@stigmer/runner 3.14.0 → 3.14.1

package/src/activities/execute-cursor/__tests__/hermetic/deny-and-retry.test.ts

@@ -0,0 +1,228 @@
+/**
+ * Hermetic golden: the DENY-AND-RETRY approval round trip through two real
+ * `ExecuteCursor` invocations, with the REAL bash hook as the out-of-process
+ * half.
+ *
+ * Invariant pinned (the Cursor pause primitive, parent §4a `pausePrimitive:
+ * "deny-and-retry"`): the model proposes a gated built-in (`shell`); the
+ * workspace hook the activity installed DENIES it and appends to the denial
+ * ledger; the stream loop reads the ledger on the next `tool_call` event, cancels
+ * the run, and the turn boundary overlays the row as WAITING_APPROVAL; the
+ * activity persists WAITING_FOR_APPROVAL, parks the agent, and RETURNS a slim
+ * status. The user approves (the server writes `approval_action` on the row —
+ * here the record does, per field ownership). The reinvocation (`thread_id` set,
+ * `turn_seq` 1) seeds its transcript from the persisted execution, derives a
+ * grant from the approved row, reinstalls the gate, and the SAME hook now ALLOWS
+ * the re-issued call — which the model emits under a FRESH `call_id`, and which
+ * the transcript reconciles onto the committed row by canonical identity (a
+ * superset, never a duplicate, never a second gate). The turn ends COMPLETED.
+ *
+ * Two goldens, one per invocation: `goldens/deny-and-retry.turn1.status.json`
+ * (the paused transcript) and `goldens/deny-and-retry.turn2.status.json` (the
+ * resumed, completed transcript). S2 must reproduce both byte for byte.
+ *
+ * Parent phase rows exercised beyond `tool-call`: reinvocation detection and
+ * transcript seeding (Phase 3); reading approval decisions from the persisted
+ * transcript (`reconstructAdjudicatedApprovals`); grants → approval state →
+ * the gate (Phase 5c); the first-denial early stop in the stream loop; the
+ * turn boundary's denial overlay; `enterApprovalPause` (WAITING_FOR_APPROVAL,
+ * park, return); the parked-agent checkout on the resume (#215, no `Agent.resume`
+ * call); the resume prompt.
+ *
+ * The hook is the runner's own generated bash script, found the way the SDK
+ * finds it (`.cursor/hooks.json` in the workspace) and run with the SDK's real
+ * preToolUse input shape (`cursor-hook-harness.ts` builders). Skipped where
+ * `bash` is unavailable — reported as SKIPPED, never a silent pass.
+ *
+ * Regenerate ONLY after a deliberate behavior change:
+ *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { toJson } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import {
+  ApprovalAction,
+  ExecutionPhase,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { hasBash, hookShell } from "../../__test-utils__/cursor-hook-harness.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  runCursorTurn,
+  runWorkspaceHook,
+  sessionWorkspaceDir,
+  stubRegistryFetch,
+} from "../../__test-utils__/hermetic-cursor.js";
+
+const AGENT_ID = "agent-hermetic-deny-0001";
+const RUN_1 = "run-hermetic-deny-0001";
+const RUN_2 = "run-hermetic-deny-0002";
+const CALL_TURN_1 = "call-hermetic-shell-0001";
+const CALL_TURN_2 = "call-hermetic-shell-0002";
+const USER_MESSAGE = "Run the build and tell me if it passes.";
+const COMMAND = "npm run build";
+const SHELL_ARGS = { command: COMMAND };
+const BUILD_OUTPUT = "build ok (hermetic)\n";
+const FINAL_TEXT = "The build passes.";
+
+describe.skipIf(!hasBash)("ExecuteCursor hermetic — deny-and-retry approval round trip", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("pauses on the hook's deny, then completes on the approved re-issue", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const workspaceRoot = sessionWorkspaceDir(env);
+    const hookDecisions: string[] = [];
+    const runHook = (label: string) =>
+      step.effect(label, () => {
+        hookDecisions.push(runWorkspaceHook(workspaceRoot, hookShell(COMMAND)).permission);
+      });
+
+    const ev1 = sdkEvents(AGENT_ID, RUN_1);
+    const ev2 = sdkEvents(AGENT_ID, RUN_2);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_1, RUN_2],
+      observeStep: () => clock.tick(),
+      turns: [
+        // Turn 1: the SDK runs the hook before executing the gated tool; the
+        // hook denies and writes the ledger; the SDK reports the call blocked.
+        [
+          step.event(ev1.init()),
+          step.event(ev1.assistant("I'll run the build now.")),
+          step.event(ev1.toolCall(CALL_TURN_1, "shell", "running", SHELL_ARGS)),
+          runHook("hook: turn 1 (expect deny)"),
+          step.event(ev1.toolCall(CALL_TURN_1, "shell", "error", SHELL_ARGS, "Blocked by hook")),
+          // Never reached: the loop detects the denial on the event above and
+          // cancels the run. Present so a regression that does NOT cancel is
+          // caught by the golden, not by a missing-result throw.
+          step.event(ev1.assistant("The build was blocked.")),
+          step.finished({ result: "The build was blocked." }),
+        ],
+        // Turn 2 (resumed): the hook runs again for the re-issued call and now
+        // allows it (the grant); the tool runs under a FRESH call id.
+        [
+          runHook("hook: turn 2 (expect allow)"),
+          step.event(ev2.toolCall(CALL_TURN_2, "shell", "running", SHELL_ARGS)),
+          step.event(ev2.toolCall(CALL_TURN_2, "shell", "completed", SHELL_ARGS, BUILD_OUTPUT)),
+          step.event(ev2.assistant(FINAL_TEXT)),
+          step.turnEnded({ inputTokens: 3_100, outputTokens: 60 }),
+          step.finished({ result: FINAL_TEXT, model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({ message: USER_MESSAGE });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act 1: the first invocation ──────────────────────────────────────────
+    const turn1 = await runCursorTurn(scenario, { threadId: "", turnSeq: 0 });
+
+    // ── Assert 1: paused for approval, returned, agent parked ────────────────
+    expect(hookDecisions, "the real hook denied the gated shell call").toEqual(["deny"]);
+    expect(turn1.outcome.kind, "an approval pause RETURNS to the workflow").toBe("returned");
+    expect((turn1.outcome as { value: Record<string, unknown> }).value.phase).toBe(
+      "EXECUTION_WAITING_FOR_APPROVAL",
+    );
+    expect(record.persistedPhases).toEqual([
+      ExecutionPhase.EXECUTION_IN_PROGRESS,
+      ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    ]);
+    expect(agent.runs[0].cancelCalls, "the first denial cancels the run exactly once").toHaveLength(1);
+    expect(agent.closeCalls, "the agent is parked for the resume, not closed").toBe(0);
+
+    const waiting = record.waitingToolCalls();
+    expect(waiting, "exactly one gate row").toHaveLength(1);
+    expect(waiting[0].id).toBe(CALL_TURN_1);
+    expect(waiting[0].name).toBe("shell");
+    expect(waiting[0].requiresApproval).toBe(true);
+    // The gate row carries what the HOOK saw (the ledger's captured tool_input:
+    // command, cwd, timeout), overlaid on the stream's args — the golden pins
+    // the full shape; here only the shared salient field is asserted.
+    expect(waiting[0].args).toMatchObject(SHELL_ARGS);
+    // The model's post-denial narration never reaches the user as fact.
+    expect(record.status?.messages.some((m) => m.content === "The build was blocked.")).toBe(false);
+
+    const turn1Json = JSON.stringify(toJson(AgentExecutionStatusSchema, record.lastFullStatus!), null, 2) + "\n";
+    await expect(turn1Json).toMatchFileSnapshot("./goldens/deny-and-retry.turn1.status.json");
+
+    // ── The user approves (the server's SubmitApproval effect on the row) ────
+    clock.tick();
+    expect(record.decideWaitingToolCalls(ApprovalAction.APPROVE, new Date().toISOString())).toBe(1);
+
+    // ── Act 2: the reinvocation ──────────────────────────────────────────────
+    const turn2 = await runCursorTurn(scenario, { threadId: AGENT_ID, turnSeq: 1 });
+
+    // ── Assert 2: allowed, reconciled, completed ─────────────────────────────
+    expect(hookDecisions, "the SAME hook allows the approved re-issue").toEqual(["deny", "allow"]);
+    expect(turn2.outcome.kind).toBe("returned");
+    const slim2 = (turn2.outcome as { value: Record<string, unknown> }).value;
+    expect(slim2.phase).toBe("EXECUTION_COMPLETED");
+    expect(slim2.final_text).toBe(FINAL_TEXT);
+    expect(record.persistedPhases).toEqual([
+      ExecutionPhase.EXECUTION_IN_PROGRESS,
+      ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+      ExecutionPhase.EXECUTION_IN_PROGRESS,
+      ExecutionPhase.EXECUTION_COMPLETED,
+    ]);
+
+    // #215: the resume checks the parked agent out of the session cache; the
+    // SDK is asked to create once for the whole round trip and never to resume.
+    expect(scenario.sdk.resolutions.map((r) => r.kind)).toEqual(["create"]);
+    expect(agent.sends).toHaveLength(2);
+
+    // Each tool gates exactly once: the committed row survives under its
+    // ORIGINAL id, now COMPLETED with the tool's result; the fresh call id the
+    // model emitted is reconciled onto it, never a second row.
+    const rows = record.toolCalls();
+    expect(rows.filter((tc) => tc.name === "shell")).toHaveLength(1);
+    const shell = rows.find((tc) => tc.name === "shell")!;
+    expect(shell.id).toBe(CALL_TURN_1);
+    expect(shell.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(shell.result).toBe(BUILD_OUTPUT);
+    expect(shell.approvalAction, "the decision survives on the row").toBe(ApprovalAction.APPROVE);
+    expect(rows.some((tc) => tc.id === CALL_TURN_2)).toBe(false);
+    expect(record.waitingToolCalls()).toHaveLength(0);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+
+    const turn2Json = JSON.stringify(toJson(AgentExecutionStatusSchema, record.lastFullStatus!), null, 2) + "\n";
+    await expect(turn2Json).toMatchFileSnapshot("./goldens/deny-and-retry.turn2.status.json");
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/file-review-capture.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Hermetic golden: a FILE-REVIEW CAPTURE turn on a git workspace through the
+ * whole `ExecuteCursor` activity.
+ *
+ * Invariant pinned (apply-then-review, the universal file-review model): on a
+ * git work tree the file edit FLOWS — the hook the activity installed ALLOWS
+ * the write (capture mode gates only gitignored paths, shell and MCP) — and the
+ * turn boundary captures the net change from the git diff against the baseline
+ * tree pinned before the agent ran, authors CANDIDATE_CAPTURED to the
+ * file_review ledger with one card for the edited file, stamps the flowed edit
+ * row with the change-set id, and the activity persists WAITING_FOR_APPROVAL
+ * and RETURNS without consulting `run.wait()`. The change-set id is the
+ * deterministic `executionId:turnSeq`. The golden
+ * (`goldens/file-review-capture.status.json`) pins the ledger shape S2 must
+ * reproduce.
+ *
+ * Parent phase rows exercised beyond `deny-and-retry`: provision a `local_path`
+ * workspace entry (mounted as-is in local mode); capture-mode derivation on a
+ * git tree; the baseline pin (`captureBaselineToLedger`, git snapshot); the
+ * turn boundary's candidate capture (`captureTurnToLedger`) and row stamping;
+ * the pause for review with file cards.
+ *
+ * Determinism: the fixture repo's commit and tree ids are byte-stable because
+ * `initGitWorkspace` pins author, committer and both dates. The stream's edit
+ * args use the REPO-RELATIVE path so no temp directory can reach the golden;
+ * the hook input carries the absolute path the SDK would pass (the hook's
+ * `git check-ignore` resolves it against the baked workspace root).
+ *
+ * Skipped where `bash` is unavailable — reported as SKIPPED, never a silent pass.
+ *
+ * Regenerate ONLY after a deliberate behavior change:
+ *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { toJson } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { hasBash, hookWrite } from "../../__test-utils__/cursor-hook-harness.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  initGitWorkspace,
+  localPathEntry,
+  runCursorTurn,
+  runWorkspaceHook,
+  stubRegistryFetch,
+} from "../../__test-utils__/hermetic-cursor.js";
+
+const AGENT_ID = "agent-hermetic-capture-0001";
+const RUN_ID = "run-hermetic-capture-0001";
+const CALL_ID = "call-hermetic-edit-0001";
+const USER_MESSAGE = "Add a line to notes.md saying the fixture was reviewed.";
+const FILE = "notes.md";
+const BEFORE = "# Notes\n\nA fixture file.\n";
+const AFTER = "# Notes\n\nA fixture file.\n\nReviewed by the hermetic run.\n";
+const CHANGE_SET_ID = `${FIXTURE.executionId}:0`;
+
+describe.skipIf(!hasBash)("ExecuteCursor hermetic — file-review capture on a git workspace", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("lets the edit flow, captures it at the boundary, and pauses for review", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const repo = join(env.workspaceRootDir, "repos", "notes");
+    initGitWorkspace(repo, { [FILE]: BEFORE });
+    const absFile = join(repo, FILE);
+    const hookDecisions: string[] = [];
+
+    const ev = sdkEvents(AGENT_ID, RUN_ID);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_ID],
+      observeStep: () => clock.tick(),
+      turns: [
+        [
+          step.event(ev.init()),
+          step.event(ev.assistant("Appending the review line.")),
+          // The SDK runs the hook before the write tool executes...
+          step.effect("hook: Write (expect allow in capture mode)", () => {
+            hookDecisions.push(runWorkspaceHook(repo, hookWrite(absFile, AFTER)).permission);
+          }),
+          // ...then performs the write itself...
+          step.effect("write notes.md", () => writeFileSync(absFile, AFTER, "utf-8")),
+          // ...and streams the tool call.
+          step.event(ev.toolCall(CALL_ID, "edit", "running", { path: FILE, content: AFTER })),
+          step.event(ev.toolCall(CALL_ID, "edit", "completed", { path: FILE, content: AFTER }, "ok")),
+          step.event(ev.assistant("Done — notes.md now records the review.")),
+          step.turnEnded({ inputTokens: 2_400, outputTokens: 70 }),
+          step.finished({ result: "Done", model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({
+      message: USER_MESSAGE,
+      workspaceEntries: [localPathEntry("notes", repo)],
+    });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runCursorTurn(scenario);
+
+    // ── Assert: the edit flowed and the turn paused for review ───────────────
+    expect(hookDecisions, "capture mode lets the write flow").toEqual(["allow"]);
+    expect(readFileSync(absFile, "utf-8"), "the working tree holds the candidate").toBe(AFTER);
+    expect(invocation.outcome.kind, "a review pause RETURNS to the workflow").toBe("returned");
+    expect((invocation.outcome as { value: Record<string, unknown> }).value.phase).toBe(
+      "EXECUTION_WAITING_FOR_APPROVAL",
+    );
+    expect(record.persistedPhases).toEqual([
+      ExecutionPhase.EXECUTION_IN_PROGRESS,
+      ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    ]);
+    expect(agent.runs[0].cancelCalls, "a flowed edit is not a denial; nothing is cancelled").toHaveLength(0);
+
+    // ── Assert: the file_review ledger ───────────────────────────────────────
+    const events = record.status?.fileReviewEventStream?.events ?? [];
+    const types = events.map((e) => e.payload.case);
+    expect(types).toEqual(["baselineCaptured", "candidateCaptured"]);
+    const candidate = events[1].payload;
+    if (candidate.case !== "candidateCaptured") throw new Error("unreachable");
+    expect(candidate.value.changeSetId).toBe(CHANGE_SET_ID);
+    expect(candidate.value.changes.map((c) => c.pathAfter)).toEqual([FILE]);
+
+    // The flowed edit row: the built-in policy still classifies `edit` as a
+    // gated category (`requiresApproval: true` is the policy's verdict, stamped
+    // at fold time), but capture mode let it FLOW — so the row is COMPLETED,
+    // never WAITING_APPROVAL, and the review happens on the file card instead.
+    const rows = record.toolCalls();
+    expect(rows).toHaveLength(1);
+    expect(rows[0].name).toBe("edit");
+    expect(rows[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(rows[0].requiresApproval, "policy verdict, not the gate outcome").toBe(true);
+    expect(record.waitingToolCalls(), "no gate row — the review is on the file card").toHaveLength(0);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+
+    // ── Assert: the golden ───────────────────────────────────────────────────
+    const json = JSON.stringify(toJson(AgentExecutionStatusSchema, record.lastFullStatus!), null, 2) + "\n";
+    expect(json, "no temp path may reach the golden").not.toContain(env.workspaceRootDir);
+    await expect(json).toMatchFileSnapshot("./goldens/file-review-capture.status.json");
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/goldens/deny-and-retry.turn1.status.json

@@ -0,0 +1,55 @@
+{
+  "messages": [
+    {
+      "type": "MESSAGE_AI",
+      "content": "I'll run the build now.",
+      "timestamp": "2026-01-01T00:00:02.000Z",
+      "toolCalls": [
+        {
+          "id": "call-hermetic-shell-0001",
+          "name": "shell",
+          "args": {
+            "command": "npm run build",
+            "cwd": "/x",
+            "timeout": 30000
+          },
+          "status": "TOOL_CALL_WAITING_APPROVAL",
+          "startedAt": "2026-01-01T00:00:03.000Z",
+          "requiresApproval": true,
+          "approvalMessage": "Run command: npm run build",
+          "approvalRequestedAt": "2026-01-01T00:00:05.000Z",
+          "argsPreview": "{\"command\":\"npm run build\",\"cwd\":\"/x\",\"timeout\":30000}",
+          "toolKind": "TOOL_KIND_SHELL",
+          "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",
+          "policyEngineVersion": "phase-7"
+        }
+      ]
+    }
+  ],
+  "phase": "EXECUTION_WAITING_FOR_APPROVAL",
+  "startedAt": "2026-01-01T00:00:00.000Z",
+  "fileReviewEventStream": {
+    "executionId": "aex_hermetic_0001",
+    "events": [
+      {
+        "eventId": "aex_hermetic_0001:0:aex_hermetic_0001:0:FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "changeSetId": "aex_hermetic_0001:0",
+        "eventType": "FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "timestamp": "2026-01-01T00:00:00.000Z",
+        "actor": "runner",
+        "baselineCaptured": {
+          "changeSetId": "aex_hermetic_0001:0",
+          "turnId": "aex_hermetic_0001:0",
+          "harnessId": "cursor",
+          "baselineSnapshot": {
+            "kind": "SNAPSHOT_KIND_CAS_MANIFEST"
+          }
+        }
+      }
+    ]
+  },
+  "fileChangeProgress": {
+    "changeSetId": "aex_hermetic_0001:0",
+    "capturedAt": "2026-01-01T00:00:01.000Z"
+  }
+}

package/src/activities/execute-cursor/__tests__/hermetic/goldens/deny-and-retry.turn2.status.json

@@ -0,0 +1,77 @@
+{
+  "messages": [
+    {
+      "type": "MESSAGE_AI",
+      "content": "I'll run the build now.",
+      "timestamp": "2026-01-01T00:00:02.000Z",
+      "toolCalls": [
+        {
+          "id": "call-hermetic-shell-0001",
+          "name": "shell",
+          "args": {
+            "command": "npm run build",
+            "cwd": "/x",
+            "timeout": 30000
+          },
+          "result": "build ok (hermetic)\n",
+          "status": "TOOL_CALL_COMPLETED",
+          "startedAt": "2026-01-01T00:00:03.000Z",
+          "completedAt": "2026-01-01T00:00:09.000Z",
+          "requiresApproval": true,
+          "approvalMessage": "Run command: npm run build",
+          "approvalRequestedAt": "2026-01-01T00:00:05.000Z",
+          "approvalDecidedAt": "2026-01-01T00:00:06.000Z",
+          "approvalAction": "APPROVAL_ACTION_APPROVE",
+          "argsPreview": "{\"command\":\"npm run build\",\"cwd\":\"/x\",\"timeout\":30000}",
+          "toolKind": "TOOL_KIND_SHELL",
+          "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",
+          "policyEngineVersion": "phase-7"
+        }
+      ]
+    },
+    {
+      "type": "MESSAGE_AI",
+      "content": "The build passes.",
+      "timestamp": "2026-01-01T00:00:10.000Z"
+    }
+  ],
+  "phase": "EXECUTION_COMPLETED",
+  "startedAt": "2026-01-01T00:00:06.000Z",
+  "completedAt": "2026-01-01T00:00:12.000Z",
+  "streamingUsage": {
+    "inputTokens": "3100",
+    "outputTokens": "60",
+    "totalTokens": "3160",
+    "turnCount": 1,
+    "estimatedCostUsd": 0.00334,
+    "model": "composer-2.5",
+    "observedAt": "2026-01-01T00:00:11.000Z",
+    "requestedServiceTier": "SERVICE_TIER_STANDARD",
+    "requestedModelParams": "[{\"id\":\"fast\",\"value\":\"false\"},{\"id\":\"thinking\",\"value\":\"false\"}]",
+    "requestedThinkingMode": "THINKING_MODE_DISABLED"
+  },
+  "fileReviewEventStream": {
+    "executionId": "aex_hermetic_0001",
+    "events": [
+      {
+        "eventId": "aex_hermetic_0001:1:aex_hermetic_0001:1:FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "changeSetId": "aex_hermetic_0001:1",
+        "eventType": "FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "timestamp": "2026-01-01T00:00:06.000Z",
+        "actor": "runner",
+        "baselineCaptured": {
+          "changeSetId": "aex_hermetic_0001:1",
+          "turnId": "aex_hermetic_0001:1",
+          "harnessId": "cursor",
+          "baselineSnapshot": {
+            "kind": "SNAPSHOT_KIND_CAS_MANIFEST"
+          }
+        }
+      }
+    ]
+  },
+  "fileChangeProgress": {
+    "changeSetId": "aex_hermetic_0001:1",
+    "capturedAt": "2026-01-01T00:00:08.000Z"
+  }
+}

package/src/activities/execute-cursor/__tests__/hermetic/goldens/file-review-capture.status.json

@@ -0,0 +1,126 @@
+{
+  "messages": [
+    {
+      "type": "MESSAGE_AI",
+      "content": "Appending the review line.",
+      "timestamp": "2026-01-01T00:00:02.000Z",
+      "toolCalls": [
+        {
+          "id": "call-hermetic-edit-0001",
+          "name": "edit",
+          "args": {
+            "path": "notes.md",
+            "content": "# Notes\n\nA fixture file.\n\nReviewed by the hermetic run.\n"
+          },
+          "result": "ok",
+          "status": "TOOL_CALL_COMPLETED",
+          "startedAt": "2026-01-01T00:00:05.000Z",
+          "completedAt": "2026-01-01T00:00:06.000Z",
+          "requiresApproval": true,
+          "approvalMessage": "Write file: notes.md",
+          "argsPreview": "{\"path\":\"notes.md\",\"content\":\"# Notes\\n\\nA fixture file.\\n\\nReviewed by the hermetic run.\\n\"}",
+          "toolKind": "TOOL_KIND_FILE_EDIT",
+          "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",
+          "policyEngineVersion": "phase-7",
+          "fileChangeSetId": "aex_hermetic_0001:0"
+        }
+      ]
+    },
+    {
+      "type": "MESSAGE_AI",
+      "content": "Done — notes.md now records the review.",
+      "timestamp": "2026-01-01T00:00:07.000Z"
+    }
+  ],
+  "phase": "EXECUTION_WAITING_FOR_APPROVAL",
+  "startedAt": "2026-01-01T00:00:00.000Z",
+  "streamingUsage": {
+    "inputTokens": "2400",
+    "outputTokens": "70",
+    "totalTokens": "2470",
+    "turnCount": 1,
+    "estimatedCostUsd": 0.00268,
+    "model": "composer-2.5",
+    "observedAt": "2026-01-01T00:00:08.000Z",
+    "requestedServiceTier": "SERVICE_TIER_STANDARD",
+    "requestedModelParams": "[{\"id\":\"fast\",\"value\":\"false\"},{\"id\":\"thinking\",\"value\":\"false\"}]",
+    "requestedThinkingMode": "THINKING_MODE_DISABLED"
+  },
+  "fileReviewEventStream": {
+    "executionId": "aex_hermetic_0001",
+    "events": [
+      {
+        "eventId": "aex_hermetic_0001:0:aex_hermetic_0001:0:FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "changeSetId": "aex_hermetic_0001:0",
+        "eventType": "FILE_REVIEW_EVENT_TYPE_BASELINE_CAPTURED",
+        "timestamp": "2026-01-01T00:00:00.000Z",
+        "actor": "runner",
+        "baselineCaptured": {
+          "changeSetId": "aex_hermetic_0001:0",
+          "turnId": "aex_hermetic_0001:0",
+          "harnessId": "cursor",
+          "baselineSnapshot": {
+            "kind": "SNAPSHOT_KIND_GIT_TREE_REF",
+            "git": {
+              "treeOid": "06669a7bfb7a3e46bda2c295d6851e52e8f778c6",
+              "ref": "refs/stigmer/baseline/aex_hermetic_0001"
+            }
+          }
+        }
+      },
+      {
+        "eventId": "aex_hermetic_0001:0:aex_hermetic_0001:0:FILE_REVIEW_EVENT_TYPE_CANDIDATE_CAPTURED",
+        "changeSetId": "aex_hermetic_0001:0",
+        "eventType": "FILE_REVIEW_EVENT_TYPE_CANDIDATE_CAPTURED",
+        "timestamp": "2026-01-01T00:00:09.000Z",
+        "actor": "runner",
+        "candidateCaptured": {
+          "changeSetId": "aex_hermetic_0001:0",
+          "candidateSnapshot": {
+            "kind": "SNAPSHOT_KIND_GIT_TREE_REF",
+            "git": {
+              "treeOid": "2bb46c28a7498d578d76b52fa1cd9c941032e787",
+              "ref": "refs/stigmer/capture/aex_hermetic_0001"
+            }
+          },
+          "changes": [
+            {
+              "id": "aex_hermetic_0001:0:notes.md",
+              "pathBefore": "notes.md",
+              "pathAfter": "notes.md",
+              "kind": "FILE_CHANGE_KIND_MODIFY",
+              "captureClass": "FILE_CAPTURE_CLASS_GIT_TRACKED",
+              "before": {
+                "inline": "# Notes\n\nA fixture file.\n"
+              },
+              "after": {
+                "inline": "# Notes\n\nA fixture file.\n\nReviewed by the hermetic run.\n"
+              },
+              "beforeSha256": "0db28d643539d6a16370a30971d73a2ee0f9509dec6cbb5a143373d5ad52b83f",
+              "afterSha256": "96e76ecee9e8af5ef051ad2edaeeed6fbc989a50850a3ef1bcf518115fd1c097",
+              "diffComplete": true,
+              "fileDigest": "10056ad414223572125b6f8a148e79dbed10b58e18957d213992e79f475bedef",
+              "linesAdded": 2
+            }
+          ],
+          "aggregateDigest": "0a2af1c9c6e6f36e81beb770fdeea30860686096a409eb6df47d34d8e46737b9",
+          "diffCompleteness": "DIFF_COMPLETENESS_COMPLETE"
+        }
+      }
+    ]
+  },
+  "fileChangeProgress": {
+    "changeSetId": "aex_hermetic_0001:0",
+    "filesChanged": 1,
+    "linesAdded": 2,
+    "entries": [
+      {
+        "pathBefore": "notes.md",
+        "pathAfter": "notes.md",
+        "kind": "FILE_CHANGE_KIND_MODIFY",
+        "linesAdded": 2
+      }
+    ],
+    "capturedAt": "2026-01-01T00:00:05.000Z"
+  }
+}