@stigmer/runner 3.12.9 → 3.14.0-dev.20260910084630

package/src/activities/execute-cursor/__tests__/turn-boundary.test.ts

@@ -32,7 +32,7 @@ import {
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { captureBaselineToLedger } from "../capture-flow.js";
 import { denialLedgerPath } from "../approval-state.js";
-import { toolCallIdentityToken } from "../message-translator.js";
+import { toolCallIdentityToken, UNRESOLVED_TOOL_CALL_ERROR } from "../message-translator.js";
 import { runTurnBoundary, type TurnBoundaryOptions } from "../turn-boundary.js";
 
 const execFileAsync = promisify(execFile);
@@ -405,3 +405,155 @@ describe("runTurnBoundary", () => {
     expect(shellCall.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });
+
+// The issue #965 invariant: an unresolved tool must never silently complete.
+// The production fixture is aex_01m1a6ww3nmp4952ar5v0g4g85 — Cursor's native
+// `generateImage` (an interaction-channel tool no Stigmer seam touches) hung
+// with no result event and no ledger entry, the turn completed, and the model's
+// last words promised a write approval the platform never held. The boundary
+// must settle such rows to an honest INTERRUPTED and put the platform's own
+// disclosure on the transcript so the model's claim is never the last word.
+describe("runTurnBoundary — unresolved tool calls on a completing turn (issue #965)", () => {
+  /** The incident's exact row shape: a streamed call that never resolved. */
+  function hangingGenerateImage(id: string): AgentMessage {
+    return create(AgentMessageSchema, {
+      type: MessageType.MESSAGE_AI,
+      toolCalls: [
+        create(ToolCallSchema, {
+          id,
+          name: "generateImage",
+          status: ToolCallStatus.TOOL_CALL_RUNNING,
+          args: { description: "a red circle", filePath: "red-circle.png" },
+        }),
+      ],
+    });
+  }
+
+  it("settles the incident shape to INTERRUPTED and discloses it (regression: aex_01m1a6ww)", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status,
+      gitRoot: repo,
+      executionId: EXEC_ID,
+      changeSetId: CHANGE_SET_ID,
+    });
+    status.messages.push(hangingGenerateImage("tc-genimage-1"));
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    // The turn completes (no pause) — but not silently.
+    expect(result.waiting).toBe(false);
+    expect(result.settledUnresolvedCount).toBe(1);
+
+    const row = status.messages[0].toolCalls[0];
+    // INTERRUPTED, never FAILED: the one settled status a recovery replay may
+    // supersede (the #207 contract) — a FAILED stamp would freeze the row.
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_INTERRUPTED);
+    expect(row.error).toBe(UNRESOLVED_TOOL_CALL_ERROR);
+    expect(row.isStreaming).toBe(false);
+    expect(row.completedAt).not.toBe("");
+
+    // The platform's disclosure is the transcript's last word — it names the
+    // tool and explicitly denies the phantom approval.
+    const last = status.messages[status.messages.length - 1];
+    expect(last.type).toBe(MessageType.MESSAGE_SYSTEM);
+    expect(last.content).toContain("generateImage");
+    expect(last.content).toContain("No approval is pending");
+  });
+
+  it("leaves non-terminal rows to the pause machinery on a PAUSING turn", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status,
+      gitRoot: repo,
+      executionId: EXEC_ID,
+      changeSetId: CHANGE_SET_ID,
+    });
+    // A captured file change makes the turn pause…
+    await write("notes.md", "original notes\npaused-turn edit\n");
+    status.messages.push(
+      streamedEdit("tc-edit-1", "notes.md", "original notes\npaused-turn edit\n"),
+    );
+    // …while a hanging row rides the same turn.
+    status.messages.push(hangingGenerateImage("tc-genimage-2"));
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    expect(result.waiting).toBe(true);
+    expect(result.settledUnresolvedCount).toBe(0);
+    // Untouched by THIS sweep (a pausing turn's rows belong to the reconcile /
+    // collapse machinery, which has its own treatment for orphaned attempts).
+    expect(status.messages[1].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);
+  });
+
+  it("never settles a ledger-attributed row — that is the kinded machinery's call", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status,
+      gitRoot: repo,
+      executionId: EXEC_ID,
+      changeSetId: CHANGE_SET_ID,
+    });
+    const secretWrite = create(ToolCallSchema, {
+      id: "tc-secret-1",
+      name: "edit",
+      status: ToolCallStatus.TOOL_CALL_PENDING,
+      args: { path: ".env", content: "API_KEY=x" },
+    });
+    status.messages.push(
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls: [secretWrite] }),
+    );
+    // A secret-kind hard-block entry: attributable (kind non-approval), so the
+    // row is accounted for and must NOT be swept as "unresolved".
+    await writeFile(
+      denialLedgerPath(hitlDir),
+      JSON.stringify({
+        toolName: "Write",
+        token: toolCallIdentityToken(secretWrite),
+        kind: "secret",
+      }) + "\n",
+      "utf-8",
+    );
+
+    const result = await runTurnBoundary(boundaryOpts(status, baseline));
+
+    expect(result.settledUnresolvedCount).toBe(0);
+    expect(secretWrite.status).toBe(ToolCallStatus.TOOL_CALL_PENDING);
+  });
+
+  it("scopes to THIS turn: seeded prior-turn rows and terminal rows are untouched", async () => {
+    const status = newStatus();
+    const baseline = await captureBaselineToLedger({
+      status,
+      gitRoot: repo,
+      executionId: EXEC_ID,
+      changeSetId: CHANGE_SET_ID,
+    });
+    // Message 0 is seeded prior-turn context (already adjudicated elsewhere).
+    status.messages.push(hangingGenerateImage("tc-prior-turn"));
+    // Message 1 opens this turn: one real terminal row.
+    status.messages.push(
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        toolCalls: [
+          create(ToolCallSchema, {
+            id: "tc-done",
+            name: "Read",
+            status: ToolCallStatus.TOOL_CALL_COMPLETED,
+            result: "file contents",
+          }),
+        ],
+      }),
+    );
+
+    const result = await runTurnBoundary(
+      boundaryOpts(status, baseline, { turnStartMessageIndex: 1 }),
+    );
+
+    expect(result.settledUnresolvedCount).toBe(0);
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);
+    expect(status.messages[1].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    // No disclosure was appended.
+    expect(status.messages.at(-1)?.type).toBe(MessageType.MESSAGE_AI);
+  });
+});

package/src/activities/execute-cursor/message-translator.ts

@@ -1923,6 +1923,121 @@ export function detectUnattributedHookBlocks(
   return blocks;
 }
 
+/**
+ * The honest terminal error stamped on a tool call that never resolved (issue
+ * #965). Deliberately states all three negatives — not executed, not approved,
+ * not denied — because the incident's harm was the model claiming an approval
+ * was pending: this text is what the transcript shows INSTEAD of a spinner or
+ * a silent after-the-fact interruption, and it must leave no room for an
+ * approval-is-coming reading.
+ */
+export const UNRESOLVED_TOOL_CALL_ERROR =
+  "The tool did not return a result before the turn ended. It was never " +
+  "executed, approved, or denied — no approval is pending for it.";
+
+/** One never-resolved tool call the turn boundary settled (issue #965). */
+export interface UnresolvedToolCall {
+  toolCallId: string;
+  toolName: string;
+}
+
+/**
+ * Settle this-turn tool calls that are still NON-TERMINAL when a turn
+ * completes without pausing — the issue #965 invariant, the sibling of
+ * {@link detectUnattributedHookBlocks}' #205 invariant ("a blocked tool must
+ * never silently complete" → "an unresolved tool must never silently
+ * complete").
+ *
+ * THE SHAPE THIS CATCHES. A tool that hangs INSIDE the Cursor agent runtime —
+ * the production case is `generateImage`, which rides the SDK's
+ * interaction-query channel rather than the ordinary tool path — streams a
+ * tool_call start, never streams a result, and is invisible to every Stigmer
+ * seam: the hook never denied it (no ledger entry), so the reconcile never
+ * gated it, and the turn completes with the row still PENDING/RUNNING. Before
+ * this sweep, the server's terminal settle (issue #207) stamped such rows
+ * TOOL_CALL_INTERRUPTED silently AFTER the runner reported completion — the
+ * transcript's last word stayed whatever the model claimed, which in
+ * aex_01m1a6ww3nmp4952ar5v0g4g85 was a promise that an approval was pending
+ * when none existed.
+ *
+ * Settling here instead makes the runner the author of the honest record: the
+ * row gets TOOL_CALL_INTERRUPTED with {@link UNRESOLVED_TOOL_CALL_ERROR}, and
+ * the caller (turn-boundary.ts) appends a system disclosure naming what never
+ * ran.
+ *
+ * WHY INTERRUPTED AND NEVER FAILED. TOOL_CALL_INTERRUPTED is deliberately the
+ * one settled status the monotonic merge guard lets live execution evidence
+ * supersede (see the guard's note in this file, ~line 331): if this FAILED
+ * execution is later RECOVERED, the harness checkpoint may re-execute the call
+ * under its original id, and the replayed events must be able to advance the
+ * row to its true outcome. A boundary-stamped FAILED would freeze it forever.
+ *
+ * WHY IT NEVER FAILS THE RUN (unlike #205). A foreign hook block is provably
+ * adversarial — approval semantics are permanently broken, so completing would
+ * always be a lie. An unresolved row can also be benign stream event-loss
+ * where the tool actually ran; failing the run would convert those into
+ * regressions. Disclosure restores honesty at zero regression risk.
+ *
+ * Scope and exclusions, in order:
+ *  - THIS turn's parent-transcript rows only (from `turnStartMessageIndex`):
+ *    seeded prior-turn rows were adjudicated by their own execution's settle,
+ *    and sub-agent inner rows are the server settle's concern — the parent row
+ *    (e.g. the Task call) is what the user sees. Mirrors #205's scoping.
+ *  - Only PENDING/RUNNING rows: every terminal row was adjudicated, and
+ *    WAITING_APPROVAL rows belong to the pause machinery (the caller only runs
+ *    this sweep on a NON-pausing turn, so none should exist here anyway).
+ *  - Only rows with NO denial-ledger entry of ANY kind (exact token, then the
+ *    normalized-path fallback — the same two identities every sweep in this
+ *    file uses): a ledger-attributed row is the unattended/secret/fail-closed
+ *    machinery's to settle, not ours.
+ *
+ * Returns the settled calls so the boundary can disclose and log them.
+ */
+export function settleUnresolvedToolCalls(
+  messages: readonly AgentMessage[],
+  turnStartMessageIndex: number,
+  ledger: readonly DeniedLedgerEntry[],
+  workspaceRoot?: string,
+): UnresolvedToolCall[] {
+  const ledgerTokens = new Set(ledger.map((e) => e.token));
+  const ledgerNormalizedSalients = new Set<string>();
+  if (workspaceRoot) {
+    for (const entry of ledger) {
+      const decoded = decodeIdentityToken(entry.token);
+      if (!decoded) continue;
+      const normalized = normalizedFileSalient(decoded.key, decoded.salient, workspaceRoot);
+      if (normalized) ledgerNormalizedSalients.add(normalized);
+    }
+  }
+
+  const matchesLedger = (tc: ToolCall): boolean => {
+    if (ledgerTokens.has(toolCallIdentityToken(tc))) return true;
+    if (!workspaceRoot) return false;
+    const id = toolIdentity(tc.name, tc.mcpServerSlug, toolCallArgs(tc));
+    const normalized = normalizedFileSalient(id.key, id.salient, workspaceRoot);
+    return !!normalized && ledgerNormalizedSalients.has(normalized);
+  };
+
+  const settled: UnresolvedToolCall[] = [];
+  for (const msg of messages.slice(Math.max(0, turnStartMessageIndex))) {
+    for (const tc of msg.toolCalls) {
+      if (
+        tc.status !== ToolCallStatus.TOOL_CALL_PENDING &&
+        tc.status !== ToolCallStatus.TOOL_CALL_RUNNING
+      ) {
+        continue;
+      }
+      if (matchesLedger(tc)) continue;
+      tc.status = ToolCallStatus.TOOL_CALL_INTERRUPTED;
+      tc.error = UNRESOLVED_TOOL_CALL_ERROR;
+      tc.isStreaming = false;
+      if (!tc.completedAt) tc.completedAt = utcTimestamp();
+      settled.push({ toolCallId: tc.id, toolName: tc.name });
+    }
+  }
+  return settled;
+}
+
 /**
  * Stamp the tool calls the hook denied under UNATTENDED approval mode
  * (DD-014) as terminal TOOL_CALL_SKIPPED rows with UNATTENDED_SKIP

package/src/activities/execute-cursor/prompt-builder.ts

@@ -751,12 +751,24 @@ const TOOL_APPROVAL_PROTOCOL_INTRO =
  * well-behaved model otherwise concludes the environment is broken and tells the
  * user to "enable hooks in your Cursor settings", contradicting the approval
  * card. This rule reframes that signal as the gate working as designed.
+ *
+ * The fifth rule is the fourth's honesty boundary (issue #965): the gate
+ * recognition must be scoped to the PLATFORM'S OWN message texts ("blocked by
+ * a hook"; "submitted to the user for approval"), because a failure inside the
+ * harness itself can ALSO speak in permission vocabulary — the production case
+ * was Cursor's native generateImage hanging with a write-permission-flavored
+ * error, which the old any-"requires approval"-text reading turned into the
+ * model promising the user an approval card the platform never held. A failure
+ * without the platform's notice is an ordinary tool failure and must be
+ * reported as one; the platform's approval surface is never narrated into
+ * existence.
  */
 const TOOL_APPROVAL_PROTOCOL_RULES: readonly string[] = [
   "Carry out every action by calling the appropriate tool directly. Never describe an action you intend to take and then stop, and never ask the user for permission in prose.",
   "When an action needs approval, the platform pauses it, asks the user, and resumes you automatically after they decide. You do not request approval yourself — invoking the tool is how you request it.",
   "Even if a tool or MCP server instructs you to confirm with the user before acting (for example before sending, deleting, or purchasing), do NOT ask in prose. Invoke the tool and let the platform's approval step handle it.",
-  "A tool result that says the action was blocked, denied, requires approval, or was \"blocked by a hook\" is the platform's approval gate doing its job — it is NOT an error and NOT a Cursor misconfiguration. Never tell the user to change Cursor settings, enable hooks, or fix their configuration; the gate is intentional and the platform will resume you automatically once the user decides.",
+  "A tool result that says it was \"blocked by a hook\" or that the action was \"submitted to the user for approval\" is the platform's approval gate doing its job — it is NOT an error and NOT a Cursor misconfiguration. Never tell the user to change Cursor settings, enable hooks, or fix their configuration; the gate is intentional, and for THESE results the platform will resume you automatically once the user decides.",
+  "Any other tool failure — including one that mentions permissions or approval but does not carry the platform's approval notice above — is an ordinary failure, not the approval gate. Report it to the user honestly as something that did not run. NEVER tell the user an approval is pending or that you will be resumed automatically unless the tool result carried the platform's approval notice; the platform shows its own approval prompts, and you must not invent one.",
   "If an action is declined, do not retry it or attempt a workaround for it; continue with the rest of the task.",
 ];
 

package/src/activities/execute-cursor/turn-boundary.ts

@@ -12,7 +12,12 @@
  *     and redact the model's provisional post-denial narration;
  *  5. detect UNATTRIBUTED hook blocks (issue #205) — a tool blocked by a hook
  *     with no ledger entry of any kind was denied by a FOREIGN hook the merge
- *     preserved, and the caller fails the run rather than completing silently.
+ *     preserved, and the caller fails the run rather than completing silently;
+ *  6. settle UNRESOLVED tool calls (issue #965) — a this-turn row still
+ *     non-terminal on a completing turn with no ledger attribution hung inside
+ *     the harness and can never complete; it is settled to an honest
+ *     TOOL_CALL_INTERRUPTED and disclosed on the transcript instead of being
+ *     silently stamped by the server's terminal settle after the fact.
  *
  * Extracted from the activity entry point (index.ts Phase 12) so it is directly
  * unit-testable AND re-enterable: the poisoned-handle / transport-timeout
@@ -51,9 +56,14 @@ import {
   clearProvisionalPostDenialNarration,
   detectUnattributedHookBlocks,
   reconcileDeniedToolCalls,
+  settleUnresolvedToolCalls,
   stampUnattendedSkippedToolCalls,
+  utcTimestamp,
   type UnattributedHookBlock,
 } from "./message-translator.js";
+import { create } from "@bufbuild/protobuf";
+import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 // How long the boundary waits for the first-denial-stop's run.cancel() to
 // settle before reading the final denial ledger and capturing the turn's tree.
@@ -140,6 +150,16 @@ export interface TurnBoundaryResult {
    * undone (a pausing turn is not silent — the caller logs and pauses as usual).
    */
   readonly unattributedHookBlocks: readonly UnattributedHookBlock[];
+  /**
+   * This-turn tool calls settled to TOOL_CALL_INTERRUPTED because they were
+   * still non-terminal on a completing turn with no ledger attribution (issue
+   * #965) — the harness returned no result for them and the platform holds no
+   * approval for them. Informational: the boundary already settled the rows
+   * and appended the transcript disclosure; the run is NOT failed for these
+   * (unlike #205's unattributed blocks, an unresolved row can be benign
+   * stream event-loss, so failing would over-punish).
+   */
+  readonly settledUnresolvedCount: number;
 }
 
 /**
@@ -338,6 +358,49 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     primaryWorkspaceDir,
   );
   const waiting = deniedToolCalls.length > 0 || capturedChangeCount > 0;
+
+  // Issue #965 invariant: an unresolved tool must never silently complete.
+  // On a COMPLETING (non-pausing) turn, any this-turn row still PENDING /
+  // RUNNING with no ledger attribution hung inside the harness (the production
+  // case: `generateImage`, which rides the SDK's interaction-query channel and
+  // is invisible to the hook). Settle it to an honest TOOL_CALL_INTERRUPTED —
+  // never FAILED, so a recovery replay can still supersede it (#207) — and
+  // disclose it on the transcript, so the model's own narration (which may
+  // have promised an approval the platform does not hold) is never the last
+  // word. A PAUSING turn is skipped: its non-terminal rows belong to the
+  // reconcile/collapse machinery above. Runs AFTER the unattended stamp so a
+  // ledger-attributed row is already SKIPPED and cannot double-settle, and
+  // AFTER the #205 detection so a hook-block FAILED row keeps its distinct,
+  // run-failing treatment. Deliberately does NOT fail the run (unlike #205):
+  // an unresolved row can also be benign stream event-loss where the tool
+  // actually ran, and converting those into failures would be a regression.
+  let settledUnresolved: readonly { toolCallId: string; toolName: string }[] = [];
+  if (!waiting) {
+    settledUnresolved = settleUnresolvedToolCalls(
+      status.messages,
+      turnStartMessageIndex,
+      deniedLedger,
+      primaryWorkspaceDir,
+    );
+    if (settledUnresolved.length > 0) {
+      const names = [...new Set(settledUnresolved.map((s) => s.toolName))].join(", ");
+      status.messages.push(create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content:
+          `Note: the following tool call(s) never completed and were not executed: ${names}. ` +
+          `No approval is pending for them — if the agent said otherwise, disregard that. ` +
+          `You can ask the agent to try again.`,
+        timestamp: utcTimestamp(),
+      }));
+      console.warn(
+        `ExecuteCursor turn boundary: settled ${settledUnresolved.length} unresolved ` +
+        `tool call(s) to INTERRUPTED with disclosure [${names}] — the harness returned ` +
+        `no result for them and no ledger entry accounts for them (issue #965; ` +
+        `execution=${executionId})`,
+      );
+    }
+  }
+
   if (unattributedHookBlocks.length > 0) {
     const culprits = (foreignGatingHooks?.length ?? 0) > 0
       ? ` — likely foreign workspace hook(s): ${foreignGatingHooks!.join(", ")}`
@@ -366,5 +429,6 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     capturedChangeCount,
     deniedToolCallCount: deniedToolCalls.length,
     unattributedHookBlocks,
+    settledUnresolvedCount: settledUnresolved.length,
   };
 }

package/src/activities/execute-deep-agent/__tests__/attachment-injector.test.ts

@@ -14,7 +14,7 @@ import {
 } from "../attachment-injector.js";
 import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
 import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
-import { buildZip, type ZipFixtureFile } from "../../../__test-utils__/zip-fixtures.js";
+import { buildZip, type ZipFixtureFile } from "@stigmer/zip-structure/testing";
 import {
   DEEP_AGENT_VISION_PROFILE,
   VisionBudget,
@@ -22,7 +22,8 @@ import {
 
 // ── ZIP Construction Helpers ─────────────────────────────────────────
 //
-// All archives come from the shared real-shape builder (zip-fixtures.ts):
+// All archives come from the shared real-shape builder
+// (@stigmer/zip-structure/testing):
 // local headers, payloads, central directory, EOCD — the only shape real
 // ZIP writers produce and the shape central-directory parsing requires.
 // The record-form helpers below keep ordinary call sites terse; tests that

package/src/activities/execute-deep-agent/attachment-injector.ts

@@ -7,7 +7,7 @@
  *
  * Security model: attachments are untrusted user uploads. ZIP archives are
  * parsed from the central directory — the format's authoritative index —
- * via the shared structural layer (shared/zip-structure.ts; issue #567,
+ * via the shared structural layer (@stigmer/zip-structure; issue #567,
  * which killed this module's local-header walk: it silently truncated
  * stored streaming entries and rejected Go-default archives outright).
  * Every entry is validated for path traversal, zip bombs, and format
@@ -48,7 +48,7 @@ import {
   EOCD_MIN_SIZE,
   parseZipStructure,
   type ZipStructuralEntry,
-} from "../../shared/zip-structure.js";
+} from "@stigmer/zip-structure";
 
 // ── Constants ────────────────────────────────────────────────────────
 

package/src/client/stigmer-client.ts

@@ -234,7 +234,10 @@ export class StigmerClient {
         //    scoped-token exchange itself requires the embedded_runner
         //    bootstrap credential (a desktop runner's control-plane token is
         //    the user's own Auth0 token, which the server correctly treats as
-        //    a browsing user).
+        //    a browsing user); and the workflow child-execution create stamps
+        //    the platform's workflow lineage labels, which cloud's
+        //    reserved-label guard and environment composer accept only from
+        //    runner-class callers — a user-token create is rejected outright.
         //
         // 3. Everything else uses the control-plane token. Falls through
         //    unchanged when no runner token exists (OSS/local, where the
@@ -246,7 +249,9 @@ export class StigmerClient {
           const usesRunnerCredential =
             req.service.typeName === ExecutionContextQueryController.typeName ||
             (req.service.typeName === PlatformQueryController.typeName &&
-              req.method.name === PlatformQueryController.method.getRunnerScopedToken.name);
+              req.method.name === PlatformQueryController.method.getRunnerScopedToken.name) ||
+            (req.service.typeName === AgentExecutionCommandController.typeName &&
+              req.method.name === AgentExecutionCommandController.method.create.name);
           const token =
             (usesRunnerCredential ? this.runnerTokenRef?.current : null)
             ?? this.tokenRef?.current

package/src/ipc-protocol-fixtures.ts

@@ -1,8 +1,7 @@
 // Golden wire-shape examples for the manager-mode IPC contract — one representative
-// instance per message. This is the single source the cross-language mirrors assert
-// against (Rust `protocol.rs`, Go `unified_runner.go`): the generator script serializes
-// `buildFixtures()` to `fixtures/ipc-protocol.generated.json`, and each mirror's tests
-// read that artifact. Because every sample is typed against an `Ipc*` interface from
+// instance per message. This is the single source the cross-language mirror asserts
+// against (Rust `protocol.rs`): the generator script serializes `buildFixtures()` to
+// `fixtures/ipc-protocol.generated.json`, and the mirror's tests read that artifact. Because every sample is typed against an `Ipc*` interface from
 // `ipc-protocol.ts`, renaming or retyping a field there fails `tsc` here — that compile
 // error is what binds the fixtures to the contract. Full rules: docs/ipc-protocol.md.
 

package/src/ipc-protocol.ts

@@ -1,9 +1,10 @@
 // Canonical machine-readable definition of the manager-mode IPC contract.
 // The runner emits these messages; the Rust host crate (crates/stigmer-runner-host/src/
-// protocol.rs) and the Go integration harness (unified_runner.go) hand-mirror them. Those
-// mirrors are kept honest by golden fixtures generated from this file via
-// ipc-protocol-fixtures.ts (run `make gen-ipc-fixtures`). Full spec and the rule for keeping
-// all definitions in sync: docs/ipc-protocol.md.
+// protocol.rs) hand-mirrors them, kept honest by golden fixtures generated from this file
+// via ipc-protocol-fixtures.ts (run `make gen-ipc-fixtures`). The conformance harness's
+// manager-mode spawner (test/conformance/src/harness/runner-manager-process.ts) imports
+// these types directly rather than mirroring them. Full spec and the rule for keeping all
+// definitions in sync: docs/ipc-protocol.md.
 
 // Integer protocol version advertised in the `ready` handshake. Bump ONLY on a
 // breaking change (removed/renamed message, changed field type, changed lifecycle

package/src/runner-manager.ts

@@ -789,7 +789,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     ...createCallGrpcActivities(),
     ...createCallFunctionActivities(),
     ...createCallLlmActivities(),
-    ...createCallAgentActivities(),
+    ...createCallAgentActivities(config),
     ...createCallAgentStatusActivities(),
     ...createRunCommandActivities(),
     ...createHydrateWorkflowActivities(config),

package/src/runner.ts

@@ -524,7 +524,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     ...createCallGrpcActivities(),
     ...createCallFunctionActivities(),
     ...createCallLlmActivities(),
-    ...createCallAgentActivities(),
+    ...createCallAgentActivities(config),
     ...createCallAgentStatusActivities(),
     ...createRunCommandActivities(),
     ...createHydrateWorkflowActivities(config),

package/src/shared/__tests__/skill-mount.test.ts

@@ -9,7 +9,7 @@ import {
   downloadArtifact,
   writeSkillMount,
 } from "../skill-mount.js";
-import { buildZip } from "../../__test-utils__/zip-fixtures.js";
+import { buildZip } from "@stigmer/zip-structure/testing";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────
 

package/src/shared/__tests__/skill-writer.test.ts

@@ -12,7 +12,7 @@ import {
 } from "../skill-writer.js";
 import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import { buildZip } from "../../__test-utils__/zip-fixtures.js";
+import { buildZip } from "@stigmer/zip-structure/testing";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────
 

package/src/shared/__tests__/zip-extract.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from "vitest";
 import { extractZipFileEntries, type ZipFileEntry } from "../zip-extract.js";
-import { buildZip } from "../../__test-utils__/zip-fixtures.js";
+import { buildZip } from "@stigmer/zip-structure/testing";
 
 /**
  * Decode entries for text-content assertions. The production contract is

package/src/shared/zip-extract.ts

@@ -33,7 +33,7 @@
  */
 
 import { createInflateRaw } from "node:zlib";
-import { EOCD_MIN_SIZE, parseZipStructure, type ZipStructuralEntry } from "./zip-structure.js";
+import { EOCD_MIN_SIZE, parseZipStructure, type ZipStructuralEntry } from "@stigmer/zip-structure";
 
 // ─── Public API ──────────────────────────────────────────────────────────
 

package/dist/shared/zip-structure.d.ts

@@ -1,61 +0,0 @@
-/**
- * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
- * location plus central-directory walk, producing one record per entry.
- *
- * Parsing is *central-directory-based* — never a front-to-back walk of
- * local file headers. This is a correctness decision, not a style choice
- * (issues #450 and #567): local headers of streaming entries
- * (general-purpose flag bit 3) carry zeroed sizes, and the only
- * local-only way to recover them is scanning the payload for the
- * data-descriptor signature — which silently truncates any stored entry
- * whose *content* happens to contain those four bytes, and
- * desynchronizes every entry after it. The central directory always
- * carries the real sizes, and every consumer here holds the complete
- * archive bytes, so nothing a local-header walk could offer is needed.
- *
- * This layer maps bytes to entry records and nothing else. Policy — what
- * a structural failure means, which entries are acceptable, how payloads
- * are decoded — belongs to the consumers, and they differ on purpose:
- *
- *   - shared/zip-extract.ts (skill artifacts): structural failure is
- *     NON-FATAL — both editions' push gates validated every artifact
- *     with a central-directory-based reader before storage, so a defect
- *     here can only be a truncated or corrupted download.
- *   - execute-deep-agent/attachment-injector.ts (user attachments):
- *     structural failure is FAIL-HARD — the input is an untrusted
- *     upload and nothing upstream vouched for it.
- *
- * ZIP64 is deliberately unsupported: both consumers cap input far below
- * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
- * attachment uploads: 10MB).
- *
- * Throws plain `Error`s on structural defects (no valid EOCD, a central
- * directory or local header record that does not parse, a payload slice
- * that runs past the end of the buffer); consumers translate those into
- * their own error models.
- */
-export interface ZipStructuralEntry {
-    /** Entry path exactly as recorded in the central directory. */
-    readonly name: string;
-    readonly isDirectory: boolean;
-    readonly compressionMethod: number;
-    /**
-     * The central directory's declared uncompressed size — authoritative for
-     * pre-extraction accounting (e.g. ZIP-bomb budgeting), but still a
-     * *declaration*: a consumer that distrusts its input must enforce it
-     * against the actual decompressed output.
-     */
-    readonly uncompressedSize: number;
-    /** The entry's raw payload slice (a view, not a copy) of the archive buffer. */
-    readonly compressedData: Uint8Array;
-}
-/** Fixed size of the EOCD record, excluding the variable-length comment. */
-export declare const EOCD_MIN_SIZE = 22;
-/**
- * Enumerate the archive's entries from its central directory.
- *
- * Throws on any structural defect: no valid EOCD, a central directory or
- * local header record that doesn't parse, or a payload slice that runs
- * past the end of the buffer.
- */
-export declare function parseZipStructure(data: Uint8Array): ZipStructuralEntry[];