@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/dist/activities/execute-cursor/error-classifier.d.ts

@@ -7,8 +7,9 @@
  * 3. Surface isRetryable for future workflow-level retry decisions
  *
  * Error detail can come from several sources (in priority order):
- * - A thrown CursorSdkError's structured fields (highest fidelity)
- * - run.wait().result (SDK-provided string, often bare/generic)
+ * - Structured fields, either from a thrown CursorSdkError or lifted from a
+ *   structured run.wait() error value (highest fidelity)
+ * - run.wait() error text (SDK-provided string, often bare/generic)
  * - SDKStatusMessage with status "ERROR" from the stream
  * - ConnectError captured from process unhandledRejection
  * - Text extracted from the failing run.conversation() turn
@@ -28,7 +29,8 @@ export interface ClassifiedError {
 }
 /**
  * Structured fields lifted from a thrown CursorSdkError (errors.d.ts:
- * { code, status, isRetryable, cause, endpoint, requestId, operation }).
+ * { code, status, isRetryable, cause, endpoint, requestId, operation }) or
+ * from a structured run.wait() error value (see extractRunErrorSources).
  * Only the fields used for classification are retained.
  */
 export interface SdkErrorFields {
@@ -36,6 +38,60 @@ export interface SdkErrorFields {
     status?: number;
     message?: string;
 }
+/**
+ * Error detail lifted from a run.wait() result, split by fidelity: structured
+ * values land in sdkError, plain text in sdkResultFields. At most one of the
+ * two is set; both undefined means the result carried nothing usable and the
+ * classifier's lower-priority sources should decide.
+ */
+export interface RunErrorSources {
+    sdkError: SdkErrorFields | undefined;
+    sdkResultFields: string | undefined;
+}
+/**
+ * Lift error detail from a run.wait() result whose status is "error".
+ *
+ * The SDK types RunResult.result as `string`, but structured values (Error
+ * instances, { code, message } objects) have been observed at runtime, both
+ * in `result` and in the undeclared error/message/reason fields (oss#299).
+ * A bare String() on those yields "[object Object]", which both destroys the
+ * message users see and — worse — shadows the lower-priority classifier
+ * sources (stream, rejection, conversation introspection) that often hold
+ * the real reason.
+ *
+ * Walks the candidate fields in order and answers from the FIRST one that
+ * yields usable content: strings keep flowing to the string channel
+ * (sdkResultFields), structured values are lifted into the same structured
+ * channel a thrown CursorSdkError uses (sdkError), and hopeless values are
+ * skipped so a later candidate — or the classifier's fallback sources — can
+ * win. (The previous `??` chain stopped at the first non-nullish value, so a
+ * hopeless object or empty string hid usable text one field later.)
+ *
+ * Deliberately NO JSON.stringify fallback for unrecognized object shapes:
+ * the error arm already logs the raw result in full server-side, and a JSON
+ * blob shown to the user would shadow the introspection sources that exist
+ * precisely to recover the real reason.
+ */
+export declare function extractRunErrorSources(result: unknown): RunErrorSources;
+/**
+ * Stable lead sentence of the detail-free fallback error (all five detail
+ * channels empty — empirically the shape of Cursor-side capacity rejections,
+ * oss#492). This is what end users read in embedded surfaces, so it must be
+ * actionable product copy, not a diagnostic; the diagnostic context follows
+ * in a parenthetical. Mirrors the COST_LIMIT_ERROR_PREFIX convention: a
+ * consumer that needs to recognize this failure can match on the prefix.
+ * Do not reword without checking consumers, and NEVER include the phrase
+ * "retry or resume" — sdk-react's isInterruptedError (MessageThread.tsx)
+ * reframes any error containing it as a neutral resumable notice instead of
+ * a failure alert.
+ */
+export declare const DETAIL_FREE_FALLBACK_USER_PREFIX = "The model may be temporarily overloaded \u2014 please retry, or switch to a different model.";
+/**
+ * Stable lead sentence of the transport-timeout fallback error (0 messages,
+ * ~30s duration — the SDK's default timeout with no stream established).
+ * Same user-facing rules as DETAIL_FREE_FALLBACK_USER_PREFIX above.
+ */
+export declare const TRANSPORT_TIMEOUT_USER_PREFIX = "The connection to the model could not be established \u2014 please retry.";
 interface SynthesizeErrorOpts {
     /** Structured fields from a thrown CursorSdkError — highest-fidelity source. */
     sdkError?: SdkErrorFields;

package/dist/activities/execute-cursor/error-classifier.js

@@ -7,8 +7,9 @@
  * 3. Surface isRetryable for future workflow-level retry decisions
  *
  * Error detail can come from several sources (in priority order):
- * - A thrown CursorSdkError's structured fields (highest fidelity)
- * - run.wait().result (SDK-provided string, often bare/generic)
+ * - Structured fields, either from a thrown CursorSdkError or lifted from a
+ *   structured run.wait() error value (highest fidelity)
+ * - run.wait() error text (SDK-provided string, often bare/generic)
  * - SDKStatusMessage with status "ERROR" from the stream
  * - ConnectError captured from process unhandledRejection
  * - Text extracted from the failing run.conversation() turn
@@ -18,6 +19,98 @@
  * the agent was obtained via resume, the error is upgraded to "agent-stale"
  * so that poisoned-handle recovery fires.
  */
+/**
+ * What String() produces for any plain object. Carries zero signal, so it is
+ * refused everywhere: extraction never emits it, and classifyFromSources
+ * treats it as absent should any other producer leak it through.
+ */
+const OBJECT_JUNK_STRING = "[object Object]";
+const NO_RUN_ERROR_SOURCES = {
+    sdkError: undefined,
+    sdkResultFields: undefined,
+};
+/**
+ * Lift error detail from a run.wait() result whose status is "error".
+ *
+ * The SDK types RunResult.result as `string`, but structured values (Error
+ * instances, { code, message } objects) have been observed at runtime, both
+ * in `result` and in the undeclared error/message/reason fields (oss#299).
+ * A bare String() on those yields "[object Object]", which both destroys the
+ * message users see and — worse — shadows the lower-priority classifier
+ * sources (stream, rejection, conversation introspection) that often hold
+ * the real reason.
+ *
+ * Walks the candidate fields in order and answers from the FIRST one that
+ * yields usable content: strings keep flowing to the string channel
+ * (sdkResultFields), structured values are lifted into the same structured
+ * channel a thrown CursorSdkError uses (sdkError), and hopeless values are
+ * skipped so a later candidate — or the classifier's fallback sources — can
+ * win. (The previous `??` chain stopped at the first non-nullish value, so a
+ * hopeless object or empty string hid usable text one field later.)
+ *
+ * Deliberately NO JSON.stringify fallback for unrecognized object shapes:
+ * the error arm already logs the raw result in full server-side, and a JSON
+ * blob shown to the user would shadow the introspection sources that exist
+ * precisely to recover the real reason.
+ */
+export function extractRunErrorSources(result) {
+    if (result === null || typeof result !== "object")
+        return NO_RUN_ERROR_SOURCES;
+    const r = result;
+    for (const candidate of [r.result, r.error, r.message, r.reason]) {
+        const extracted = extractFromCandidate(candidate);
+        if (extracted)
+            return extracted;
+    }
+    return NO_RUN_ERROR_SOURCES;
+}
+function extractFromCandidate(v) {
+    if (v == null)
+        return undefined;
+    if (typeof v === "string") {
+        if (v.length === 0 || v === OBJECT_JUNK_STRING)
+            return undefined;
+        return { sdkError: undefined, sdkResultFields: v };
+    }
+    if (typeof v === "object") {
+        // Covers Error instances too: their message (and, on SDK/Node error
+        // shapes, code/status) are readable as plain properties.
+        const o = v;
+        const fields = {};
+        if (typeof o.code === "string" && o.code.length > 0)
+            fields.code = o.code;
+        if (typeof o.status === "number")
+            fields.status = o.status;
+        if (typeof o.message === "string" && o.message.length > 0)
+            fields.message = o.message;
+        if (fields.code !== undefined || fields.status !== undefined || fields.message !== undefined) {
+            return { sdkError: fields, sdkResultFields: undefined };
+        }
+        return undefined;
+    }
+    // Remaining primitives (number, boolean, ...) stringify losslessly.
+    const text = String(v);
+    return text.length > 0 ? { sdkError: undefined, sdkResultFields: text } : undefined;
+}
+/**
+ * Stable lead sentence of the detail-free fallback error (all five detail
+ * channels empty — empirically the shape of Cursor-side capacity rejections,
+ * oss#492). This is what end users read in embedded surfaces, so it must be
+ * actionable product copy, not a diagnostic; the diagnostic context follows
+ * in a parenthetical. Mirrors the COST_LIMIT_ERROR_PREFIX convention: a
+ * consumer that needs to recognize this failure can match on the prefix.
+ * Do not reword without checking consumers, and NEVER include the phrase
+ * "retry or resume" — sdk-react's isInterruptedError (MessageThread.tsx)
+ * reframes any error containing it as a neutral resumable notice instead of
+ * a failure alert.
+ */
+export const DETAIL_FREE_FALLBACK_USER_PREFIX = "The model may be temporarily overloaded — please retry, or switch to a different model.";
+/**
+ * Stable lead sentence of the transport-timeout fallback error (0 messages,
+ * ~30s duration — the SDK's default timeout with no stream established).
+ * Same user-facing rules as DETAIL_FREE_FALLBACK_USER_PREFIX above.
+ */
+export const TRANSPORT_TIMEOUT_USER_PREFIX = "The connection to the model could not be established — please retry.";
 const AUTH_PATTERNS = [
     "unauthenticated", "unauthorized", "401", "forbidden",
     "permission_denied", "invalid api key", "not logged in",
@@ -117,7 +210,11 @@ function classifyFromSources(opts) {
         }
     }
     if (opts.sdkResultFields) {
-        const isBareGeneric = opts.sdkResultFields === "Cursor run failed";
+        // "Cursor run failed" is the SDK's bare generic; "[object Object]" is
+        // String()-coerced junk from any producer that bypassed the shape-aware
+        // extraction. Neither carries signal — fall through to better sources.
+        const isBareGeneric = opts.sdkResultFields === "Cursor run failed"
+            || opts.sdkResultFields === OBJECT_JUNK_STRING;
         if (!isBareGeneric) {
             const { category, retryable } = classifyText(opts.sdkResultFields);
             return {
@@ -171,7 +268,9 @@ function classifyFromSources(opts) {
         const { model, mode, agentId } = opts.fallbackContext;
         return {
             category: "network",
-            message: `Transport timeout (${opts.durationMs}ms, 0 messages received). Model=${model}, mode=${mode}, agentId=${agentId}`,
+            message: `${TRANSPORT_TIMEOUT_USER_PREFIX} ` +
+                `(Transport timeout: ${opts.durationMs}ms, 0 messages received. ` +
+                `Model=${model}, mode=${mode}, agentId=${agentId})`,
             retryable: true,
             source: "fallback",
         };
@@ -184,11 +283,21 @@ function classifyFromSources(opts) {
             source: "fallback",
         };
     }
+    // The honest last resort: every detail channel was empty. Observed in prod
+    // only during provider capacity incidents (oss#492: Composer 2.5 degradation
+    // — the SDK rejection that carries ERROR_RESOURCE_EXHAUSTED in Cursor's IDE
+    // arrives here detail-free), so the copy leads with the capacity hypothesis
+    // hedged ("may be"), and retryable is true: the observed cause is transient
+    // by nature, and nothing gates a recovery loop on unknown+retryable. The
+    // parenthetical keeps the exact Model=/mode=/agentId= tokens for log-grep
+    // continuity and the env integration test's matcher.
     const { model, mode, agentId } = opts.fallbackContext;
     return {
         category: "unknown",
-        message: `Cursor run failed (no detail from SDK). Model=${model}, mode=${mode}, agentId=${agentId}`,
-        retryable: false,
+        message: `${DETAIL_FREE_FALLBACK_USER_PREFIX} ` +
+            `(No error detail from the Cursor SDK. ` +
+            `Model=${model}, mode=${mode}, agentId=${agentId})`,
+        retryable: true,
         source: "fallback",
     };
 }

package/dist/activities/execute-cursor/error-classifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-classifier.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/error-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA+BH,MAAM,aAAa,GAAG;IACpB,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW;IACrD,mBAAmB,EAAE,iBAAiB,EAAE,eAAe;CACxD,CAAC;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG;IACvB,2BAA2B,EAAE,oBAAoB;IACjD,sBAAsB,EAAE,6BAA6B;IACrD,aAAa,EAAE,iCAAiC;CACjD,CAAC;AACF,MAAM,mBAAmB,GAAG;IAC1B,oBAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU;CACtD,CAAC;AACF,MAAM,gBAAgB,GAAG;IACvB,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK;IAChD,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW;IACpD,eAAe,EAAE,cAAc,EAAE,gBAAgB;CAClD,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,eAAe,EAAE,iBAAiB,EAAE,sBAAsB;IAC1D,mBAAmB;CACpB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzF,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnF,IAAI,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD;QACjD,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAC7C,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI;QAC3D,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI;QACjE,wBAAwB,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI;QACpD,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI;QACvE,mBAAmB,IAAI,CAAC,eAAe,IAAI;QAC3C,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,UAAU,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CACzE,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9D,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAyB;IACpD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChD,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC;aACtE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aACjE,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,SAAS;gBACT,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,KAAK,mBAAmB,CAAC;QACnE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnE,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,SAAS;gBACT,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,kBAAkB;YAChC,SAAS;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAC/B,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CACnE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,OAAO,EAAE,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE;YAC7E,qEAAqE;YACrE,qDAAqD;YACrD,SAAS,EAAE,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,SAAS;YACxD,MAAM,EAAE,WAAW;SACpB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzE,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,qBAAqB;YACnC,SAAS;YACT,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,qEAAqE;IACrE,IACE,IAAI,CAAC,YAAY,KAAK,CAAC;WACpB,IAAI,CAAC,UAAU,IAAI,IAAI;WACvB,IAAI,CAAC,UAAU,IAAI,KAAK;WACxB,IAAI,CAAC,UAAU,IAAI,KAAK;WACxB,CAAC,IAAI,CAAC,eAAe,EACxB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACtD,OAAO;YACL,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,sBAAsB,IAAI,CAAC,UAAU,mCAAmC,KAAK,UAAU,IAAI,aAAa,OAAO,EAAE;YAC1H,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,2EAA2E;YACpF,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;IACtD,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,iDAAiD,KAAK,UAAU,IAAI,aAAa,OAAO,EAAE;QACnG,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,OAAO,GAAG,GAAG,CAAC,OAAO,cAAc,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,GAAG,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,OAAO,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;AACtE,CAAC"}
+{"version":3,"file":"error-classifier.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/error-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgCH;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAa7C,MAAM,oBAAoB,GAAoB;IAC5C,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,SAAS;CAC3B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAe;IACpD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC;IAC/E,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,KAAK,MAAM,SAAS,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAU;IACtC,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACjE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,oEAAoE;QACpE,yDAAyD;QACzD,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,oEAAoE;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,yFAAyF,CAAC;AAE5F;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GACxC,sEAAsE,CAAC;AAEzE,MAAM,aAAa,GAAG;IACpB,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW;IACrD,mBAAmB,EAAE,iBAAiB,EAAE,eAAe;CACxD,CAAC;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG;IACvB,2BAA2B,EAAE,oBAAoB;IACjD,sBAAsB,EAAE,6BAA6B;IACrD,aAAa,EAAE,iCAAiC;CACjD,CAAC;AACF,MAAM,mBAAmB,GAAG;IAC1B,oBAAoB,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU;CACtD,CAAC;AACF,MAAM,gBAAgB,GAAG;IACvB,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,KAAK;IAChD,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW;IACpD,eAAe,EAAE,cAAc,EAAE,gBAAgB;CAClD,CAAC;AACF,MAAM,cAAc,GAAG;IACrB,eAAe,EAAE,iBAAiB,EAAE,sBAAsB;IAC1D,mBAAmB;CACpB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzF,IAAI,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnF,IAAI,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACxF,IAAI,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC;AAkBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD;QACjD,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;QAC7C,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI;QAC3D,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI;QACjE,wBAAwB,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI;QACpD,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI;QACvE,mBAAmB,IAAI,CAAC,eAAe,IAAI;QAC3C,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,UAAU,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CACzE,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9D,OAAO,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAyB;IACpD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAChD,2EAA2E;QAC3E,mCAAmC;QACnC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC;aACtE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;aACjE,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnD,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,SAAS;gBACT,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,KAAK,mBAAmB;eAC7D,IAAI,CAAC,eAAe,KAAK,kBAAkB,CAAC;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnE,OAAO;gBACL,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,eAAe;gBAC7B,SAAS;gBACT,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtE,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,kBAAkB;YAChC,SAAS;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAC/B,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CACnE,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACvD,OAAO,EAAE,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE;YAC7E,qEAAqE;YACrE,qDAAqD;YACrD,SAAS,EAAE,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,SAAS;YACxD,MAAM,EAAE,WAAW;SACpB,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzE,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,IAAI,CAAC,qBAAqB;YACnC,SAAS;YACT,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,2EAA2E;IAC3E,qEAAqE;IACrE,IACE,IAAI,CAAC,YAAY,KAAK,CAAC;WACpB,IAAI,CAAC,UAAU,IAAI,IAAI;WACvB,IAAI,CAAC,UAAU,IAAI,KAAK;WACxB,IAAI,CAAC,UAAU,IAAI,KAAK;WACxB,CAAC,IAAI,CAAC,eAAe,EACxB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QACtD,OAAO;YACL,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,GAAG,6BAA6B,GAAG;gBACnC,uBAAuB,IAAI,CAAC,UAAU,2BAA2B;gBACjE,SAAS,KAAK,UAAU,IAAI,aAAa,OAAO,GAAG;YACrD,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,2EAA2E;YACpF,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,UAAU;SACnB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;IACtD,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,OAAO,EACL,GAAG,gCAAgC,GAAG;YACtC,wCAAwC;YACxC,SAAS,KAAK,UAAU,IAAI,aAAa,OAAO,GAAG;QACrD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAoB;IACxD,OAAO,GAAG,GAAG,CAAC,OAAO,cAAc,GAAG,CAAC,QAAQ,YAAY,GAAG,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,GAAG,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAoB;IAC5D,OAAO,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;AACtE,CAAC"}

package/dist/activities/execute-cursor/extract-structured-output.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Tier-2 structured-output extraction for the Cursor harness.
+ *
+ * When tier-1 text extraction (shared/extract-json.ts) cannot find JSON in
+ * the agent's free-text response, this tier asks an economy-tier LLM to
+ * extract it via withStructuredOutput (function-calling), which guarantees
+ * schema-conformant output through the API's tool-use mechanism.
+ *
+ * Lives in its own module (rather than inside execute-cursor/index.ts) so
+ * the LangChain construction path stays out of the Cursor activity's module
+ * graph until a run actually needs tier 2 — index.ts imports this module
+ * lazily at the call site, mirroring its tier-1 import, which is what
+ * bundle-slim's deferred evaluation preserves.
+ */
+import type { Config } from "../../config.js";
+/**
+ * Extract structured data from an agent's free-text response using an
+ * economy-tier LLM with withStructuredOutput (function-calling).
+ *
+ * Construction (registry-id resolution, provider inference, proxy wiring) is
+ * delegated to the shared buildChatModel so the economy model's registry id
+ * is always resolved to a provider API id before the call.
+ *
+ * Throws when no LLM is reachable (no proxy and no credential path for the
+ * extraction model's provider) — the caller treats any throw here as "tier 2
+ * unavailable", logs it, and returns the agent's text without structured
+ * output, so the failure mode is a diagnosable log line, never a lost run.
+ */
+export declare function extractStructuredOutput(agentResponse: string, schema: Record<string, unknown>, config: Config, primaryModel: string): Promise<unknown | null>;

package/dist/activities/execute-cursor/extract-structured-output.js

@@ -0,0 +1,58 @@
+/**
+ * Tier-2 structured-output extraction for the Cursor harness.
+ *
+ * When tier-1 text extraction (shared/extract-json.ts) cannot find JSON in
+ * the agent's free-text response, this tier asks an economy-tier LLM to
+ * extract it via withStructuredOutput (function-calling), which guarantees
+ * schema-conformant output through the API's tool-use mechanism.
+ *
+ * Lives in its own module (rather than inside execute-cursor/index.ts) so
+ * the LangChain construction path stays out of the Cursor activity's module
+ * graph until a run actually needs tier 2 — index.ts imports this module
+ * lazily at the call site, mirroring its tier-1 import, which is what
+ * bundle-slim's deferred evaluation preserves.
+ */
+import { getEconomyModel } from "../../shared/model-registry.js";
+import { buildChatModel } from "../../shared/model-client.js";
+import { checkDirectCredentials } from "../../shared/llm-backend.js";
+import { tryInferProvider } from "../../shared/llm-proxy.js";
+import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
+/**
+ * Extract structured data from an agent's free-text response using an
+ * economy-tier LLM with withStructuredOutput (function-calling).
+ *
+ * Construction (registry-id resolution, provider inference, proxy wiring) is
+ * delegated to the shared buildChatModel so the economy model's registry id
+ * is always resolved to a provider API id before the call.
+ *
+ * Throws when no LLM is reachable (no proxy and no credential path for the
+ * extraction model's provider) — the caller treats any throw here as "tier 2
+ * unavailable", logs it, and returns the agent's text without structured
+ * output, so the failure mode is a diagnosable log line, never a lost run.
+ */
+export async function extractStructuredOutput(agentResponse, schema, config, primaryModel) {
+    const extractionModel = await getEconomyModel(primaryModel);
+    const proxyEndpoint = config.proxyEndpoint ?? undefined;
+    if (!proxyEndpoint) {
+        const provider = tryInferProvider(extractionModel);
+        const missing = provider === null ? null : checkDirectCredentials(provider);
+        if (missing !== null) {
+            throw new Error(`Structured-output extraction needs the ${provider} model ` +
+                `'${extractionModel}' but has no credential path. ${missing}`);
+        }
+    }
+    const { model: llm } = await buildChatModel({
+        modelName: extractionModel,
+        proxyEndpoint,
+        stigmerToken: config.stigmerToken ?? undefined,
+        maxTokens: 4096,
+    });
+    const zodSchema = jsonSchemaToZod(schema);
+    const structured = llm.withStructuredOutput(zodSchema);
+    const result = await structured.invoke([
+        { role: "system", content: "Extract the structured data from the agent's response. Return only the data that matches the schema." },
+        { role: "user", content: agentResponse },
+    ]);
+    return result ?? null;
+}
+//# sourceMappingURL=extract-structured-output.js.map

package/dist/activities/execute-cursor/extract-structured-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-structured-output.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/extract-structured-output.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,MAA+B,EAC/B,MAAc,EACd,YAAoB;IAEpB,MAAM,eAAe,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAExD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0CAA0C,QAAQ,SAAS;gBAC3D,IAAI,eAAe,iCAAiC,OAAO,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAAC;QAC1C,SAAS,EAAE,eAAe;QAC1B,aAAa;QACb,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;QAC9C,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;QACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sGAAsG,EAAE;QACnI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE;KACzC,CAAC,CAAC;IAEH,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC"}

package/dist/activities/execute-cursor/hook-script.d.ts

@@ -32,6 +32,8 @@
  *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
  *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
  *   - "fail-closed"   — approval state file missing, everything gated denies.
+ *   - "disabled"      — enabled_tools manifest exclusion (issue #350): the
+ *                       agent continues, no pause, permanent for the run.
  * Only approval-kind records carry the captured tool_input: a secret write's
  * content must never be persisted (DD-26), a capture-error's content is
  * UNCLASSIFIED (the staging error means secret classification may never have
@@ -84,8 +86,16 @@
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
- *    spec.auto_approve_all global bypass) → allow
+ * 1. Missing state file → deny (fail-closed)
+ * 1a. beforeMCPExecution event → tool excluded by the server's
+ *     mcpServerEnabledTools allow-list → record kind "disabled", deny.
+ *     Deliberately BEFORE autoApproveAll and the grant checks: enabled_tools
+ *     is a capability manifest, not an approval gate (issue #350) — no bypass
+ *     may resurrect a disabled tool, and no human may be offered "approve" on
+ *     one. Server-scoped via the payload's mcp_server_name; an absent slug in
+ *     the map means unrestricted.
+ * 1b. autoApproveAll (the pre-armed spec.auto_approve_all global bypass) →
+ *     allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
@@ -117,7 +127,8 @@
  *
  * From the pointer the script reads the current turn's approval-state file (the
  * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
- * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * mcpToolPolicies, mcpServerEnabledTools, approvedGrantTokens), denial ledger,
+ * and runner PID. The
  * static policy (which built-ins are gated, their categories, the salient arg
  * fields) is baked at generation time from approval-policy.ts.
  *

package/dist/activities/execute-cursor/hook-script.js

@@ -32,6 +32,8 @@
  *   - "secret"        — DD-26 secret hard-block: the agent continues, no pause.
  *   - "capture-error" — CAS staging failed, write kept on the deny-gate.
  *   - "fail-closed"   — approval state file missing, everything gated denies.
+ *   - "disabled"      — enabled_tools manifest exclusion (issue #350): the
+ *                       agent continues, no pause, permanent for the run.
  * Only approval-kind records carry the captured tool_input: a secret write's
  * content must never be persisted (DD-26), a capture-error's content is
  * UNCLASSIFIED (the staging error means secret classification may never have
@@ -84,8 +86,16 @@
  * set, allow the rest" — matching the native harness and avoiding denial of
  * auto-approved MCP tools (which are absent from mcpToolPolicies):
  * 0. Scope guard: not the runner's own agent → allow (never touch the ledger)
- * 1. Missing state file → deny (fail-closed); autoApproveAll (the pre-armed
- *    spec.auto_approve_all global bypass) → allow
+ * 1. Missing state file → deny (fail-closed)
+ * 1a. beforeMCPExecution event → tool excluded by the server's
+ *     mcpServerEnabledTools allow-list → record kind "disabled", deny.
+ *     Deliberately BEFORE autoApproveAll and the grant checks: enabled_tools
+ *     is a capability manifest, not an approval gate (issue #350) — no bypass
+ *     may resurrect a disabled tool, and no human may be offered "approve" on
+ *     one. Server-scoped via the payload's mcp_server_name; an absent slug in
+ *     the map means unrestricted.
+ * 1b. autoApproveAll (the pre-armed spec.auto_approve_all global bypass) →
+ *     allow
  * 2. beforeMCPExecution event → MCP tool present in mcpToolPolicies
  *    (require-approval):
  *    a. name token in approvedGrantTokens → allow (reinvocation grant)
@@ -143,6 +153,21 @@ const SECRET_BLOCKED_AGENT_MESSAGE = "This file was blocked for security because
     "misconfiguration, so never tell the user to change Cursor settings or enable " +
     "hooks. Do not retry this write or attempt a workaround; the write will not be " +
     "applied. Continue with the rest of the task.";
+// Shown to the model when an MCP tool call is denied because the agent's
+// enabled_tools manifest excludes the tool (issue #350). Like
+// SECRET_BLOCKED_AGENT_MESSAGE this must NOT promise a resume — the exclusion
+// is permanent for the run and mode-independent (it is a capability manifest,
+// not an approval, so nothing can be granted). Same embedding constraint
+// (single-quoted bash echo of a JSON object): no double quotes, apostrophes,
+// or backslashes.
+const DISABLED_TOOL_AGENT_MESSAGE = "This tool is not enabled for this agent: the MCP server exposes it, but the " +
+    "agent manifest (enabled_tools) excludes it. This is the platform capability " +
+    "manifest working as intended — it is not an error and not a Cursor " +
+    "misconfiguration, so never tell the user to change Cursor settings or enable " +
+    "hooks. Do not retry this tool or attempt a workaround; it will stay " +
+    "unavailable for this entire run. Use a different tool or adapt your plan, " +
+    "and if the task cannot proceed without it, tell the user plainly what was " +
+    "unavailable.";
 /**
  * Build the bash `case` arms that map an incoming hook `tool_name` to its
  * canonical approval category. Generated from approval-policy.ts so the hook and
@@ -195,14 +220,17 @@ function buildContentDigestScript() {
  * Build the inline Node.js identity extractor embedded in the hook script.
  *
  * Parses the hook's stdin JSON properly (the bash fallback's grep truncates
- * string values at the first escaped quote) and emits SEVEN lines: tool_name,
+ * string values at the first escaped quote) and emits NINE lines: tool_name,
  * canonical category, coarse identity token, MCP name-token, hook_event_name
  * (the event discriminator: `preToolUse` for built-ins, `beforeMCPExecution`
  * for MCP), base64(JSON(tool_input)) — the authoritative pre-execution args the
- * runner overlays onto the gated tool call for the approval preview — and the
+ * runner overlays onto the gated tool call for the approval preview — the
  * CONTENT token (base64(category \n salient \n contentDigest), empty when the
- * tool has no edit content). The token encodings must stay byte-identical to
- * grantToken()/contentToken() in approval-state.ts.
+ * tool has no edit content), base64(salient), and mcp_server_name (the MCP
+ * server slug the beforeMCPExecution payload carries; empty for built-ins) —
+ * the server scope for the enabled_tools manifest arm. The token encodings
+ * must stay byte-identical to grantToken()/contentToken() in
+ * approval-state.ts.
  *
  * Authored as a single-quoted bash string, so the JS must not contain single
  * quotes. The category map, salient field list, and edit/content field lists are
@@ -233,6 +261,7 @@ function buildNodeIdentityScript() {
         // is "" for a non-edit tool, in which case the content token (line 7) is "".
         buildContentDigestScript(),
         `const ev=typeof t.hook_event_name==="string"?t.hook_event_name:"";`,
+        `const srv=typeof t.mcp_server_name==="string"?t.mcp_server_name:"";`,
         // Line 6 is base64(JSON(tool_input)): the AUTHORITATIVE pre-execution args
         // the runner overlays onto the gated tool call so the approval card can show
         // the proposed change before the user approves. Base64 keeps the bash side
@@ -241,8 +270,10 @@ function buildNodeIdentityScript() {
         // grant the runner authorizes for a file edit. Line 8 is base64(salient) —
         // the raw resource value (file path / command) capture mode needs to run
         // `git check-ignore` on a file path; base64 keeps newlines/quotes out of the
-        // line-oriented bash parse.
-        `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s));`,
+        // line-oriented bash parse. Line 9 is mcp_server_name — the server scope
+        // the enabled_tools manifest arm matches against mcpServerEnabledTools
+        // (a bare slug, never quoted/escaped, so it rides as a plain line).
+        `process.stdout.write(name+"\\n"+cat+"\\n"+b(cat+"\\n"+s)+"\\n"+b(name+"\\n")+"\\n"+ev+"\\n"+b(JSON.stringify(a))+"\\n"+(dig?b(cat+"\\n"+s+"\\n"+dig):"")+"\\n"+b(s)+"\\n"+srv);`,
     ].join("");
 }
 /**
@@ -264,7 +295,8 @@ function buildNodeIdentityScript() {
  *
  * From the pointer the script reads the current turn's approval-state file (the
  * single source of truth for the dynamic inputs: autoApproveAll, leasedCategories,
- * mcpToolPolicies, approvedGrantTokens), denial ledger, and runner PID. The
+ * mcpToolPolicies, mcpServerEnabledTools, approvedGrantTokens), denial ledger,
+ * and runner PID. The
  * static policy (which built-ins are gated, their categories, the salient arg
  * fields) is baked at generation time from approval-policy.ts.
  *
@@ -425,6 +457,9 @@ if [ -n "$IDENTITY" ]; then
   # Raw salient (base64) — the file path / command. Capture mode decodes it to
   # run git check-ignore on a file path.
   SALIENT=$(printf '%s\\n' "$IDENTITY" | sed -n 8p | base64 -d 2>/dev/null || true)
+  # MCP server slug (beforeMCPExecution payloads only; empty for built-ins) —
+  # the server scope for the enabled_tools manifest arm.
+  MCP_SERVER=$(printf '%s\\n' "$IDENTITY" | sed -n 9p)
 else
   # Fallback when the Node binary cannot run: grep/cut extraction. Best-effort
   # only — '"field":"[^"]*"' truncates at the first JSON-escaped quote, so the
@@ -434,6 +469,10 @@ else
   # would otherwise abort the script and emit no decision.
   TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   HOOK_EVENT=$(echo "$INPUT" | grep -o '"hook_event_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
+  # Server slugs are plain identifiers (no JSON-escaped quotes), so the grep
+  # fallback extracts mcp_server_name reliably — the manifest arm keeps its
+  # full precision even without the Node binary.
+  MCP_SERVER=$(echo "$INPUT" | grep -o '"mcp_server_name":"[^"]*"' | head -1 | cut -d'"' -f4 || true)
   SALIENT=""
   for field in ${salientFields}; do
     v=$(echo "$INPUT" | grep -o "\\"$field\\":\\"[^\\"]*\\"" | head -1 | cut -d'"' -f4 || true)
@@ -573,7 +612,30 @@ if [ "$CAPTURE_IGNORED" = "true" ] && [ "$CATEGORY" = "write" ] && [ -n "$SALIEN
   fi
 fi
 
-# --- 1. Auto-approve all ---
+# --- 1a. MCP capability manifest: enabled_tools (issue #350) ---
+# Runs BEFORE the auto-approve-all shortcut and every grant check because
+# enabled_tools is a capability manifest, not an approval gate: no bypass may
+# resurrect a disabled tool and no human may be offered approval on one.
+# mcpServerEnabledTools holds ONLY restricted servers (an absent slug means
+# unrestricted, so this arm is inert for the common case). Matching is
+# server-scoped via the payload's mcp_server_name — equal tool names on
+# different servers cannot cross-grant — and the quoted-name membership check
+# is exact, never a substring match. Kind "disabled": attributable,
+# non-pausing (the model adapts, same consumer semantics as "secret"), and
+# permanent for the run.
+if [ "$HOOK_EVENT" = "beforeMCPExecution" ] && [ -n "$MCP_SERVER" ] && [ -n "$TOOL_NAME" ]; then
+  ENABLED_MAP=$(echo "$STATE" | grep -o '"mcpServerEnabledTools":{[^}]*}' | head -1 || true)
+  if [ -n "$ENABLED_MAP" ]; then
+    SERVER_ENABLED=$(echo "$ENABLED_MAP" | grep -o "\\"$MCP_SERVER\\":\\[[^]]*\\]" | head -1 || true)
+    if [ -n "$SERVER_ENABLED" ] && ! echo "$SERVER_ENABLED" | grep -qF "\\"$TOOL_NAME\\""; then
+      record_denial "$MCP_TOKEN" "disabled"
+      echo '{"permission":"deny","agent_message":"${DISABLED_TOOL_AGENT_MESSAGE}","user_message":"Tool not enabled for this agent: '"$TOOL_NAME"'"}'
+      exit 0
+    fi
+  fi
+fi
+
+# --- 1b. Auto-approve all ---
 if echo "$STATE" | grep -q '"autoApproveAll":true'; then
   echo '{"permission":"allow"}'
   exit 0

package/dist/activities/execute-cursor/hook-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,6BAA6B,GACjC,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,YAAY,CAAC;AAEf,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAoD8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAyDzC,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAmC3B,6BAA6B;;;;oDAI/B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2B9B,6BAA6B;;;;gDAI/B,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}
+{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,uEAAuE;AACvE,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,oEAAoE;AACpE,iEAAiE;AACjE,MAAM,6BAA6B,GACjC,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,YAAY,CAAC;AAEf,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD,yEAAyE;AACzE,8DAA8D;AAC9D,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,6EAA6E;AAC7E,kBAAkB;AAClB,MAAM,2BAA2B,GAC/B,8EAA8E;IAC9E,8EAA8E;IAC9E,qEAAqE;IACrE,+EAA+E;IAC/E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,cAAc,CAAC;AAEjB;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,qEAAqE;QACrE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,iLAAiL;KAClL,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkC5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAoD8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAyDzC,wBAAwB;iFACmB,wBAAwB;;;;;;;;kDAQvD,4BAA4B;;;;;;;;;kDAS5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;oDAsB7B,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAoCzB,6BAA6B;;;;oDAI/B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;;;;oDAKtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;kDA2B9B,6BAA6B;;;;gDAI/B,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}