@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/dist/activities/emit-event.js

@@ -9,14 +9,29 @@
  *
  * Supported delivery targets:
  * - webhook: HTTP POST with Content-Type: application/cloudevents+json
- * - signal:  Temporal signal to another running workflow's listen task
+ * - signal:  signal to another workflow execution's listen task, routed
+ *            through the server's SendSignal lane
+ *
+ * Signal delivery is deliberately server-mediated (oss#517): a direct
+ * Temporal client here would bypass the authorization boundary (any
+ * workflow could signal any workflow id in the namespace) and is
+ * structurally incompatible with payload encryption — emit→listen is
+ * the platform's only runner-to-runner channel, and under per-identity
+ * runner keys a sender-encrypted signal fails closed at a receiver
+ * holding a different key. The server re-produces the payload, so each
+ * side's codec passes it through.
  *
  * CloudEvents spec: https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md
  */
 import { randomUUID } from "node:crypto";
+import { StigmerClient } from "../client/stigmer-client.js";
 import { loadConfig } from "../config.js";
 import { resolveRuntimePlaceholders } from "../workflow-engine/resolve.js";
 const WEBHOOK_TIMEOUT_MS = 30_000;
+// Delivery is best-effort by contract, so no single target may consume the
+// CallFunction activity's whole 5m startToClose budget. Same bound as the
+// webhook arm.
+const SIGNAL_TIMEOUT_MS = 30_000;
 function buildEnvelope(config, executionId) {
     const source = config.event.source || `/workflows/executions/${executionId}`;
     const envelope = {
@@ -67,27 +82,43 @@ async function deliverWebhook(envelope, target, runtimeEnv) {
         };
     }
 }
-async function deliverSignal(envelope, target) {
+function buildClient() {
+    const config = loadConfig();
+    return new StigmerClient({
+        endpoint: config.stigmerBackendEndpoint,
+        token: config.stigmerToken,
+    });
+}
+async function deliverSignal(envelope, target, client) {
+    // Refuse the pre-oss#517 field by name: direct-addressing raw Temporal
+    // workflow ids is exactly the capability server mediation removes.
+    const legacyWorkflowId = target.workflow_id;
+    if (!target.execution_id) {
+        const reason = legacyWorkflowId
+            ? "signal delivery addresses workflow executions by 'execution_id' (\"wfx_...\"); 'workflow_id' is not supported"
+            : "signal delivery requires 'execution_id'";
+        return {
+            target: `signal:${String(legacyWorkflowId ?? "")}/${target.signal_name ?? ""}`,
+            error: reason,
+        };
+    }
+    if (!target.signal_name) {
+        return {
+            target: `signal:${target.execution_id}/`,
+            error: "signal delivery requires 'signal_name'",
+        };
+    }
     try {
-        const { Connection, Client } = await import("@temporalio/client");
-        // Resolve Temporal coordinates through the central config layer rather than
-        // reading env directly: signal delivery must dial the SAME cluster/namespace
-        // the worker connected with. config.ts is the single source of truth for the
-        // canonical TEMPORAL_SERVICE_ADDRESS / TEMPORAL_NAMESPACE resolution — reading
-        // env here would diverge (and previously dialed localhost via a stale name).
-        const config = loadConfig();
-        const temporalAddress = config.temporalAddress;
-        const temporalNamespace = config.temporalNamespace;
-        const connection = await Connection.connect({ address: temporalAddress });
-        const client = new Client({ connection, namespace: temporalNamespace });
-        const handle = client.workflow.getHandle(target.workflow_id);
-        await handle.signal(target.signal_name, envelope);
+        await client.sendWorkflowSignal(target.execution_id, target.signal_name, envelope, { timeoutMs: SIGNAL_TIMEOUT_MS });
         return null;
     }
     catch (err) {
+        // Server refusals arrive as ConnectErrors whose messages carry the code
+        // (e.g. [not_found], [failed_precondition] for terminal executions) —
+        // surfaced verbatim in delivery_errors, same contract as the webhook arm.
         const message = err instanceof Error ? err.message : String(err);
         return {
-            target: `signal:${target.workflow_id}/${target.signal_name}`,
+            target: `signal:${target.execution_id}/${target.signal_name}`,
             error: message,
         };
     }
@@ -105,13 +136,17 @@ export async function emitEventAction(config, executionId, runtimeEnv) {
     }
     const errors = [];
     const env = runtimeEnv ?? {};
+    // One client serves all signal targets of this emit; constructed lazily so
+    // webhook-only emits never pay for a gRPC transport.
+    let client;
     for (const target of config.delivery) {
         let err = null;
         if ("webhook" in target) {
             err = await deliverWebhook(envelope, target.webhook, env);
         }
         else if ("signal" in target) {
-            err = await deliverSignal(envelope, target.signal);
+            client ??= buildClient();
+            err = await deliverSignal(envelope, target.signal, client);
         }
         if (err) {
             errors.push(err);

package/dist/activities/emit-event.js.map

@@ -1 +1 @@
-{"version":3,"file":"emit-event.js","sourceRoot":"","sources":["../../src/activities/emit-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAoC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,SAAS,aAAa,CACpB,MAAuB,EACvB,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,yBAAyB,WAAW,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAA4B;QACxC,EAAE,EAAE,UAAU,EAAE;QAChB,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;QACvB,MAAM;QACN,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,eAAe,EAAE,kBAAkB;KACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACzB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAiC,EACjC,MAA6B,EAC7B,UAAmC;IAEnC,MAAM,eAAe,GAA2B;QAC9C,cAAc,EAAE,8BAA8B;KAC/C,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,WAAW,MAAM,CAAC,GAAG,EAAE;gBAC/B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;aACjC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,CAAC,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAiC,EACjC,MAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAElE,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC/C,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAEnD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAElD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,UAAU,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,EAAE;YAC5D,KAAK,EAAE,OAAO;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,WAAmB,EACnB,UAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC;IAE7B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,GAAyB,IAAI,CAAC;QAErC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,GAAG,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"emit-event.js","sourceRoot":"","sources":["../../src/activities/emit-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAsC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,2EAA2E;AAC3E,0EAA0E;AAC1E,eAAe;AACf,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,SAAS,aAAa,CACpB,MAAuB,EACvB,WAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,yBAAyB,WAAW,EAAE,CAAC;IAE7E,MAAM,QAAQ,GAA4B;QACxC,EAAE,EAAE,UAAU,EAAE;QAChB,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;QACvB,MAAM;QACN,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,eAAe,EAAE,kBAAkB;KACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACzB,QAAQ,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,QAAiC,EACjC,MAA6B,EAC7B,UAAmC;IAEnC,MAAM,eAAe,GAA2B;QAC9C,cAAc,EAAE,8BAA8B;KAC/C,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,eAAe;YACxB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAC9B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,WAAW,MAAM,CAAC,GAAG,EAAE;gBAC/B,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE;aACjC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,WAAW,MAAM,CAAC,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,IAAI,aAAa,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC,sBAAsB;QACvC,KAAK,EAAE,MAAM,CAAC,YAAY;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAiC,EACjC,MAA4B,EAC5B,MAAqB;IAErB,uEAAuE;IACvE,mEAAmE;IACnE,MAAM,gBAAgB,GAAI,MAAoC,CAAC,WAAW,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,gBAAgB;YAC7B,CAAC,CAAC,+GAA+G;YACjH,CAAC,CAAC,yCAAyC,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,UAAU,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;YAC9E,KAAK,EAAE,MAAM;SACd,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,UAAU,MAAM,CAAC,YAAY,GAAG;YACxC,KAAK,EAAE,wCAAwC;SAChD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,kBAAkB,CAC7B,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,EAClB,QAAsB,EACtB,EAAE,SAAS,EAAE,iBAAiB,EAAE,CACjC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,MAAM,EAAE,UAAU,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE;YAC7D,KAAK,EAAE,OAAO;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAuB,EACvB,WAAmB,EACnB,UAAoC;IAEpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEpD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,UAAU,IAAI,EAAE,CAAC;IAE7B,2EAA2E;IAC3E,qDAAqD;IACrD,IAAI,MAAiC,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,GAAyB,IAAI,CAAC;QAErC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,GAAG,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,KAAK,WAAW,EAAE,CAAC;YACzB,GAAG,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/activities/execute-cursor/__test-utils__/cursor-hook-harness.d.ts

@@ -98,6 +98,14 @@ export interface CursorHookHarnessOptions {
      * non-pausing "unattended" kind and the adapt-and-explain agent message.
      */
     unattendedSkip?: boolean;
+    /**
+     * Per-server enabled_tools allow-lists (issue #350) — restricted servers
+     * only. The hook's manifest arm denies a beforeMCPExecution call whose
+     * mcp_server_name is listed here with a tool name outside its list (kind
+     * "disabled", ahead of every approval bypass). hookMcp payloads carry
+     * mcp_server_name "srv".
+     */
+    mcpServerEnabledTools?: Record<string, string[]>;
 }
 /**
  * Build a throwaway workspace, write the generated hook + (optionally) the

package/dist/activities/execute-cursor/__test-utils__/cursor-hook-harness.js

@@ -77,7 +77,7 @@ export function setupCursorHookHarness(opts = {}) {
                 source: "classifier_default",
             },
         ]));
-        const state = buildApprovalState(policies, opts.autoApproveAll ?? false, new Set(opts.leasedCategories ?? []), opts.grants, opts.captureMode ?? false, opts.captureIgnored ?? false, opts.gitWorkspace ?? true, opts.unattendedSkip ?? false);
+        const state = buildApprovalState(policies, opts.autoApproveAll ?? false, new Set(opts.leasedCategories ?? []), opts.grants, opts.captureMode ?? false, opts.captureIgnored ?? false, opts.gitWorkspace ?? true, opts.unattendedSkip ?? false, opts.mcpServerEnabledTools ?? {});
         writeFileSync(statePath, JSON.stringify(state), "utf-8");
     }
     return {

package/dist/activities/execute-cursor/__test-utils__/cursor-hook-harness.js.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-hook-harness.js","sourceRoot":"","sources":["../../../../src/activities/execute-cursor/__test-utils__/cursor-hook-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAEvG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,wBAAwB,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAY,CAAC,GAAG,EAAE;IACpC,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAyEL;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC,EAAE;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACvD,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,gFAAgF;IAChF,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACzE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,aAAa,CACX,WAAW,EACX,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG;KACzC,CAAC,EACF,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE;YACb;gBACE,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,eAAe,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;gBAChC,MAAM,EAAE,oBAA6B;aACtC;SACF,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAC9B,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,IAAI,KAAK,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,CAAC,YAAY,IAAI,IAAI,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,CAC7B,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE;QACR,MAAM,CAAC,KAAa;YAClB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACpD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;oBACpC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM;YACJ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,WAAW;YACT,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,YAAY;YACV,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACrI,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,SAAS,GAAG,GAAG,EAAE,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACjM,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3G,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IACjC,eAAe,EAAE,KAAK;IACtB,OAAO,EAAE,gBAAgB;IACzB,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC"}
+{"version":3,"file":"cursor-hook-harness.js","sourceRoot":"","sources":["../../../../src/activities/execute-cursor/__test-utils__/cursor-hook-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAClG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAA+C,MAAM,sBAAsB,CAAC;AAEvG,OAAO,EAAE,mBAAmB,EAAwB,MAAM,wBAAwB,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAY,CAAC,GAAG,EAAE;IACpC,IAAI,CAAC;QACH,QAAQ,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAiFL;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAiC,EAAE;IACxE,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACvD,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,gFAAgF;IAChF,iEAAiE;IACjE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACzE,QAAQ,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,+EAA+E;IAC/E,iFAAiF;IACjF,gFAAgF;IAChF,aAAa,CAAC,UAAU,EAAE,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,aAAa,CACX,WAAW,EACX,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG;KACzC,CAAC,EACF,OAAO,CACR,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACxD,OAAO,IAAI,EAAE;YACb;gBACE,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,KAAK;gBACpB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,eAAe,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;gBAChC,MAAM,EAAE,oBAA6B;aACtC;SACF,CAAC,CACH,CAAC;QACF,MAAM,KAAK,GAAG,kBAAkB,CAC9B,QAAQ,EACR,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,EACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,IAAI,KAAK,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,CAAC,YAAY,IAAI,IAAI,EACzB,IAAI,CAAC,cAAc,IAAI,KAAK,EAC5B,IAAI,CAAC,qBAAqB,IAAI,EAAE,CACjC,CAAC;QACF,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,EAAE;QACR,MAAM,CAAC,KAAa;YAClB,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5F,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;gBACpD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;oBACpC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM;YACJ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,EAAE,CAAC;YACvC,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;iBACrC,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,WAAW;YACT,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,8EAA8E;QAC9E,8EAA8E;QAC9E,YAAY;YACV,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACrI,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,SAAS,GAAG,GAAG,EAAE,SAAS,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACjM,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC3H,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC/G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3G,iFAAiF;AACjF,uEAAuE;AACvE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAiC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7E,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IACjC,eAAe,EAAE,KAAK;IACtB,OAAO,EAAE,gBAAgB;IACzB,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC"}

package/dist/activities/execute-cursor/approval-state.d.ts

@@ -13,6 +13,7 @@
  *   "mcpToolPolicies": {
  *     "apply_cloud_resource": { "requiresApproval": true, "message": "..." }
  *   },
+ *   "mcpServerEnabledTools": { "planton": ["get_cloud_resource"] },
  *   "approvedGrants": [{ "toolName": "edit", "mcpServerSlug": "", "key": "write", "salient": "a.txt", "contentDigest": "<sha256>" }],
  *   "approvedGrantTokens": ["<base64(key\nsalient[\ncontentDigest])>"]
  * }
@@ -146,6 +147,21 @@ export interface ApprovalStateFile {
      */
     leasedCategories: string[];
     mcpToolPolicies: Record<string, McpToolPolicyEntry>;
+    /**
+     * Per-server effective enabled_tools allow-lists (issue #350), keyed by
+     * MCP server slug — ONLY restricted servers appear (an absent slug means
+     * unrestricted, so the common case stays an empty object). The Cursor SDK
+     * config cannot hide a server's tools, so the hook enforces the manifest
+     * instead: on beforeMCPExecution it matches the payload's mcp_server_name
+     * against this map and denies a non-listed tool with the non-pausing,
+     * permanent "disabled" kind — BEFORE autoApproveAll and grants, because
+     * enabled_tools is a capability manifest, not an approval gate (no bypass
+     * may resurrect a disabled tool, and no human may be offered "approve" on
+     * one). Unlike mcpToolPolicies (name-keyed, server-blind), this map is
+     * server-scoped: the hook payload carries the server identity, so equal
+     * tool names on different servers cannot cross-grant.
+     */
+    mcpServerEnabledTools: Record<string, string[]>;
     approvedGrants: ApprovalGrant[];
     approvedGrantTokens: string[];
     /**
@@ -271,13 +287,15 @@ export declare function buildApprovalGrants(pendingApprovals: PendingApproval[],
  * - leasedCategories: built-in categories with a run-lifetime lease
  * - mcpToolPolicies: per-tool policy for MCP tools requiring approval (leased
  *   servers are already absent — dropped upstream by mergeApprovalPolicies)
+ * - mcpServerEnabledTools: per-server enabled_tools allow-lists (issue #350,
+ *   restricted servers only) for the hook's permanent "disabled" arm
  * - approvedGrants / approvedGrantTokens: tools approved in the current HITL
  *   cycle, allowed through on reinvocation
  *
  * The static gated built-in set and its category mapping are baked into the
  * generated hook script (from approval-policy.ts), not carried here.
  */
-export declare function buildApprovalState(mergedPolicies: Map<string, MergedToolPolicy>, globalBypass: boolean, leasedCategories: ReadonlySet<ApprovalCategory>, grants?: ApprovalGrant[], captureMode?: boolean, captureIgnored?: boolean, gitWorkspace?: boolean, unattendedSkip?: boolean): ApprovalStateFile;
+export declare function buildApprovalState(mergedPolicies: Map<string, MergedToolPolicy>, globalBypass: boolean, leasedCategories: ReadonlySet<ApprovalCategory>, grants?: ApprovalGrant[], captureMode?: boolean, captureIgnored?: boolean, gitWorkspace?: boolean, unattendedSkip?: boolean, mcpServerEnabledTools?: Record<string, string[]>): ApprovalStateFile;
 /**
  * Write the approval state file into the session's HITL directory for the hook
  * script to read.
@@ -312,16 +330,24 @@ export declare function writeApprovalStateFile(hitlDir: string, state: ApprovalS
  *                     classification may never have run).
  * - `fail-closed`   — the approval state file was missing, so everything gated
  *                     denied. A turn-level "the gate itself was broken" fact.
+ * - `disabled`      — the agent's enabled_tools manifest excludes this MCP
+ *                     tool (issue #350). Permanent for the run and
+ *                     mode-independent: NOT an approval (a human must never be
+ *                     offered "approve" on a manifest-disabled tool), so it is
+ *                     non-pausing and the model adapts — the same consumer
+ *                     semantics as `secret`.
  *
  * An unknown kind string is preserved as-is: it is treated as non-pausing (an
  * unknown deny must never manufacture an approval) but still attributes the
  * blocked call to our own hook.
  */
-export type DenialKind = "approval" | "unattended" | "secret" | "capture-error" | "fail-closed";
+export type DenialKind = "approval" | "unattended" | "secret" | "capture-error" | "fail-closed" | "disabled";
 /** The one kind that pauses the run for user approval. */
 export declare const APPROVAL_DENIAL_KIND: DenialKind;
 /** The unattended-mode resolution kind (non-pausing; stamped SKIPPED). */
 export declare const UNATTENDED_DENIAL_KIND: DenialKind;
+/** The enabled_tools manifest denial kind (non-pausing, permanent; issue #350). */
+export declare const DISABLED_DENIAL_KIND: DenialKind;
 /**
  * One denial recorded by the preToolUse hook. `token` is the call's identity in
  * the same space as grantToken() (base64 of `toolName \n salientArg`), used to

package/dist/activities/execute-cursor/approval-state.js

@@ -13,6 +13,7 @@
  *   "mcpToolPolicies": {
  *     "apply_cloud_resource": { "requiresApproval": true, "message": "..." }
  *   },
+ *   "mcpServerEnabledTools": { "planton": ["get_cloud_resource"] },
  *   "approvedGrants": [{ "toolName": "edit", "mcpServerSlug": "", "key": "write", "salient": "a.txt", "contentDigest": "<sha256>" }],
  *   "approvedGrantTokens": ["<base64(key\nsalient[\ncontentDigest])>"]
  * }
@@ -228,13 +229,15 @@ function parseArgs(argsPreview) {
  * - leasedCategories: built-in categories with a run-lifetime lease
  * - mcpToolPolicies: per-tool policy for MCP tools requiring approval (leased
  *   servers are already absent — dropped upstream by mergeApprovalPolicies)
+ * - mcpServerEnabledTools: per-server enabled_tools allow-lists (issue #350,
+ *   restricted servers only) for the hook's permanent "disabled" arm
  * - approvedGrants / approvedGrantTokens: tools approved in the current HITL
  *   cycle, allowed through on reinvocation
  *
  * The static gated built-in set and its category mapping are baked into the
  * generated hook script (from approval-policy.ts), not carried here.
  */
-export function buildApprovalState(mergedPolicies, globalBypass, leasedCategories, grants, captureMode = false, captureIgnored = false, gitWorkspace = true, unattendedSkip = false) {
+export function buildApprovalState(mergedPolicies, globalBypass, leasedCategories, grants, captureMode = false, captureIgnored = false, gitWorkspace = true, unattendedSkip = false, mcpServerEnabledTools = {}) {
     const approvedGrants = grants ?? [];
     const mcpToolPolicies = {};
     for (const policy of mergedPolicies.values()) {
@@ -247,6 +250,7 @@ export function buildApprovalState(mergedPolicies, globalBypass, leasedCategorie
         autoApproveAll: globalBypass,
         leasedCategories: [...leasedCategories],
         mcpToolPolicies,
+        mcpServerEnabledTools,
         approvedGrants,
         // The hook matches a tool call's PRIMARY token (content when it can compute a
         // digest from tool_input, else coarse). A content-identified grant authorizes
@@ -288,6 +292,8 @@ const DENIAL_LEDGER_FILE = "denials.jsonl";
 export const APPROVAL_DENIAL_KIND = "approval";
 /** The unattended-mode resolution kind (non-pausing; stamped SKIPPED). */
 export const UNATTENDED_DENIAL_KIND = "unattended";
+/** The enabled_tools manifest denial kind (non-pausing, permanent; issue #350). */
+export const DISABLED_DENIAL_KIND = "disabled";
 /** The effective kind of a ledger entry (absent → approval, the pre-kind format). */
 export function denialKindOf(entry) {
     return entry.kind || APPROVAL_DENIAL_KIND;

package/dist/activities/execute-cursor/approval-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,sCAAsC,CAAC;AA8B9C,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAmGD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAoB;IACxE,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,cAA8B,EAC9B,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,yBAAyB;YACzB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;gBACtC,aAAa,EAAE,UAAU;gBACzB,mBAAmB,EAAE,qBAAqB;gBAC1C,WAAW,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC,EACtC,cAAoC;IAEpC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE;YACvD,gBAAgB,EAAE,EAAE,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,YAAqB,EACrB,gBAA+C,EAC/C,MAAwB,EACxB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,YAAY,GAAG,IAAI,EACnB,cAAc,GAAG,KAAK;IAEtB,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,eAAe;QACf,cAAc;QACd,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/F,WAAW;QACX,cAAc;QACd,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AA2B3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAe,UAAU,CAAC;AAE3D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAe,YAAY,CAAC;AA+B/D,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqC;IACrE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAmB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAK7B,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,+DAA+D;oBAC/D,sCAAsC;oBACtC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACrE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAwB1C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,sEAAsE;YACtE,qEAAqE;YACrE,qCAAqC;YACrC,cAAc,CAAC,GAAG,CAChB,EAAE,CAAC,EAAE,EACL,EAAE,CAAC,qBAAqB;gBACtB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,IAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;YACF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"approval-state.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/approval-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,kEAAkE,CAAC;AAIzG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EACL,yBAAyB,GAE1B,MAAM,sCAAsC,CAAC;AA8B9C,MAAM,UAAU,YAAY,CAC1B,QAAgB,EAChB,aAAqB,EACrB,IAAyC;IAEzC,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAkHD;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,OAAe;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,OAAO,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IAC9E,OAAO,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAoB;IACxE,OAAO,yBAAyB,CAAC,GAAG,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,cAA8B,EAC9B,WAAmB;IAEnB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,yBAAyB;YACzB,IAAI,CAAC,SAAS,CAAC;gBACb,WAAW;gBACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,QAAQ,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;gBACtC,aAAa,EAAE,UAAU;gBACzB,mBAAmB,EAAE,qBAAqB;gBAC1C,WAAW,EAAE,gBAAgB,CAAC,cAAc,EAAE,CAAC,CAAC;gBAChD,SAAS,EAAE,QAAQ;gBACnB,QAAQ,EAAE,KAAK;aAChB,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,gBAAmC,EACnC,SAAsC,EACtC,cAAoC;IAEpC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,gBAAgB,EAAE,CAAC;QAClC,yEAAyE;QACzE,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,cAAc,CAAC,OAAO,IAAI,QAAQ,KAAK,cAAc,CAAC,WAAW;YAAE,SAAS;QAE7F,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,2EAA2E;YAC3E,oCAAoC;YACpC,aAAa,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE;YACvD,gBAAgB,EAAE,EAAE,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAAC,WAAmB;IACpC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAA6C,EAC7C,YAAqB,EACrB,gBAA+C,EAC/C,MAAwB,EACxB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,YAAY,GAAG,IAAI,EACnB,cAAc,GAAG,KAAK,EACtB,wBAAkD,EAAE;IAEpD,MAAM,cAAc,GAAG,MAAM,IAAI,EAAE,CAAC;IAEpC,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,OAAO,EAAE,MAAM,CAAC,eAAe;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,eAAe;QACf,qBAAqB;QACrB,cAAc;QACd,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC;QAC/F,WAAW;QACX,cAAc;QACd,YAAY;QACZ,cAAc;KACf,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,KAAwB;IAExB,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAiC3C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAe,UAAU,CAAC;AAE3D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAe,YAAY,CAAC;AAE/D,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAe,UAAU,CAAC;AA+B3D,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,OAAO,KAAK,CAAC,IAAI,IAAI,oBAAoB,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAqC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqC;IACrE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,sBAAsB,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,OAAmB;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YACtD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,kBAAkB;gBAAE,OAAO,EAAE,CAAC;QAC9D,CAAC,CAAC,CAAC;QACH,2EAA2E;QAC3E,qEAAqE;QACrE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC;gBACH,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAK7B,CAAC;YACF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;oBAC9D,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,+DAA+D;oBAC/D,sCAAsC;oBACtC,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACrE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAY;IACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAwB1C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACjD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAe;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,QAAwB;IAExB,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEjD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,0BAA0B;gBAAE,SAAS;YACtE,IAAI,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;gBAAE,SAAS;YAE/D,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC;YACxC,sEAAsE;YACtE,qEAAqE;YACrE,qCAAqC;YACrC,cAAc,CAAC,GAAG,CAChB,EAAE,CAAC,EAAE,EACL,EAAE,CAAC,qBAAqB;gBACtB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,IAA+B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACrE,CAAC;YACF,gBAAgB,CAAC,IAAI,CACnB,MAAM,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,EAAE,CAAC,EAAE;gBACjB,QAAQ,EAAE,EAAE,CAAC,IAAI;gBACjB,OAAO,EAAE,EAAE,CAAC,eAAe;gBAC3B,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,aAAa,EAAE,EAAE,CAAC,aAAa;gBAC/B,WAAW,EAAE,EAAE,CAAC,mBAAmB;aACpC,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AACzD,CAAC"}

package/dist/activities/execute-cursor/attachment-resolver.d.ts

@@ -22,6 +22,13 @@
  * directives are built from the RESOLVED paths, so prompt and filesystem can
  * never disagree.
  *
+ * Duplicate filenames are renamed, never overwritten (issue #364): because
+ * placement keys purely on the filename, two attachments with the same name
+ * contend for one path — the later one takes the platform's `stem-2.ext`
+ * rename (shared/attachment-naming.ts, same semantics as the deep-agent
+ * injector and the React composer) and the rename is disclosed in the
+ * prompt's `<input_files>` section via {@link ResolvedAttachment.renamedFrom}.
+ *
  * Error model: fail-hard, matching the native harness's attachment injector.
  * Attachments are explicit user inputs — an execution that silently runs
  * without one produces silently incorrect results (the "plan file wasn't
@@ -32,9 +39,16 @@ import type { Attachment } from "@stigmer/protos/ai/stigmer/agentic/agentexecuti
 import type { ArtifactStorage } from "../../shared/artifact-storage.js";
 import { type VisionBudget, type VisionDegradedReason, type VisionImage } from "../../shared/attachment-vision.js";
 export interface ResolvedAttachment {
+    /** The final on-disk basename — after any duplicate rename. */
     filename: string;
     /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
     relativePath: string;
+    /**
+     * The attachment's original filename, present only when a duplicate name
+     * was renamed (shared/attachment-naming.ts) — rendered as disclosure in
+     * the prompt's `<input_files>` section.
+     */
+    renamedFrom?: string;
     /** Present when the attachment was accepted into the turn's vision payload. */
     vision?: VisionImage;
     /**

package/dist/activities/execute-cursor/attachment-resolver.js

@@ -22,6 +22,13 @@
  * directives are built from the RESOLVED paths, so prompt and filesystem can
  * never disagree.
  *
+ * Duplicate filenames are renamed, never overwritten (issue #364): because
+ * placement keys purely on the filename, two attachments with the same name
+ * contend for one path — the later one takes the platform's `stem-2.ext`
+ * rename (shared/attachment-naming.ts, same semantics as the deep-agent
+ * injector and the React composer) and the rename is disclosed in the
+ * prompt's `<input_files>` section via {@link ResolvedAttachment.renamedFrom}.
+ *
  * Error model: fail-hard, matching the native harness's attachment injector.
  * Attachments are explicit user inputs — an execution that silently runs
  * without one produces silently incorrect results (the "plan file wasn't
@@ -30,6 +37,7 @@
  */
 import { mkdir, copyFile, readFile, stat, writeFile } from "node:fs/promises";
 import { join, basename } from "node:path";
+import { allocateUniqueName } from "../../shared/attachment-naming.js";
 import { isVisionCandidate, } from "../../shared/attachment-vision.js";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
 import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "../../shared/workspace/stigmer-link.js";
@@ -60,18 +68,22 @@ export async function resolveAttachments(attachments, options) {
     // every resolved path below would dangle (the skill resolver also ensures
     // it, but only when the agent has skills).
     await ensureStigmerSymlink(options.primaryWorkspaceDir, platformDir);
+    // Placement keys purely on the filename, so this set is the whole
+    // collision domain — sequential resolution means each attachment sees
+    // every name claimed before it (see module doc on duplicate handling).
+    const takenNames = new Set();
     const results = [];
     for (const attachment of attachments) {
-        results.push(await resolveAttachment(attachment, inputsDir, options));
+        results.push(await resolveAttachment(attachment, inputsDir, takenNames, options));
     }
     console.log(`[attachment-resolver] resolved ${results.length} attachment(s): ` +
         results.map((r) => r.relativePath).join(", "));
     return results;
 }
-async function resolveAttachment(attachment, inputsDir, options) {
+async function resolveAttachment(attachment, inputsDir, takenNames, options) {
     // Local-mode fast path: the file is already on this machine's disk.
     if (options.mode === "local" && attachment.localPath) {
-        const filename = safeInputName(attachment.filename || attachment.localPath);
+        const { name: filename, renamedFrom } = allocateUniqueName(safeInputName(attachment.filename || attachment.localPath), takenNames);
         let vision;
         try {
             vision = await materializeLocalFile(attachment, filename, inputsDir, options.visionBudget);
@@ -83,6 +95,7 @@ async function resolveAttachment(attachment, inputsDir, options) {
         return {
             filename,
             relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
+            ...(renamedFrom !== undefined ? { renamedFrom } : {}),
             ...visionOutcomeFields(vision),
         };
     }
@@ -94,7 +107,7 @@ async function resolveAttachment(attachment, inputsDir, options) {
         throw new AttachmentResolutionError(attachment.filename, `artifact storage is unavailable, so this attachment ` +
             `(key: ${attachment.storageKey}) cannot be downloaded`);
     }
-    const filename = safeInputName(attachment.filename || attachment.storageKey);
+    const { name: filename, renamedFrom } = allocateUniqueName(safeInputName(attachment.filename || attachment.storageKey), takenNames);
     let content;
     try {
         content = await options.storage.download(attachment.storageKey);
@@ -111,6 +124,7 @@ async function resolveAttachment(attachment, inputsDir, options) {
     return {
         filename,
         relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
+        ...(renamedFrom !== undefined ? { renamedFrom } : {}),
         ...visionOutcomeFields(vision),
     };
 }

package/dist/activities/execute-cursor/attachment-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EACL,iBAAiB,GAKlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEvG,MAAM,aAAa,GAAG,QAAQ,CAAC;AAmC/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,OAAkC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAErE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,kBAAkB;QAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,SAAiB,EACjB,OAAkC;IAElC,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACpE,GAAG,mBAAmB,CAAC,MAAM,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,sDAAsD;YACtD,SAAS,UAAU,CAAC,UAAU,wBAAwB,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,KAAK;YACnE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEpD,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEtF,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;QACpE,GAAG,mBAAmB,CAAC,MAAM,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,UAAsB,EACtB,QAAgB,EAChB,SAAiB,EACjB,YAAsC;IAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkC;IAElC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAChC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE;QAC3B,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CACjC,GAAG,EACH,IAAI,GAAG,wDAAwD,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EACL,iBAAiB,GAKlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEvG,MAAM,aAAa,GAAG,QAAQ,CAAC;AA0C/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,OAAkC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAErE,kEAAkE;IAClE,sEAAsE;IACtE,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,kBAAkB;QAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,SAAiB,EACjB,UAAuB,EACvB,OAAkC;IAElC,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACxD,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC,EAC1D,UAAU,CACX,CAAC;QACF,IAAI,MAAiC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;YACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,sDAAsD;YACtD,SAAS,UAAU,CAAC,UAAU,wBAAwB,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,kBAAkB,CACxD,aAAa,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,EAC3D,UAAU,CACX,CAAC;IACF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,KAAK;YACnE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEpD,uEAAuE;IACvE,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEtF,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;QACpE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,mBAAmB,CAAC,MAAM,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,UAAsB,EACtB,QAAgB,EAChB,SAAiB,EACjB,YAAsC;IAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,gEAAgE;IAChE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAkC;IAElC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAChC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE;QAC3B,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,yBAAyB,CACjC,GAAG,EACH,IAAI,GAAG,wDAAwD,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/activities/execute-cursor/blueprint-resolver.d.ts

@@ -18,6 +18,7 @@ import type { SessionSpec } from "@stigmer/protos/ai/stigmer/agentic/session/v1/
 import type { WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { CloudRepo } from "./session-lifecycle.js";
+export { mergeMcpServerUsages } from "../../shared/mcp-resolver.js";
 export interface ResolvedBlueprint {
     agent: Agent;
     agentSpec: AgentSpec;
@@ -55,15 +56,6 @@ export declare function resolveBlueprint(client: StigmerClient, session: Session
  * Always computed (cheap iteration) but only consumed when mode is cloud.
  */
 export declare function resolveCloudRepos(workspaceEntries: WorkspaceEntry[]): CloudRepo[];
-/**
- * Merge MCP server usages from agent (base) and session (overlay).
- *
- * Replicates session_context_merge.py::merge_mcp_server_usages():
- * - Agent-level usages are the base set
- * - Session-level usages extend or override by mcp_server_ref.slug
- * - If both reference the same slug, session-level takes precedence
- */
-export declare function mergeMcpServerUsages(agentUsages: McpServerUsage[], sessionUsages: McpServerUsage[]): McpServerUsage[];
 /**
  * Merge skill refs from agent and session.
  *

package/dist/activities/execute-cursor/blueprint-resolver.js

@@ -11,6 +11,12 @@
  * containing runner-internal markers are rejected with a warning.
  */
 import { resolve } from "node:path";
+import { mergeMcpServerUsages } from "../../shared/mcp-resolver.js";
+// Both harnesses must merge agent + session usages identically (session wins
+// per slug — the usage whose enabled_tools the enforcement honors), so the
+// merge lives in shared/mcp-resolver.ts. Re-exported here for its historical
+// home alongside mergeSkillRefs.
+export { mergeMcpServerUsages } from "../../shared/mcp-resolver.js";
 /**
  * Path segments that identify runner-internal directories. Any workspace dir
  * whose resolved absolute path contains one of these is rejected.
@@ -77,28 +83,6 @@ export function resolveCloudRepos(workspaceEntries) {
 // ---------------------------------------------------------------------------
 // MCP and skill merging
 // ---------------------------------------------------------------------------
-/**
- * Merge MCP server usages from agent (base) and session (overlay).
- *
- * Replicates session_context_merge.py::merge_mcp_server_usages():
- * - Agent-level usages are the base set
- * - Session-level usages extend or override by mcp_server_ref.slug
- * - If both reference the same slug, session-level takes precedence
- */
-export function mergeMcpServerUsages(agentUsages, sessionUsages) {
-    const bySlug = new Map();
-    for (const usage of agentUsages) {
-        const slug = usage.mcpServerRef?.slug;
-        if (slug)
-            bySlug.set(slug, usage);
-    }
-    for (const usage of sessionUsages) {
-        const slug = usage.mcpServerRef?.slug;
-        if (slug)
-            bySlug.set(slug, usage);
-    }
-    return [...bySlug.values()];
-}
 /**
  * Merge skill refs from agent and session.
  *

package/dist/activities/execute-cursor/blueprint-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/blueprint-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC;;;GAGG;AACH,MAAM,uBAAuB,GAAG;IAC9B,0BAA0B;IAC1B,yBAAyB;CACjB,CAAC;AAuBX;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,OAAgB,EAChB,oBAA4B;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAK,CAAC;IAElC,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAK,CAAC;IAE9B,MAAM,qBAAqB,GAAG,oBAAoB,CAChD,SAAS,CAAC,eAAe,EACzB,WAAW,CAAC,eAAe,CAC5B,CAAC;IAEF,MAAM,eAAe,GAAG,cAAc,CACpC,SAAS,CAAC,SAAS,EACnB,WAAW,CAAC,SAAS,CACtB,CAAC;IAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEnE,OAAO;QACL,KAAK;QACL,SAAS;QACT,OAAO;QACP,WAAW;QACX,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,qBAAqB;QACrB,eAAe;QACf,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,aAAa;QACb,UAAU;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,gBAAkC;IAClE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC;gBACT,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,WAAW,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAA6B,EAC7B,aAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC;QACtC,IAAI,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiC,EACjC,WAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,WAAwB,EACxB,WAAmB;IAEnB,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,CAAC;QACpD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAExD,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,MAAc;IACtD,OAAO,CAAC,IAAI,CACV,sBAAsB,MAAM,MAAM,GAAG,iCAAiC;QACtE,qDAAqD,CACtD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"blueprint-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/blueprint-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,iCAAiC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE;;;GAGG;AACH,MAAM,uBAAuB,GAAG;IAC9B,0BAA0B;IAC1B,yBAAyB;CACjB,CAAC;AAuBX;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,OAAgB,EAChB,oBAA4B;IAE5B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAK,CAAC;IAElC,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAK,CAAC;IAE9B,MAAM,qBAAqB,GAAG,oBAAoB,CAChD,SAAS,CAAC,eAAe,EACzB,WAAW,CAAC,eAAe,CAC5B,CAAC;IAEF,MAAM,eAAe,GAAG,cAAc,CACpC,SAAS,CAAC,SAAS,EACnB,WAAW,CAAC,SAAS,CACtB,CAAC;IAEF,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAEnE,OAAO;QACL,KAAK;QACL,SAAS;QACT,OAAO;QACP,WAAW;QACX,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,qBAAqB;QACrB,eAAe;QACf,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,aAAa;QACb,UAAU;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,gBAAkC;IAClE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC;gBACT,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,WAAW,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAiC,EACjC,WAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAC3B,WAAwB,EACxB,WAAmB;IAEnB,MAAM,YAAY,GAAG,oBAAoB,CAAC,WAAW,CAAC;QACpD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IAExD,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,MAAc;IACtD,OAAO,CAAC,IAAI,CACV,sBAAsB,MAAM,MAAM,GAAG,iCAAiC;QACtE,qDAAqD,CACtD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/activities/execute-cursor/env-resolver.js

@@ -14,7 +14,9 @@
 export async function resolveExecutionEnv(client, executionId) {
     // A desktop runner exchanges its bootstrap credential for a token scoped to
     // this execution's session, so cloud's decrypt gate binds the read (#156).
-    // No-op for cloud sandbox and OSS runners.
+    // No-op for cloud sandbox and OSS runners. A failed exchange throws and
+    // fails the activity: the bootstrap credential no longer decrypts
+    // (stigmer-cloud#218), so proceeding would resolve redacted placeholders.
     const scopedToken = await client.acquireScopedRunnerToken({
         agentExecutionId: executionId,
     });

package/dist/activities/execute-cursor/env-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EACrB,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyB,EAAE,IAAI,CAAC;QAC9C,4DAA4D;QAC5D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,2CAA2C,WAAW,KAAK;gBACzD,oCAAoC,CACvC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAEhC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,8CAA8C;QAC5C,cAAc,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI;QACtC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI;QAC5C,gBAAgB,UAAU,CAAC,IAAI,IAAI;QACnC,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"env-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAqB,EACrB,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyB,EAAE,IAAI,CAAC;QAC9C,4DAA4D;QAC5D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CACT,2CAA2C,WAAW,KAAK;gBACzD,oCAAoC,CACvC,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAEhC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAC/B,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,8CAA8C;QAC5C,cAAc,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI;QACtC,aAAa,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,IAAI;QAC5C,gBAAgB,UAAU,CAAC,IAAI,IAAI;QACnC,SAAS,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrD,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}