are load-bearing there), this exchange is
+    // opportunistic: every consumer below degrades to an empty answer by
+    // contract, and the server refuses the ambient fallback safely, so a
+    // failed exchange must not kill the run.
+    let exchangedRunnerToken: string | undefined;
+    try {
+      exchangedRunnerToken =
+        await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
+    } catch (err) {
+      console.warn(
+        "[execute-cursor] Scoped-token exchange failed for attachment/discovery " +
+        `reads; degrading to the ambient credential: ${err instanceof Error ? err.message : err}`,
+      );
+    }
     const attachmentCredential = exchangedRunnerToken
       ?? config.stigmerTokenRef?.current
       ?? config.stigmerToken;
@@ -734,11 +747,11 @@ async function executeCursorInner(
     // them as auto-approved); the global bypass empties the map entirely.
     const leases = deriveActiveLeases(execution);
     const globalBypass = leases.global;
-    const agentOverrides = blueprint.mergedMcpServerUsages
-      .flatMap((u) => u.toolApprovalOverrides ?? []);
+    // Layer-3 overrides ride each resolved server from its merged usage —
+    // see ResolvedMcpServer.toolApprovalOverrides (issue #349) — so there
+    // is no separate override input to pass here.
     const mergedPolicies = mergeApprovalPolicies(
       mcpResolution.resolvedServers,
-      agentOverrides,
       leases,
     );
     heartbeat();
@@ -785,7 +798,10 @@ async function executeCursorInner(
       storage: artifactStorage,
       visionBudget,
     });
-    const attachmentPaths = attachmentResults.map((a) => a.relativePath);
+    const attachmentEntries = attachmentResults.map((a) => ({
+      path: a.relativePath,
+      ...(a.renamedFrom !== undefined ? { renamedFrom: a.renamedFrom } : {}),
+    }));
     // Vision facts, derived once from the single resolution result: the
     // images the model will see inline (in attachment order) and the ones
     // that degraded to path-only, disclosed in the prompt.
@@ -906,6 +922,11 @@ async function executeCursorInner(
       captureIgnored,
       gitWorkspace,
       isUnattendedApprovalMode(execution),
+      // The enabled_tools capability manifest (issue #350): restricted
+      // servers' allow-lists, enforced by the hook's "disabled" arm ahead of
+      // every approval bypass. The Cursor SDK config cannot hide a server's
+      // tools, so this deny-at-call is the harness's enforcement.
+      enabledToolsBySlug(mcpResolution.resolvedServers),
     );
     const hitlGate = await installHitlGate({
       workspaceRoot: primaryWorkspaceDir,
@@ -1130,7 +1151,7 @@ async function executeCursorInner(
       subAgents: blueprint.subAgents,
       workspaceDirs: blueprint.workspaceDirs,
       workspaceFileRefs: spec.workspaceFileRefs ?? [],
-      attachmentPaths,
+      attachments: attachmentEntries,
       vision: visionPromptInfo,
       pendingApprovals: adjudicatedApprovals,
       appliedToolCallIds,
@@ -1721,12 +1742,10 @@ async function executeCursorInner(
         status.phase = ExecutionPhase.EXECUTION_COMPLETED;
         break;
       case "error": {
-        const resultAny = result as unknown as Record<string, unknown>;
-        const sdkError = result.result
-          ?? resultAny.error
-          ?? resultAny.message
-          ?? resultAny.reason;
-        const sdkErrorStr = sdkError ? String(sdkError) : undefined;
+        // Shape-aware extraction, NOT String(): the result's error fields are
+        // structured at runtime often enough that a bare coercion showed users
+        // "[object Object]" and shadowed every fallback source below (oss#299).
+        const runErrorSources = extractRunErrorSources(result);
 
         // The SDK frequently resolves run.wait() to a bare { status: "error" }
         // while the real reason (e.g. the original grpc-status 12 routing
@@ -1738,7 +1757,8 @@ async function executeCursorInner(
         if (capturedRejection) clearCapturedRejection(executionId);
 
         const classified = synthesizeError({
-          sdkResultFields: sdkErrorStr,
+          sdkError: runErrorSources.sdkError,
+          sdkResultFields: runErrorSources.sdkResultFields,
           streamErrorMessage: turnState.streamErrorMessage,
           capturedRejection,
           conversationErrorText,
@@ -1789,7 +1809,7 @@ async function executeCursorInner(
             subAgents: blueprint.subAgents,
             workspaceDirs: blueprint.workspaceDirs,
             workspaceFileRefs: spec.workspaceFileRefs ?? [],
-            attachmentPaths,
+            attachments: attachmentEntries,
             vision: visionPromptInfo,
             pendingApprovals: adjudicatedApprovals,
             interactionMode,
@@ -1856,8 +1876,14 @@ async function executeCursorInner(
 
           const retryConversationErrorText = await introspectConversation(retryRun, executionId);
 
+          // Same shape-aware extraction as the primary error arm — the retry
+          // previously String()-coerced result.result alone, so a structured
+          // retry failure both read "[object Object]" and ignored the
+          // error/message/reason fields the primary arm consults.
+          const retryErrorSources = extractRunErrorSources(retryResult);
           const retryClassified = synthesizeError({
-            sdkResultFields: retryResult.result ? String(retryResult.result) : undefined,
+            sdkError: retryErrorSources.sdkError,
+            sdkResultFields: retryErrorSources.sdkResultFields,
             streamErrorMessage: turnState.streamErrorMessage,
             capturedRejection: retryRejection,
             conversationErrorText: retryConversationErrorText,
@@ -1974,6 +2000,7 @@ async function executeCursorInner(
             `finalTextLength=${finalText.length}`,
           );
           try {
+            const { extractStructuredOutput } = await import("./extract-structured-output.js");
             structuredOutput = await extractStructuredOutput(
               finalText, structuredOutputSchema, config, requestedModel,
             );
@@ -2298,53 +2325,6 @@ function seedCursorTranscriptFromExecution(
   return persisted.subAgentExecutions.map((sub) => clone(SubAgentExecutionSchema, sub));
 }
 
-// ---------------------------------------------------------------------------
-// Structured Output Extraction (Cursor Harness Tier 2)
-// ---------------------------------------------------------------------------
-
-/**
- * Extract structured data from an agent's free-text response using an
- * economy-tier LLM with withStructuredOutput (function-calling).
- * Guarantees schema-conformant JSON output via the API's tool-use mechanism.
- *
- * Construction (registry-id resolution, provider inference, proxy wiring) is
- * delegated to the shared buildChatModel so the economy model's registry id is
- * always resolved to a provider API id before the call.
- */
-async function extractStructuredOutput(
-  agentResponse: string,
-  schema: Record<string, unknown>,
-  config: Config,
-  primaryModel: string,
-): Promise<unknown | null> {
-  const { getEconomyModel } = await import("../../shared/model-registry.js");
-  const { buildChatModel } = await import("../../shared/model-client.js");
-
-  const extractionModel = await getEconomyModel(primaryModel);
-  const proxyEndpoint = config.proxyEndpoint ?? config.stigmerBackendEndpoint;
-
-  const { model: llm } = await buildChatModel({
-    modelName: extractionModel,
-    proxyEndpoint,
-    stigmerToken: config.stigmerToken ?? undefined,
-    maxTokens: 4096,
-  });
-
-  const zodSchema = jsonSchemaToZod(schema);
-  const structured = llm.withStructuredOutput(zodSchema);
-
-  const result = await structured.invoke([
-    { role: "system", content: "Extract the structured data from the agent's response. Return only the data that matches the schema." },
-    { role: "user", content: agentResponse },
-  ]);
-
-  return result ?? null;
-}
-
-// Re-export for use within this module; shared implementation eliminates
-// the three duplicate converters that previously drifted independently.
-import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
-
 // ---------------------------------------------------------------------------
 // Prompt selection
 // ---------------------------------------------------------------------------
@@ -2365,7 +2345,11 @@ export interface BuildPromptInput {
   subAgents: import("@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb").SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
-  attachmentPaths: string[];
+  /**
+   * This turn's resolved attachments for the `<input_files>` section —
+   * final paths plus duplicate-rename disclosure (attachment-resolver.ts).
+   */
+  attachments: import("./prompt-builder.js").AttachmentPromptEntry[];
   /**
    * Vision facts for the input-files section (T04): which attachments the
    * model sees inline and which degraded to path-only. PER-TURN like the
@@ -2458,7 +2442,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     subAgents,
     workspaceDirs,
     workspaceFileRefs,
-    attachmentPaths,
+    attachments,
     interactionMode,
     buildFromPlan,
     conversationCatchup,
@@ -2492,9 +2476,9 @@ export function buildPrompt(input: BuildPromptInput): string {
   if (resolution.reason === "resumed_successfully") {
     const prefixes = [
       formatInteractionModePrefix(interactionMode),
-      formatImplementPlanSection(buildFromPlan, attachmentPaths),
-      attachmentPaths.length > 0
-        ? formatInputFiles(attachmentPaths, input.vision)
+      formatImplementPlanSection(buildFromPlan, attachments),
+      attachments.length > 0
+        ? formatInputFiles(attachments, input.vision)
         : undefined,
       conversationCatchup !== undefined
         ? formatConversationCatchupSection(conversationCatchup)
@@ -2517,7 +2501,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     subAgents,
     workspaceDirs,
     workspaceFileRefs,
-    attachmentPaths,
+    attachments,
     vision: input.vision,
     interactionMode,
     buildFromPlan,

package/src/activities/execute-cursor/mcp-resolver.ts

@@ -14,7 +14,7 @@
  * same pipeline as the Python agent-runner's config_transformer.py.
  */
 
-import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { McpServerUsage, ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { StigmerClient } from "../../client/stigmer-client.js";
@@ -29,6 +29,7 @@ import {
   filterEnvToDeclaredKeys,
   PlaceholderResolutionError,
 } from "./placeholder-resolver.js";
+import { effectiveEnabledTools } from "../../shared/mcp-enabled-tools.js";
 
 /**
  * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
@@ -70,6 +71,29 @@ export interface ResolvedMcpServer {
   pinnedToolApprovals: ToolApprovalPolicy[];
   /** True when the server has never been connected (no tool discovery yet). */
   discoveredCapabilitiesEmpty: boolean;
+  /**
+   * The EFFECTIVE tool allow-list for this server (issue #350): the usage's
+   * enabled_tools, falling back to the server's default_enabled_tools when
+   * the usage's list is empty (see shared/mcp-enabled-tools.ts). Absent when
+   * unrestricted. The Cursor SDK config cannot hide tools, so this harness
+   * enforces it in the HITL hook: the restricted map is written into the
+   * approval state (mcpServerEnabledTools) and non-enabled calls are denied
+   * with the non-pausing "disabled" kind (see hook-script.ts).
+   */
+  enabledTools?: string[];
+  /**
+   * Layer-3 per-agent approval overrides from the usage that resolved this
+   * server (issue #349): riding the resolved server is what SCOPES an
+   * override to its own server — a flat cross-server list is how an
+   * override once leaked onto (or silently un-gated) a same-named tool on
+   * another server. Deliberately REQUIRED, not optional: empty means "no
+   * overrides", and every construction site — including the shared
+   * resolver this one mirrors and the synthesized attachments, which have
+   * no usage and therefore no layer 3 — must say so explicitly, so a
+   * forgotten mirror cannot compile. Consumed by mergeApprovalPolicies
+   * (shared/approval-policy.ts).
+   */
+  toolApprovalOverrides: ToolApprovalOverride[];
 }
 
 /**
@@ -115,7 +139,13 @@ export async function resolveMcpServers(
         envVars,
         ref.slug,
       );
-      const server = mcpServerToResolved(mcpServer, ref.slug, serverEnv);
+      const server = mcpServerToResolved(
+        mcpServer,
+        ref.slug,
+        serverEnv,
+        usage.enabledTools,
+        usage.toolApprovalOverrides ?? [],
+      );
       if (server) {
         assertTransportAllowed(server.slug, server.connectionType, transportPosture);
         resolved.push(server);
@@ -152,6 +182,8 @@ function mcpServerToResolved(
   server: McpServer,
   slug: string,
   envVars: Record<string, string>,
+  usageEnabledTools?: readonly string[],
+  usageToolApprovalOverrides: ToolApprovalOverride[] = [],
 ): ResolvedMcpServer | null {
   const spec = server.spec;
   if (!spec) return null;
@@ -167,6 +199,8 @@ function mcpServerToResolved(
     toolApprovals,
     pinnedToolApprovals,
     discoveredCapabilitiesEmpty,
+    enabledTools: effectiveEnabledTools(usageEnabledTools, spec.defaultEnabledTools),
+    toolApprovalOverrides: usageToolApprovalOverrides,
   };
 
   switch (spec.serverType.case) {

package/src/activities/execute-cursor/prompt-builder.ts

@@ -71,6 +71,18 @@ export interface VisionPromptInfo {
   notViewable: NotViewableEntry[];
 }
 
+/**
+ * One resolved attachment as the `<input_files>` section renders it —
+ * the final workspace-relative path plus the duplicate-rename disclosure
+ * (attachment-resolver.ts / shared/attachment-naming.ts).
+ */
+export interface AttachmentPromptEntry {
+  /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
+  path: string;
+  /** Original filename, present only when a duplicate name was renamed. */
+  renamedFrom?: string;
+}
+
 export interface EnhancedPromptOptions {
   instructions: string;
   userMessage: string;
@@ -78,7 +90,10 @@ export interface EnhancedPromptOptions {
   /**
    * Datastores attached via `datastore_usages` — rendered as the
    * `<available_datastores>` section (DD-005 SD-5, skills precedent)
-   * pointing the model at the synthesized record tools.
+   * pointing the model at the synthesized record tools. Always the healthy
+   * rendering here: the Cursor SDK connects MCP itself, so this harness can
+   * never observe the live roster — the section's standing
+   * failure-disclosure instruction is its whole coverage (issue #325).
    */
   datastoreUsages?: DatastoreUsage[];
   /**
@@ -90,7 +105,7 @@ export interface EnhancedPromptOptions {
   subAgents: SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
-  attachmentPaths: string[];
+  attachments: AttachmentPromptEntry[];
   /** Inline/degraded image facts for the input-files section (T04 vision). */
   vision?: VisionPromptInfo;
   interactionMode?: InteractionMode;
@@ -153,7 +168,7 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
 
   const implementPlan = formatImplementPlanSection(
     options.buildFromPlan,
-    options.attachmentPaths,
+    options.attachments,
   );
   if (implementPlan) {
     sections.push(implementPlan);
@@ -195,8 +210,8 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatWorkspaceContext(safeDirs));
   }
 
-  if (options.attachmentPaths.length > 0) {
-    sections.push(formatInputFiles(options.attachmentPaths, options.vision));
+  if (options.attachments.length > 0) {
+    sections.push(formatInputFiles(options.attachments, options.vision));
   }
 
   if (options.workspaceFileRefs.length > 0) {
@@ -479,8 +494,18 @@ export function formatWorkspaceContext(dirs: string[]): string {
   ].join("\n");
 }
 
-export function formatInputFiles(paths: string[], vision?: VisionPromptInfo): string {
-  const entries = paths.map((p) => `- \`${p}\``);
+export function formatInputFiles(
+  attachments: readonly AttachmentPromptEntry[],
+  vision?: VisionPromptInfo,
+): string {
+  // A duplicate-renamed file (attachment-naming.ts) discloses its original
+  // name so the agent can connect "the two report.pdfs" in the user's
+  // message to distinct files on disk.
+  const entries = attachments.map((a) =>
+    a.renamedFrom !== undefined
+      ? `- \`${a.path}\` (renamed from duplicate '${a.renamedFrom}')`
+      : `- \`${a.path}\``,
+  );
   // The vision lines (shared wording, attachment-vision.ts) tell the model
   // which of these files it can already SEE inline versus which degraded to
   // path-only — without them an agent silently ignores a photo the user
@@ -541,14 +566,14 @@ export function formatInteractionModePrefix(
  */
 export function formatImplementPlanSection(
   buildFromPlan: boolean | undefined,
-  attachmentPaths: string[],
+  attachments: readonly AttachmentPromptEntry[],
 ): string | undefined {
   if (!buildFromPlan) {
     return undefined;
   }
 
   const directive = buildImplementPlanDirective(
-    findApprovedPlanPath(attachmentPaths),
+    findApprovedPlanPath(attachments.map((a) => a.path)),
   );
   return ["<implement_plan>", directive, "</implement_plan>"].join("\n");
 }

package/src/activities/execute-cursor/turn-stream.ts

@@ -387,8 +387,11 @@ export async function consumeCursorTurnStream(
         console.log(
           `ExecuteCursor stream status: execution=${executionId}, status=${JSON.stringify(event)}`,
         );
-        const statusEvent = event as { status?: string; message?: string };
-        if (statusEvent.status === "ERROR" && statusEvent.message) {
+        const statusEvent = event as { status?: string; message?: unknown };
+        // The cast is a claim, not a guarantee: message is untyped at runtime
+        // (the oss#299 class of bug). A structured value here would crash
+        // classification downstream, so only capture actual text.
+        if (statusEvent.status === "ERROR" && typeof statusEvent.message === "string" && statusEvent.message.length > 0) {
           state.streamErrorMessage = statusEvent.message;
         }
       }