@stigmer/runner 3.10.0 → 3.11.0

package/dist/activities/execute-cursor/extract-structured-output.js

@@ -0,0 +1,58 @@
+/**
+ * Tier-2 structured-output extraction for the Cursor harness.
+ *
+ * When tier-1 text extraction (shared/extract-json.ts) cannot find JSON in
+ * the agent's free-text response, this tier asks an economy-tier LLM to
+ * extract it via withStructuredOutput (function-calling), which guarantees
+ * schema-conformant output through the API's tool-use mechanism.
+ *
+ * Lives in its own module (rather than inside execute-cursor/index.ts) so
+ * the LangChain construction path stays out of the Cursor activity's module
+ * graph until a run actually needs tier 2 — index.ts imports this module
+ * lazily at the call site, mirroring its tier-1 import, which is what
+ * bundle-slim's deferred evaluation preserves.
+ */
+import { getEconomyModel } from "../../shared/model-registry.js";
+import { buildChatModel } from "../../shared/model-client.js";
+import { checkDirectCredentials } from "../../shared/llm-backend.js";
+import { tryInferProvider } from "../../shared/llm-proxy.js";
+import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
+/**
+ * Extract structured data from an agent's free-text response using an
+ * economy-tier LLM with withStructuredOutput (function-calling).
+ *
+ * Construction (registry-id resolution, provider inference, proxy wiring) is
+ * delegated to the shared buildChatModel so the economy model's registry id
+ * is always resolved to a provider API id before the call.
+ *
+ * Throws when no LLM is reachable (no proxy and no credential path for the
+ * extraction model's provider) — the caller treats any throw here as "tier 2
+ * unavailable", logs it, and returns the agent's text without structured
+ * output, so the failure mode is a diagnosable log line, never a lost run.
+ */
+export async function extractStructuredOutput(agentResponse, schema, config, primaryModel) {
+    const extractionModel = await getEconomyModel(primaryModel);
+    const proxyEndpoint = config.proxyEndpoint ?? undefined;
+    if (!proxyEndpoint) {
+        const provider = tryInferProvider(extractionModel);
+        const missing = provider === null ? null : checkDirectCredentials(provider);
+        if (missing !== null) {
+            throw new Error(`Structured-output extraction needs the ${provider} model ` +
+                `'${extractionModel}' but has no credential path. ${missing}`);
+        }
+    }
+    const { model: llm } = await buildChatModel({
+        modelName: extractionModel,
+        proxyEndpoint,
+        stigmerToken: config.stigmerToken ?? undefined,
+        maxTokens: 4096,
+    });
+    const zodSchema = jsonSchemaToZod(schema);
+    const structured = llm.withStructuredOutput(zodSchema);
+    const result = await structured.invoke([
+        { role: "system", content: "Extract the structured data from the agent's response. Return only the data that matches the schema." },
+        { role: "user", content: agentResponse },
+    ]);
+    return result ?? null;
+}
+//# sourceMappingURL=extract-structured-output.js.map

package/dist/activities/execute-cursor/extract-structured-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-structured-output.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/extract-structured-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,MAA+B,EAC/B,MAAc,EACd,YAAoB;IAEpB,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0CAA0C,QAAQ,SAAS;gBAC3D,IAAI,eAAe,iCAAiC,OAAO,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QAC1C,SAAS,EAAE,eAAe;QAC1B,aAAa;QACb,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;QAC9C,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sGAAsG,EAAE;QACnI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC"}

package/dist/activities/execute-cursor/hook-script.d.ts

@@ -32,6 +32,8 @@
  *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
  *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
  *   - "fail-closed"   — approval state file missing, everything gated denies.
+ *   - "disabled"      — enabled_tools manifest exclusion (issue #350): the
+ *                       agent continues, no pause, permanent for the run.
  * Only approval-kind records carry the captured tool_input: a secret write's
  * content must never be persisted (DD-26), a capture-error's content is
  * UNCLASSIFIED (the staging error means secret classification may never have
@@ -84,8 +86,16 @@
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
- *    spec.auto_approve_all global bypass) → allow
+ * 1. Missing state file → deny (fail-closed)
+ * 1a. beforeMCPExecution event → tool excluded by the server's
+ *     mcpServerEnabledTools allow-list → record kind "disabled", deny.
+ *     Deliberately BEFORE autoApproveAll and the grant checks: enabled_tools
+ *     is a capability manifest, not an approval gate (issue #350) — no bypass
+ *     may resurrect a disabled tool, and no human may be offered "approve" on
+ *     one. Server-scoped via the payload's mcp_server_name; an absent slug in
+ *     the map means unrestricted.
+ * 1b. autoApproveAll (the pre-armed spec.auto_approve_all global bypass) →
+ *     allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
@@ -117,7 +127,8 @@
  *
  * From the pointer the script reads the current turn's approval-state file (the
  * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
- * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * mcpToolPolicies, mcpServerEnabledTools, approvedGrantTokens), denial ledger,
+ * and runner PID. The
  * static policy (which built-ins are gated, their categories, the salient arg
  * fields) is baked at generation time from approval-policy.ts.
  *

package/dist/activities/execute-cursor/hook-script.js

@@ -32,6 +32,8 @@
  *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
  *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
  *   - "fail-closed"   — approval state file missing, everything gated denies.
+ *   - "disabled"      — enabled_tools manifest exclusion (issue #350): the
+ *                       agent continues, no pause, permanent for the run.
  * Only approval-kind records carry the captured tool_input: a secret write's
  * content must never be persisted (DD-26), a capture-error's content is
  * UNCLASSIFIED (the staging error means secret classification may never have
@@ -84,8 +86,16 @@
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
- *    spec.auto_approve_all global bypass) → allow
+ * 1. Missing state file → deny (fail-closed)
+ * 1a. beforeMCPExecution event → tool excluded by the server's
+ *     mcpServerEnabledTools allow-list → record kind "disabled", deny.
+ *     Deliberately BEFORE autoApproveAll and the grant checks: enabled_tools
+ *     is a capability manifest, not an approval gate (issue #350) — no bypass
+ *     may resurrect a disabled tool, and no human may be offered "approve" on
+ *     one. Server-scoped via the payload's mcp_server_name; an absent slug in
+ *     the map means unrestricted.
+ * 1b. autoApproveAll (the pre-armed spec.auto_approve_all global bypass) →
+ *     allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
@@ -143,6 +153,21 @@ const SECRET_BLOCKED_AGENT_MESSAGE = "This file was blocked for security because
     "misconfiguration, so never tell the user to change Cursor settings or enable " +
     "hooks. Do not retry this write or attempt a workaround; the write will not be " +
     "applied. Continue with the rest of the task.";
+// Shown to the model when an MCP tool call is denied because the agent's
+// enabled_tools manifest excludes the tool (issue #350). Like
+// SECRET_BLOCKED_AGENT_MESSAGE this must NOT promise a resume — the exclusion
+// is permanent for the run and mode-independent (it is a capability manifest,
+// not an approval, so nothing can be granted). Same embedding constraint
+// (single-quoted bash echo of a JSON object): no double quotes, apostrophes,
+// or backslashes.
+const DISABLED_TOOL_AGENT_MESSAGE = "This tool is not enabled for this agent: the MCP server exposes it, but the " +
+    "agent manifest (enabled_tools) excludes it. This is the platform capability " +
+    "manifest working as intended — it is not an error and not a Cursor " +
+    "misconfiguration, so never tell the user to change Cursor settings or enable " +
+    "hooks. Do not retry this tool or attempt a workaround; it will stay " +
+    "unavailable for this entire run. Use a different tool or adapt your plan, " +
+    "and if the task cannot proceed without it, tell the user plainly what was " +
+    "unavailable.";
 /**
  * Build the bash `case` arms that map an incoming hook `tool_name` to its
  * canonical approval category. Generated from approval-policy.ts so the hook and
@@ -195,14 +220,17 @@ function buildContentDigestScript() {
  * Build the inline Node.js identity extractor embedded in the hook script.
  *
  * Parses the hook's stdin JSON properly (the bash fallback's grep truncates
- * string values at the first escaped quote) and emits SEVEN lines: tool_name,
+ * string values at the first escaped quote) and emits NINE lines: tool_name,
  * canonical category, coarse identity token, MCP name-token, hook_event_name
  * (the event discriminator: `preToolUse` for built-ins, `beforeMCPExecution`
  * for MCP), base64(JSON(tool_input)) — the authoritative pre-execution args the
- * runner overlays onto the gated tool call for the approval preview — and the
+ * runner overlays onto the gated tool call for the approval preview — the
  * CONTENT token (base64(category \n salient \n contentDigest), empty when the
- * tool has no edit content). The token encodings must stay byte-identical to
- * grantToken()/contentToken() in approval-state.ts.
+ * tool has no edit content), base64(salient), and mcp_server_name (the MCP
+ * server slug the beforeMCPExecution payload carries; empty for built-ins) —
+ * the server scope for the enabled_tools manifest arm. The token encodings
+ * must stay byte-identical to grantToken()/contentToken() in
+ * approval-state.ts.
  *
  * Authored as a single-quoted bash string, so the JS must not contain single
  * quotes. The category map, salient field list, and edit/content field lists are
@@ -233,6 +261,7 @@ function buildNodeIdentityScript() {
         // is "" for a non-edit tool, in which case the content token (line 7) is "".
         buildContentDigestScript(),
         `const ev=typeof t.hook_event_name==="string"?t.hook_event_name:"";`,
+        `const srv=typeof t.mcp_server_name==="string"?t.mcp_server_name:"";`,
         // Line 6 is base64(JSON(tool_input)): the AUTHORITATIVE pre-execution args
         // the runner overlays onto the gated tool call so the approval card can show
         // the proposed change before the user approves. Base64 keeps the bash side
@@ -241,8 +270,10 @@ function buildNodeIdentityScript() {
         // grant the runner authorizes for a file edit. Line 8 is base64(salient) —
         // the raw resource value (file path / command) capture mode needs to run
         // `git check-ignore` on a file path; base64 keeps newlines/quotes out of the
-        // line-oriented bash parse.
-        `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s));`,
+        // line-oriented bash parse. Line 9 is mcp_server_name — the server scope
+        // the enabled_tools manifest arm matches against mcpServerEnabledTools
+        // (a bare slug, never quoted/escaped, so it rides as a plain line).
+        `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s)+"\\n"+srv);`,
     ].join("");
 }
 /**
@@ -264,7 +295,8 @@ function buildNodeIdentityScript() {
  *
  * From the pointer the script reads the current turn's approval-state file (the
  * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
- * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * mcpToolPolicies, mcpServerEnabledTools, approvedGrantTokens), denial ledger,
+ * and runner PID. The
  * static policy (which built-ins are gated, their categories, the salient arg
  * fields) is baked at generation time from approval-policy.ts.
  *
@@ -425,6 +457,9 @@ if [ -n "$IDENTITY" ]; then
   # Raw salient (base64) — the file path / command. Capture mode decodes it to
   # run git check-ignore on a file path.
   SALIENT=$(printf '%s\\n' "$IDENTITY" | sed -n 8p | base64 -d 2>/dev/null || true)
+  # MCP server slug (beforeMCPExecution payloads only; empty for built-ins) —
+  # the server scope for the enabled_tools manifest arm.
+  MCP_SERVER=$(printf '%s\\n' "$IDENTITY" | sed -n 9p)
 else
   # Fallback when the Node binary cannot run: grep/cut extraction. Best-effort
   # only — '"field":"[^"]*"' truncates at the first JSON-escaped quote, so the
@@ -434,6 +469,10 @@ else
   # would otherwise abort the script and emit no decision.
   TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   HOOK_EVENT=$(echo "$INPUT" | grep -o '"hook_event_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
+  # Server slugs are plain identifiers (no JSON-escaped quotes), so the grep
+  # fallback extracts mcp_server_name reliably — the manifest arm keeps its
+  # full precision even without the Node binary.
+  MCP_SERVER=$(echo "$INPUT" | grep -o '"mcp_server_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   SALIENT=""
   for field in ${salientFields}; do
     v=$(echo "$INPUT" | grep -o "\\"$field\\":\\"[^\\"]*\\"" | head -1 | cut -d'"' -f4 || true)
@@ -573,7 +612,30 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
   fi
 fi
 
-# --- 1. Auto-approve all ---
+# --- 1a. MCP capability manifest: enabled_tools (issue #350) ---
+# Runs BEFORE the auto-approve-all shortcut and every grant check because
+# enabled_tools is a capability manifest, not an approval gate: no bypass may
+# resurrect a disabled tool and no human may be offered approval on one.
+# mcpServerEnabledTools holds ONLY restricted servers (an absent slug means
+# unrestricted, so this arm is inert for the common case). Matching is
+# server-scoped via the payload's mcp_server_name — equal tool names on
+# different servers cannot cross-grant — and the quoted-name membership check
+# is exact, never a substring match. Kind "disabled": attributable,
+# non-pausing (the model adapts, same consumer semantics as "secret"), and
+# permanent for the run.
+if [ "$HOOK_EVENT" = "beforeMCPExecution" ] && [ -n "$MCP_SERVER" ] && [ -n "$TOOL_NAME" ]; then
+  ENABLED_MAP=$(echo "$STATE" | grep -o '"mcpServerEnabledTools":{[^}]*}' | head -1 || true)
+  if [ -n "$ENABLED_MAP" ]; then
+    SERVER_ENABLED=$(echo "$ENABLED_MAP" | grep -o "\\"$MCP_SERVER\\":\\[[^]]*\\]" | head -1 || true)
+    if [ -n "$SERVER_ENABLED" ] && ! echo "$SERVER_ENABLED" | grep -qF "\\"$TOOL_NAME\\""; then
+      record_denial "$MCP_TOKEN" "disabled"
+      echo '{"permission":"deny","agent_message":"${DISABLED_TOOL_AGENT_MESSAGE}","user_message":"Tool not enabled for this agent: '"$TOOL_NAME"'"}'
+      exit 0
+    fi
+  fi
+fi
+
+# --- 1b. Auto-approve all ---
 if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   echo '{"permission":"allow"}'
   exit 0

package/dist/activities/execute-cursor/hook-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,6BAA6B,GACjC,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,YAAY,CAAC;AAEf,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAoD8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAyDzC,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAmC3B,6BAA6B;;;;oDAI/B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2B9B,6BAA6B;;;;gDAI/B,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}
+{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,6BAA6B,GACjC,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,YAAY,CAAC;AAEf,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD,yEAAyE;AACzE,8DAA8D;AAC9D,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,kBAAkB;AAClB,MAAM,2BAA2B,GAC/B,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,+EAA+E;IAC/E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,cAAc,CAAC;AAEjB;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,qEAAqE;QACrE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,iLAAiL;KAClL,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkC5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAoD8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAyDzC,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;oDAsB7B,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAoCzB,6BAA6B;;;;oDAI/B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2B9B,6BAA6B;;;;gDAI/B,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}

package/dist/activities/execute-cursor/index.d.ts

@@ -52,7 +52,11 @@ export interface BuildPromptInput {
     subAgents: import("@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb").SubAgent[];
     workspaceDirs: string[];
     workspaceFileRefs: string[];
-    attachmentPaths: string[];
+    /**
+     * This turn's resolved attachments for the `<input_files>` section —
+     * final paths plus duplicate-rename disclosure (attachment-resolver.ts).
+     */
+    attachments: import("./prompt-builder.js").AttachmentPromptEntry[];
     /**
      * Vision facts for the input-files section (T04): which attachments the
      * model sees inline and which degraded to path-only. PER-TURN like the

package/dist/activities/execute-cursor/index.js

@@ -62,6 +62,7 @@ import { readChannelConversationId, synthesizeConversationAttachment, } from "..
 import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
+import { enabledToolsBySlug } from "../../shared/mcp-enabled-tools.js";
 import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
@@ -96,7 +97,7 @@ import { StreamingUsageSummarySchema } from "@stigmer/protos/ai/stigmer/agentic/
 import { activityStarted, activityFinished } from "../../idle-watchdog.js";
 import { normalizeActivityInput } from "../../shared/activity-input.js";
 import { getCapturedRejection, clearCapturedRejection } from "./rejection-capture.js";
-import { synthesizeError, formatClassifiedError, shouldRetryWithFreshAgent } from "./error-classifier.js";
+import { synthesizeError, formatClassifiedError, shouldRetryWithFreshAgent, extractRunErrorSources } from "./error-classifier.js";
 import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
@@ -536,8 +537,20 @@ turnSeq) {
         // the messaging reach; undefined lets a cloud sandbox runner's
         // ambient session-scoped token or OSS's no-auth apply). The
         // attachment header falls back to the ambient credential where no
-        // exchange happens.
-        const exchangedRunnerToken = await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
+        // exchange happens. Unlike the env read (which hard-fails on a broken
+        // exchange — secrets are load-bearing there), this exchange is
+        // opportunistic: every consumer below degrades to an empty answer by
+        // contract, and the server refuses the ambient fallback safely, so a
+        // failed exchange must not kill the run.
+        let exchangedRunnerToken;
+        try {
+            exchangedRunnerToken =
+                await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
+        }
+        catch (err) {
+            console.warn("[execute-cursor] Scoped-token exchange failed for attachment/discovery " +
+                `reads; degrading to the ambient credential: ${err instanceof Error ? err.message : err}`);
+        }
         const attachmentCredential = exchangedRunnerToken
             ?? config.stigmerTokenRef?.current
             ?? config.stigmerToken;
@@ -612,9 +625,10 @@ turnSeq) {
         // them as auto-approved); the global bypass empties the map entirely.
         const leases = deriveActiveLeases(execution);
         const globalBypass = leases.global;
-        const agentOverrides = blueprint.mergedMcpServerUsages
-            .flatMap((u) => u.toolApprovalOverrides ?? []);
-        const mergedPolicies = mergeApprovalPolicies(mcpResolution.resolvedServers, agentOverrides, leases);
+        // Layer-3 overrides ride each resolved server from its merged usage —
+        // see ResolvedMcpServer.toolApprovalOverrides (issue #349) — so there
+        // is no separate override input to pass here.
+        const mergedPolicies = mergeApprovalPolicies(mcpResolution.resolvedServers, leases);
         heartbeat();
         // Phase 4c: Validate MCP server env health (diagnostic, non-blocking)
         const mcpWarnings = validateMcpServerEnv(mcpResolution.resolvedServers, blueprint.mergedMcpServerUsages, envVars);
@@ -650,7 +664,10 @@ turnSeq) {
             storage: artifactStorage,
             visionBudget,
         });
-        const attachmentPaths = attachmentResults.map((a) => a.relativePath);
+        const attachmentEntries = attachmentResults.map((a) => ({
+            path: a.relativePath,
+            ...(a.renamedFrom !== undefined ? { renamedFrom: a.renamedFrom } : {}),
+        }));
         // Vision facts, derived once from the single resolution result: the
         // images the model will see inline (in attachment order) and the ones
         // that degraded to path-only, disclosed in the prompt.
@@ -751,7 +768,12 @@ turnSeq) {
         // approval denials with the non-pausing "unattended" kind, so the
         // first-denial stop never fires and the turn boundary settles the denied
         // calls as SKIPPED instead of pausing a turn nobody can approve.
-        const approvalState = buildApprovalState(mergedPolicies, globalBypass, leases.categories, approvalGrants, captureMode, captureIgnored, gitWorkspace, isUnattendedApprovalMode(execution));
+        const approvalState = buildApprovalState(mergedPolicies, globalBypass, leases.categories, approvalGrants, captureMode, captureIgnored, gitWorkspace, isUnattendedApprovalMode(execution), 
+        // The enabled_tools capability manifest (issue #350): restricted
+        // servers' allow-lists, enforced by the hook's "disabled" arm ahead of
+        // every approval bypass. The Cursor SDK config cannot hide a server's
+        // tools, so this deny-at-call is the harness's enforcement.
+        enabledToolsBySlug(mcpResolution.resolvedServers));
         const hitlGate = await installHitlGate({
             workspaceRoot: primaryWorkspaceDir,
             hitlDir,
@@ -944,7 +966,7 @@ turnSeq) {
             subAgents: blueprint.subAgents,
             workspaceDirs: blueprint.workspaceDirs,
             workspaceFileRefs: spec.workspaceFileRefs ?? [],
-            attachmentPaths,
+            attachments: attachmentEntries,
             vision: visionPromptInfo,
             pendingApprovals: adjudicatedApprovals,
             appliedToolCallIds,
@@ -1450,12 +1472,10 @@ turnSeq) {
                 status.phase = ExecutionPhase.EXECUTION_COMPLETED;
                 break;
             case "error": {
-                const resultAny = result;
-                const sdkError = result.result
-                    ?? resultAny.error
-                    ?? resultAny.message
-                    ?? resultAny.reason;
-                const sdkErrorStr = sdkError ? String(sdkError) : undefined;
+                // Shape-aware extraction, NOT String(): the result's error fields are
+                // structured at runtime often enough that a bare coercion showed users
+                // "[object Object]" and shadowed every fallback source below (oss#299).
+                const runErrorSources = extractRunErrorSources(result);
                 // The SDK frequently resolves run.wait() to a bare { status: "error" }
                 // while the real reason (e.g. the original grpc-status 12 routing
                 // failure) lives on the failing conversation turn. Capture it here so
@@ -1465,7 +1485,8 @@ turnSeq) {
                 if (capturedRejection)
                     clearCapturedRejection(executionId);
                 const classified = synthesizeError({
-                    sdkResultFields: sdkErrorStr,
+                    sdkError: runErrorSources.sdkError,
+                    sdkResultFields: runErrorSources.sdkResultFields,
                     streamErrorMessage: turnState.streamErrorMessage,
                     capturedRejection,
                     conversationErrorText,
@@ -1508,7 +1529,7 @@ turnSeq) {
                         subAgents: blueprint.subAgents,
                         workspaceDirs: blueprint.workspaceDirs,
                         workspaceFileRefs: spec.workspaceFileRefs ?? [],
-                        attachmentPaths,
+                        attachments: attachmentEntries,
                         vision: visionPromptInfo,
                         pendingApprovals: adjudicatedApprovals,
                         interactionMode,
@@ -1564,8 +1585,14 @@ turnSeq) {
                     if (retryRejection)
                         clearCapturedRejection(executionId);
                     const retryConversationErrorText = await introspectConversation(retryRun, executionId);
+                    // Same shape-aware extraction as the primary error arm — the retry
+                    // previously String()-coerced result.result alone, so a structured
+                    // retry failure both read "[object Object]" and ignored the
+                    // error/message/reason fields the primary arm consults.
+                    const retryErrorSources = extractRunErrorSources(retryResult);
                     const retryClassified = synthesizeError({
-                        sdkResultFields: retryResult.result ? String(retryResult.result) : undefined,
+                        sdkError: retryErrorSources.sdkError,
+                        sdkResultFields: retryErrorSources.sdkResultFields,
                         streamErrorMessage: turnState.streamErrorMessage,
                         capturedRejection: retryRejection,
                         conversationErrorText: retryConversationErrorText,
@@ -1661,6 +1688,7 @@ turnSeq) {
                     console.log(`ExecuteCursor text extraction failed, trying LLM extraction: execution=${executionId}, ` +
                         `finalTextLength=${finalText.length}`);
                     try {
+                        const { extractStructuredOutput } = await import("./extract-structured-output.js");
                         structuredOutput = await extractStructuredOutput(finalText, structuredOutputSchema, config, requestedModel);
                         if (structuredOutput !== undefined) {
                             console.log(`ExecuteCursor structured output extracted (LLM): execution=${executionId}`);
@@ -1949,40 +1977,6 @@ function seedCursorTranscriptFromExecution(status, execution) {
     }
     return persisted.subAgentExecutions.map((sub) => clone(SubAgentExecutionSchema, sub));
 }
-// ---------------------------------------------------------------------------
-// Structured Output Extraction (Cursor Harness Tier 2)
-// ---------------------------------------------------------------------------
-/**
- * Extract structured data from an agent's free-text response using an
- * economy-tier LLM with withStructuredOutput (function-calling).
- * Guarantees schema-conformant JSON output via the API's tool-use mechanism.
- *
- * Construction (registry-id resolution, provider inference, proxy wiring) is
- * delegated to the shared buildChatModel so the economy model's registry id is
- * always resolved to a provider API id before the call.
- */
-async function extractStructuredOutput(agentResponse, schema, config, primaryModel) {
-    const { getEconomyModel } = await import("../../shared/model-registry.js");
-    const { buildChatModel } = await import("../../shared/model-client.js");
-    const extractionModel = await getEconomyModel(primaryModel);
-    const proxyEndpoint = config.proxyEndpoint ?? config.stigmerBackendEndpoint;
-    const { model: llm } = await buildChatModel({
-        modelName: extractionModel,
-        proxyEndpoint,
-        stigmerToken: config.stigmerToken ?? undefined,
-        maxTokens: 4096,
-    });
-    const zodSchema = jsonSchemaToZod(schema);
-    const structured = llm.withStructuredOutput(zodSchema);
-    const result = await structured.invoke([
-        { role: "system", content: "Extract the structured data from the agent's response. Return only the data that matches the schema." },
-        { role: "user", content: agentResponse },
-    ]);
-    return result ?? null;
-}
-// Re-export for use within this module; shared implementation eliminates
-// the three duplicate converters that previously drifted independently.
-import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
 /**
  * Select and build the appropriate prompt based on resolution reason and
  * HITL state.
@@ -2011,7 +2005,7 @@ export function isHitlReinvocation(approvalDecisions) {
     return approvalDecisions !== undefined && approvalDecisions.size > 0;
 }
 export function buildPrompt(input) {
-    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachmentPaths, interactionMode, buildFromPlan, conversationCatchup, } = input;
+    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachments, interactionMode, buildFromPlan, conversationCatchup, } = input;
     // HITL reinvocation: the agent is resumed, so its native context carries the
     // prior conversation; the reinvocation prompt conveys the approval decisions
     // (and which approved writes the runner already exact-applied).
@@ -2035,9 +2029,9 @@ export function buildPrompt(input) {
     if (resolution.reason === "resumed_successfully") {
         const prefixes = [
             formatInteractionModePrefix(interactionMode),
-            formatImplementPlanSection(buildFromPlan, attachmentPaths),
-            attachmentPaths.length > 0
-                ? formatInputFiles(attachmentPaths, input.vision)
+            formatImplementPlanSection(buildFromPlan, attachments),
+            attachments.length > 0
+                ? formatInputFiles(attachments, input.vision)
                 : undefined,
             conversationCatchup !== undefined
                 ? formatConversationCatchupSection(conversationCatchup)
@@ -2059,7 +2053,7 @@ export function buildPrompt(input) {
         subAgents,
         workspaceDirs,
         workspaceFileRefs,
-        attachmentPaths,
+        attachments,
         vision: input.vision,
         interactionMode,
         buildFromPlan,