@stigmer/runner 3.14.0 → 3.15.0

package/src/activities/execute-cursor/__tests__/http2-interceptor.test.ts

@@ -1,8 +1,8 @@
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import { createRequire } from "node:module";
 import type http2Type from "node:http2";
-import { installHttp2Interceptor, uninstallHttp2Interceptor, updateHttp2InterceptorToken, assertHttp2ConnectPatched } from "../http2-interceptor.js";
-import { getExecutionContext } from "../fetch-interceptor.js";
+import { installHttp2Interceptor, uninstallHttp2Interceptor, assertHttp2ConnectPatched } from "../http2-interceptor.js";
+import { getExecutionContext } from "../../../shared/execution-context.js";
 
 const require = createRequire(import.meta.url);
 const http2: typeof http2Type = require("node:http2");
@@ -53,27 +53,56 @@ describe("http2-interceptor", () => {
   describe("installHttp2Interceptor", () => {
     it("is a no-op when proxyEndpoint is undefined", () => {
       const before = http2.connect;
-      installHttp2Interceptor({ proxyEndpoint: undefined, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: undefined, proxyTokenRef: { current: STIGMER_TOKEN } });
       expect(http2.connect).toBe(before);
     });
 
     it("is a no-op when proxyEndpoint is empty string", () => {
       const before = http2.connect;
-      installHttp2Interceptor({ proxyEndpoint: "", stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: "", proxyTokenRef: { current: STIGMER_TOKEN } });
       expect(http2.connect).toBe(before);
     });
 
-    it("is a no-op when stigmerToken is undefined", () => {
+    it("is a no-op when no token ref is bound", () => {
       const before = http2.connect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: undefined });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: undefined });
       expect(http2.connect).toBe(before);
     });
 
-    it("replaces http2.connect when proxyEndpoint and stigmerToken are valid", () => {
+    it("is a no-op when the bound ref is empty at install", () => {
       const before = http2.connect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: null } });
+      expect(http2.connect).toBe(before);
+    });
+
+    it("replaces http2.connect when proxyEndpoint and a bound ref are valid", () => {
+      const before = http2.connect;
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: STIGMER_TOKEN } });
       expect(http2.connect).not.toBe(before);
     });
+
+    it("is idempotent: a second install rebinds the ref and does not wrap a proxy session twice", async () => {
+      const mock = createMockConnect();
+      http2.connect = mock.mockConnect;
+      const first = { current: "first-token" };
+      const second = { current: "second-token" };
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: first });
+      const patched = http2.connect;
+
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: second });
+      // The one patch stays; a re-capture here would have made the patched
+      // connect the "original" and wrapped every proxy session twice.
+      expect(http2.connect).toBe(patched);
+
+      const session = http2.connect(PROXY_ENDPOINT);
+      session.request({ ":path": "/agent.v1.AgentService/Run" });
+      expect(mock.calls).toHaveLength(1);
+      expect(mock.calls[0].headers).toHaveProperty("x-stigmer-auth", "Bearer second-token");
+
+      // Uninstall restores the connect that was live at the FIRST install.
+      uninstallHttp2Interceptor();
+      expect(http2.connect).toBe(mock.mockConnect);
+    });
   });
 
   describe("uninstallHttp2Interceptor", () => {
@@ -81,7 +110,7 @@ describe("http2-interceptor", () => {
       const { mockConnect } = createMockConnect();
       http2.connect = mockConnect;
 
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: STIGMER_TOKEN } });
       expect(http2.connect).not.toBe(mockConnect);
 
       uninstallHttp2Interceptor();
@@ -95,7 +124,7 @@ describe("http2-interceptor", () => {
     beforeEach(() => {
       mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: STIGMER_TOKEN } });
     });
 
     it("injects x-stigmer-execution-id and x-stigmer-auth when context is active and target is proxy", async () => {
@@ -188,7 +217,7 @@ describe("http2-interceptor", () => {
     beforeEach(() => {
       mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: STIGMER_TOKEN } });
     });
 
     it("different requests on same session get execution IDs from their respective ALS contexts", async () => {
@@ -229,7 +258,7 @@ describe("http2-interceptor", () => {
     it("matches https with explicit port", async () => {
       const mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com:9443", stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com:9443", proxyTokenRef: { current: STIGMER_TOKEN } });
 
       const executionContext = getExecutionContext();
       await executionContext.run({ executionId: "exec-port" }, async () => {
@@ -243,7 +272,7 @@ describe("http2-interceptor", () => {
     it("matches https with default port (443)", async () => {
       const mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com", stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com", proxyTokenRef: { current: STIGMER_TOKEN } });
 
       const executionContext = getExecutionContext();
       await executionContext.run({ executionId: "exec-default-port" }, async () => {
@@ -257,7 +286,7 @@ describe("http2-interceptor", () => {
     it("matches http with explicit port", async () => {
       const mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: "http://localhost:9090", stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: "http://localhost:9090", proxyTokenRef: { current: STIGMER_TOKEN } });
 
       const executionContext = getExecutionContext();
       await executionContext.run({ executionId: "exec-http" }, async () => {
@@ -271,7 +300,7 @@ describe("http2-interceptor", () => {
     it("does not match when port differs", async () => {
       const mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com:8443", stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: "https://proxy.example.com:8443", proxyTokenRef: { current: STIGMER_TOKEN } });
 
       const executionContext = getExecutionContext();
       await executionContext.run({ executionId: "exec-wrong-port" }, async () => {
@@ -283,31 +312,30 @@ describe("http2-interceptor", () => {
     });
   });
 
-  describe("updateHttp2InterceptorToken", () => {
+  describe("the token ref is read per request (the root rotates it in place; Q-S2-7)", () => {
     let mock: ReturnType<typeof createMockConnect>;
+    let proxyTokenRef: { current: string | null };
 
     beforeEach(() => {
       mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      proxyTokenRef = { current: STIGMER_TOKEN };
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef });
     });
 
-    it("subsequent requests use the updated token", () => {
+    it("a session opened BEFORE a rotation carries the new token on its next request", () => {
       const session = http2.connect(PROXY_ENDPOINT);
       session.request({ ":path": "/agent.v1.AgentService/Run" });
-
       expect(mock.calls[0].headers).toHaveProperty("x-stigmer-auth", `Bearer ${STIGMER_TOKEN}`);
 
-      const refreshedToken = "refreshed-stigmer-jwt-token";
-      updateHttp2InterceptorToken(refreshedToken);
-
+      proxyTokenRef.current = "refreshed-stigmer-jwt-token";
       session.request({ ":path": "/agent.v1.AgentService/Run" });
 
-      expect(mock.calls[1].headers).toHaveProperty("x-stigmer-auth", `Bearer ${refreshedToken}`);
+      expect(mock.calls[1].headers).toHaveProperty("x-stigmer-auth", "Bearer refreshed-stigmer-jwt-token");
     });
 
-    it("new sessions after token update use the updated token", () => {
-      updateHttp2InterceptorToken("new-token-value");
+    it("a session opened AFTER a rotation carries the new token", () => {
+      proxyTokenRef.current = "new-token-value";
 
       const session = http2.connect(PROXY_ENDPOINT);
       session.request({ ":path": "/aiserver.v1.AnalyticsService/BootstrapStatsig" });
@@ -315,15 +343,16 @@ describe("http2-interceptor", () => {
       expect(mock.calls[0].headers).toHaveProperty("x-stigmer-auth", "Bearer new-token-value");
     });
 
-    it("is a no-op when interceptor is not installed", () => {
-      uninstallHttp2Interceptor();
-      // Should not throw
-      updateHttp2InterceptorToken("orphan-token");
-
-      const session = http2.connect(PROXY_ENDPOINT);
-      session.request({ ":path": "/test" });
+    it("an emptied ref omits x-stigmer-auth and keeps the execution id (the proxy's 401 is the diagnostic)", async () => {
+      proxyTokenRef.current = null;
+      const executionContext = getExecutionContext();
+      await executionContext.run({ executionId: "exec-empty-ref" }, async () => {
+        const session = http2.connect(PROXY_ENDPOINT);
+        session.request({ ":path": "/agent.v1.AgentService/Run" });
+      });
 
       expect(mock.calls[0].headers).not.toHaveProperty("x-stigmer-auth");
+      expect(mock.calls[0].headers).toHaveProperty("x-stigmer-execution-id", "exec-empty-ref");
     });
   });
 
@@ -333,8 +362,9 @@ describe("http2-interceptor", () => {
     // and CASE A/B in the probe). That makes the positive "configured + in-sync"
     // path impossible to assert deterministically inside a shared test process
     // — it is guaranteed by load order (interceptor installed before connect-node
-    // imports node:http2) and exercised by the boot guard in the runner
-    // factories. Here we cover the two deterministic contracts: it is a no-op
+    // imports node:http2), exercised by the boot guard inside the Cursor
+    // adapter's boot, and proven in a FRESH process by
+    // src/__tests__/harness-boot-order.test.ts. Here we cover the two deterministic contracts: it is a no-op
     // when unconfigured (no import, so it never freezes the facade), and it
     // throws when the frozen facade is out of sync with the patched connect.
     //
@@ -359,7 +389,7 @@ describe("http2-interceptor", () => {
 
       const mock = createMockConnect();
       http2.connect = mock.mockConnect;
-      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, stigmerToken: STIGMER_TOKEN });
+      installHttp2Interceptor({ proxyEndpoint: PROXY_ENDPOINT, proxyTokenRef: { current: STIGMER_TOKEN } });
 
       await expect(assertHttp2ConnectPatched()).rejects.toThrow(
         /node:http2 ESM facade is unpatched/,

package/src/activities/execute-cursor/__tests__/message-translator.test.ts

@@ -26,9 +26,7 @@ import type { SDKMessage } from "@cursor/sdk";
 import {
   MessageAccumulator,
   extractConversationSteps,
-  cancelInProgressSubAgentProtos,
 } from "../message-translator.js";
-import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 
 function toolCallEvent(
   callId: string,
@@ -1032,42 +1030,4 @@ describe("MessageAccumulator tool call status transitions", () => {
     });
   });
 
-  describe("cancelInProgressSubAgentProtos standalone", () => {
-    it("cancels IN_PROGRESS/PENDING protos in place and reports whether anything changed", () => {
-      const running = create(SubAgentExecutionSchema, {
-        id: "a",
-        status: SubAgentStatus.SUB_AGENT_IN_PROGRESS,
-      });
-      const pending = create(SubAgentExecutionSchema, {
-        id: "b",
-        status: SubAgentStatus.SUB_AGENT_PENDING,
-      });
-      const completed = create(SubAgentExecutionSchema, {
-        id: "c",
-        status: SubAgentStatus.SUB_AGENT_COMPLETED,
-        completedAt: "2026-01-01T00:00:00Z",
-      });
-
-      const list = [running, pending, completed];
-      const changed = cancelInProgressSubAgentProtos(list);
-
-      expect(changed).toBe(true);
-      expect(running.status).toBe(SubAgentStatus.SUB_AGENT_CANCELLED);
-      expect(running.completedAt).not.toBe("");
-      expect(pending.status).toBe(SubAgentStatus.SUB_AGENT_CANCELLED);
-      // Terminal sub-agents are untouched.
-      expect(completed.status).toBe(SubAgentStatus.SUB_AGENT_COMPLETED);
-      expect(completed.completedAt).toBe("2026-01-01T00:00:00Z");
-    });
-
-    it("returns false when there is nothing to cancel", () => {
-      const completed = create(SubAgentExecutionSchema, {
-        id: "c",
-        status: SubAgentStatus.SUB_AGENT_COMPLETED,
-      });
-      expect(cancelInProgressSubAgentProtos([completed])).toBe(false);
-      expect(cancelInProgressSubAgentProtos([])).toBe(false);
-    });
-  });
-
 });

package/src/activities/execute-cursor/__tests__/same-identity-reproposal.test.ts

@@ -0,0 +1,171 @@
+/**
+ * A later, same-identity proposal is a NEW act: it never lands on a row the
+ * user already decided (S2 M4 finding F9).
+ *
+ * The defect the harness contract kit found against this adapter: within one
+ * execution, after the user APPROVED `edit a.txt` and the resumed agent ran
+ * it (its row COMPLETED, still carrying `approval_action = APPROVE`), the
+ * model proposed the SAME edit again in a later turn. The hook denied it
+ * (correct: no grant). The denial overlay then matched the denial to the
+ * FIRST same-identity row in the whole transcript — the completed, approved
+ * one — flipped it back to WAITING_APPROVAL with its APPROVE still on it and
+ * wiped its result; the actual streamed call was hidden as a twin. On the next
+ * invocation `approvalDecisionsOf` read that row as a decision and the new,
+ * never-approved proposal ran under the old approval. The accumulator had the
+ * sibling flaw: a re-issue after a SKIP or REJECT was reconciled onto the
+ * declined row by identity, inheriting its decision.
+ *
+ * The rule, in `message-translator.ts`: a row the server has adjudicated
+ * (`isAdjudicatedRow`) is never the home of THIS turn's denial and never a
+ * twin to collapse; a row the user DECLINED (`isDeclinedRow`) is never the
+ * home of a later same-identity call. The approved re-issue (the
+ * `sequential-gate-resume` shape) still reconciles onto its APPROVE row — the
+ * one case where the later call IS the decided act.
+ *
+ * Each arm ends by deriving the decisions the runtime would read from the
+ * reconciled transcript (`approvalDecisionsOf`): the assertion that matters
+ * is that nothing decided bleeds onto the new proposal.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create, clone } from "@bufbuild/protobuf";
+import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApprovalAction, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { SDKMessage } from "@cursor/sdk";
+
+import { approvalDecisionsOf } from "../../../harness/turn-context.js";
+import { MessageAccumulator, reconcileDeniedToolCalls, toolCallIdentityToken } from "../message-translator.js";
+import type { DeniedLedgerEntry } from "../approval-state.js";
+
+const PATH = "/work/a.txt";
+const CONTENT = "A\n";
+const FIRST_ID = "tool_edit_first";
+const LATER_ID = "tool_edit_later";
+const RESULT_OF_FIRST = "wrote a.txt";
+
+function toolCallEvent(
+  callId: string,
+  status: "running" | "completed" | "error",
+  result?: unknown,
+): Extract<SDKMessage, { type: "tool_call" }> {
+  return { type: "tool_call", agent_id: "agent-1", run_id: "r3", call_id: callId, name: "edit", status, args: { path: PATH, content: CONTENT }, result };
+}
+
+/** The transcript after the first gate was decided `action` and, for an APPROVE, run. */
+function decidedFirstGate(action: ApprovalAction): AgentMessage[] {
+  const executed = action === ApprovalAction.APPROVE;
+  return [
+    create(AgentMessageSchema, {
+      type: MessageType.MESSAGE_AI,
+      content: "I'll write file A.",
+      toolCalls: [
+        create(ToolCallSchema, {
+          id: FIRST_ID,
+          name: "edit",
+          status: executed ? ToolCallStatus.TOOL_CALL_COMPLETED : ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+          requiresApproval: true,
+          approvalAction: action,
+          args: { path: PATH, content: CONTENT },
+          argsPreview: JSON.stringify({ path: PATH, content: CONTENT }),
+          result: executed ? RESULT_OF_FIRST : "",
+          completedAt: executed ? "2026-06-20T00:00:05.000Z" : "",
+        }),
+      ],
+    }),
+  ];
+}
+
+function allToolCalls(messages: AgentMessage[]): ToolCall[] {
+  return messages.flatMap((m) => m.toolCalls);
+}
+
+/** The later turn: the model proposes the same edit under a fresh id, the hook denies it, the turn boundary reconciles. */
+async function laterTurnProposesSameEdit(seeded: AgentMessage[]): Promise<ToolCall[]> {
+  const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+  acc.processEvent(toolCallEvent(LATER_ID, "running"));
+  acc.processEvent(toolCallEvent(LATER_ID, "error", "Blocked by hook"));
+  acc.finalize();
+  const ledger: DeniedLedgerEntry[] = [{ toolName: "Write", token: toolCallIdentityToken(allToolCalls(seeded).find((tc) => tc.id === LATER_ID)!) }];
+  return reconcileDeniedToolCalls(seeded, ledger);
+}
+
+function decisionsTheRuntimeWouldRead(messages: AgentMessage[]): ReadonlyMap<string, ApprovalAction> {
+  return approvalDecisionsOf(create(AgentExecutionStatusSchema, { messages }));
+}
+
+describe("a later same-identity proposal never lands on a decided row (F9)", () => {
+  it("after APPROVE and execution: the completed row keeps its result and decision; the new call gets its own gate; nothing bleeds", async () => {
+    const seeded = decidedFirstGate(ApprovalAction.APPROVE).map((m) => clone(AgentMessageSchema, m));
+
+    const gated = await laterTurnProposesSameEdit(seeded);
+
+    const byId = new Map(allToolCalls(seeded).map((tc) => [tc.id, tc]));
+    const first = byId.get(FIRST_ID)!;
+    expect(first.status, "the executed row is the transcript's record and is never rewritten").toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(first.result).toBe(RESULT_OF_FIRST);
+    expect(first.approvalAction).toBe(ApprovalAction.APPROVE);
+
+    const later = byId.get(LATER_ID);
+    expect(later, "the new act has its own row").toBeDefined();
+    expect(later!.status, "and it is the turn's one gate").toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(later!.approvalAction, "undecided — the user has not been asked yet").toBe(ApprovalAction.UNSPECIFIED);
+    expect(gated.map((tc) => tc.id)).toEqual([LATER_ID]);
+
+    expect(decisionsTheRuntimeWouldRead(seeded).size, "no decision bleeds onto the new proposal").toBe(0);
+  });
+
+  it.each([
+    ["SKIP", ApprovalAction.SKIP],
+    ["REJECT", ApprovalAction.REJECT],
+  ] as const)("after %s: the re-issue is not reconciled onto the declined row; it gets its own gate and inherits nothing", async (_label, action) => {
+    const seeded = decidedFirstGate(action).map((m) => clone(AgentMessageSchema, m));
+
+    const gated = await laterTurnProposesSameEdit(seeded);
+
+    const byId = new Map(allToolCalls(seeded).map((tc) => [tc.id, tc]));
+    const first = byId.get(FIRST_ID)!;
+    expect(first.status, "the declined gate is untouched").toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(first.approvalAction).toBe(action);
+    expect(first.error, "the later denial was not merged onto it").toBe("");
+
+    const later = byId.get(LATER_ID);
+    expect(later, "the re-issue is a new act with its own row").toBeDefined();
+    expect(later!.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(later!.approvalAction).toBe(ApprovalAction.UNSPECIFIED);
+    expect(gated.map((tc) => tc.id)).toEqual([LATER_ID]);
+
+    const decisions = decisionsTheRuntimeWouldRead(seeded);
+    expect(decisions.get(FIRST_ID), "the declined row's decision stays its own").toBe(action);
+    expect(decisions.has(LATER_ID), "and is not the new proposal's").toBe(false);
+  });
+
+  it("the approved re-issue itself still reconciles onto its APPROVE row (the sequential-gate-resume shape is unchanged)", () => {
+    const seeded = [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        toolCalls: [
+          create(ToolCallSchema, {
+            id: FIRST_ID,
+            name: "edit",
+            status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+            requiresApproval: true,
+            approvalAction: ApprovalAction.APPROVE,
+            argsPreview: JSON.stringify({ path: PATH, content: CONTENT }),
+          }),
+        ],
+      }),
+    ];
+
+    const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+    acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "running"));
+    acc.processEvent(toolCallEvent(`${FIRST_ID}_RESUME`, "completed", RESULT_OF_FIRST));
+    acc.finalize();
+
+    const tools = allToolCalls(seeded);
+    expect(tools.map((tc) => tc.id), "one row, the committed id").toEqual([FIRST_ID]);
+    expect(tools[0]!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tools[0]!.result).toBe(RESULT_OF_FIRST);
+  });
+});