@stigmer/runner 3.15.0 → 3.15.2-dev.20260913223433

package/src/activities/execute-cursor/turn-setup.ts

@@ -9,8 +9,9 @@
  * the attachments are resolved. What remains is Cursor's own reading of that
  * record: the cursor mode; the row facts beside the runtime's approval
  * verdicts; the SDK's MCP config; the prompt-shaped view of the attachments;
- * the HITL gate (hook script, approval state, grants, denial watcher,
- * capture baseline, progress substrate); the catalog validation of the
+ * the HITL gate (hook script, approval state, grants, denial watcher, and
+ * the hook sidecar bound as the runtime's CAS observations); the catalog
+ * validation of the
  * requested model; the credential, the sub-agents, the variant params and
  * the agent itself (parked or resolved); the bind of a new agent's id through
  * the sink; the prompt in one of its four shapes; the vision payload; the
@@ -27,40 +28,36 @@
 
 import type { SDKUserMessage } from "@cursor/sdk";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
-import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { Config } from "../../config.js";
 import type { TurnInput, TurnSink } from "../../harness/types.js";
-import { isReinvocation } from "../../harness/turn-context.js";
 import { toCursorImages } from "../../shared/attachment-vision.js";
 import { emitTimingLog } from "../../shared/cold-start-timing.js";
 import { deriveExecutionFingerprintKey } from "../../shared/approval-fingerprint.js";
 import { isUnattendedApprovalMode } from "../../shared/approval-policy.js";
 import { excludeAppliedFromGrants } from "../../shared/exact-apply.js";
 import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
-import { newProgressCaptureState, type ProgressCaptureState, type ProgressSubstrate } from "../../shared/filereview/progress.js";
 import { enabledToolsBySlug } from "../../shared/mcp-enabled-tools.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
 import { computeAgentFingerprint, takeCachedAgent } from "./agent-session-cache.js";
 import { buildApprovalGrants, buildApprovalState, emitCursorGrantReceipts, reconstructAdjudicatedApprovals, watchDenialLedger, type ApprovalGrant } from "./approval-state.js";
-import { buildCursorProgressSubstrate, captureBaselineToLedger } from "./capture-flow.js";
+import { readSidecarSnapshot } from "./cas-observations.js";
 import { CURSOR_CAPABILITIES } from "./cursor-capabilities.js";
 import { toCursorMcpConfig, validateMcpServerEnv } from "./cursor-mcp-config.js";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { closeProxySessions } from "./http2-interceptor.js";
-import { seededSubAgentsOf } from "./message-translator.js";
 import { ensureLoaded as ensurePricingLoaded, resolveModelId } from "./model-pricing.js";
 import {
   appendStructuredOutputDirective,
   buildPrompt,
   primarySendCarriesImages,
   promptCarriesStandingContext,
-  type AttachmentPromptEntry,
   type BuildPromptInput,
-  type VisionPromptInfo,
 } from "./prompt-builder.js";
+import { visionPromptInfoOf } from "../../shared/prompt-sections.js";
 import { resolveServiceTierParams } from "./service-tier.js";
 import {
   createAgent,
@@ -93,8 +90,6 @@ export type CursorAgentMode = "cloud" | "local";
 export interface AdjudicatedRows {
   /** Create-vs-resume, derived from the state id exactly as the runtime derives it. */
   readonly isReinvocation: boolean;
-  /** The sub-agent rows the accumulator re-registers on a resume. */
-  readonly seededSubAgents: readonly SubAgentExecution[];
   /** The pending-approval protos the grant builder and the reinvocation prompt render. */
   readonly adjudicatedApprovals: PendingApproval[];
   /** The content digest that authorizes an approved edit by its exact bytes (a sibling edit to the same file re-gates). */
@@ -107,10 +102,6 @@ export interface CursorGate {
   readonly hitlDir: string;
   readonly hitlGate: HitlGateHandle;
   readonly approvalGrants: ApprovalGrant[] | undefined;
-  /** The pre-turn tree in capture mode, pinned before the agent runs; the boundary diffs against it. */
-  readonly baselineTree: string | undefined;
-  readonly progressSubstrate: ProgressSubstrate | undefined;
-  readonly progressState: ProgressCaptureState;
   /** Closes the denial-ledger watcher; idempotent. */
   readonly stopDenialWatcher: () => void;
   /** Restores the workspace's `.cursor/hooks.json` (issue #173); the runtime removes the `.stigmer` link after it. */
@@ -158,13 +149,18 @@ export function resolveCursorMode(input: TurnInput, config: CursorAdapterConfig)
   return { cursorMode, agentMode: isCloudMode(cursorMode) ? "cloud" : "local" };
 }
 
-/** The adapter's own read of the adjudicated rows the runtime already turned into verdicts. */
-export function readAdjudicatedRows(input: TurnInput): AdjudicatedRows {
-  const reinvoked = isReinvocation(CURSOR_CAPABILITIES.stateIdSource, input);
+/**
+ * The adapter's own read of the adjudicated rows the runtime already turned
+ * into verdicts. Create-vs-resume is the adapter's fact about its ENGINE: a
+ * bound agent id (`threadId`, engine-minted) means the Cursor agent already
+ * holds this session's conversation, so this turn resumes it — the runtime's
+ * `isReinvocation` answers its own question and is not consulted here.
+ */
+export function readAdjudicatedRows(input: TurnInput, status: AgentExecutionStatus): AdjudicatedRows {
+  const reinvoked = input.threadId !== "";
   const adjudicated = reinvoked ? reconstructAdjudicatedApprovals(input.execution.status?.messages ?? []) : undefined;
   return {
     isReinvocation: reinvoked,
-    seededSubAgents: seededSubAgentsOf(input.execution),
     adjudicatedApprovals: adjudicated?.pendingApprovals ?? [],
     adjudicatedContentDigests: adjudicated?.contentDigests ?? new Map(),
   };
@@ -185,21 +181,6 @@ export function projectMcpConfig(input: TurnInput): ReturnType<typeof toCursorMc
   return toCursorMcpConfig(input.mcp.servers);
 }
 
-/** The prompt-shaped projections of the runtime's attachments: the `<input_files>` entries and the vision disclosure. */
-export function prepareAttachmentPrompt(input: TurnInput): { attachmentEntries: AttachmentPromptEntry[]; visionPromptInfo: VisionPromptInfo | undefined } {
-  const { visionImages, visionNotViewable } = input.attachments;
-  const attachmentEntries = input.attachments.results.map((a) => ({
-    path: a.relativePath,
-    ...(a.renamedFrom !== undefined ? { renamedFrom: a.renamedFrom } : {}),
-    ...(a.downloadUrl !== undefined ? { downloadUrl: a.downloadUrl } : {}),
-  }));
-  const visionPromptInfo =
-    visionImages.length > 0 || visionNotViewable.length > 0
-      ? { inlineFilenames: visionImages.map((v) => v.filename), notViewable: visionNotViewable }
-      : undefined;
-  return { attachmentEntries, visionPromptInfo };
-}
-
 /**
  * Install the HITL approval gate BEFORE resolving the agent.
  *
@@ -216,26 +197,16 @@ export function prepareAttachmentPrompt(input: TurnInput): { attachmentEntries:
  * the resumed agent's re-attempt (which carries a fresh tool-call id) is
  * allowed through. Exact-applied writes are EXCLUDED from the grants: with no
  * grant, a further write to that file is re-gated (the user sees every change).
- * Capture mode: pin the pre-turn baseline tree before the agent runs (and
- * before the gate is installed, though the gate files are excluded from the
- * capture anyway). The turn-end capture diffs the post-turn tree against this
- * to build the per-file cards; the baseline ref is also what a reject reverts
- * to on resume. Covers a fresh turn and the approved-irreversible resume
- * fall-through (the agent will run and may make further edits).
+ * Capture mode is the runtime's (`harness/capture.ts`: the baseline is pinned
+ * before this adapter runs, the candidate captured after it returns); what
+ * this gate contributes is the hook's on-disk sidecar of gitignored writes,
+ * bound as the runtime's CAS observations.
  */
 export async function installGate(input: TurnInput, sink: TurnSink, rows: AdjudicatedRows, streamState: TurnStreamState): Promise<CursorGate> {
   const { executionId, sessionId, workspace, mcp, approvalDecisions, appliedToolCallIds, artifactStorage } = input;
-  const { primaryDir, gitWorkspace, captureMode, changeSetId } = workspace;
+  const { primaryDir, gitWorkspace, captureMode } = workspace;
   const globalBypass = mcp.leases.global;
 
-  let baselineTree: string | undefined;
-  if (captureMode && primaryDir) {
-    // Pin the pre-turn tree AND author BASELINE_CAPTURED so the projection can
-    // materialize the change set (status CAPTURING) before any candidate exists.
-    // The event rides the next persist; CAPTURING does not arm the unified gate.
-    baselineTree = await captureBaselineToLedger({ status: sink.status, gitRoot: primaryDir, executionId, changeSetId, gitWorkspace });
-  }
-
   const hitlDir = await ensureHitlDir(sessionId);
   const grantApprovals = excludeAppliedFromGrants(rows.adjudicatedApprovals, appliedToolCallIds);
   const approvalGrants = approvalDecisions.size > 0
@@ -295,28 +266,18 @@ export async function installGate(input: TurnInput, sink: TurnSink, rows: Adjudi
   });
   sink.setupTiming.mark("install_hitl_gate");
 
-  // Mid-run live capture (DD-32 / DD-33): choose the progress substrate for this
-  // turn's workspace shape ONCE (git / non-git CAS / hybrid). It owns its own
-  // short-circuit cache across the loop's persists; the floor lives in
-  // progressState. Undefined outside capture mode — writes are deny-gated and
-  // nothing is captured.
-  const progressSubstrate = buildCursorProgressSubstrate({
-    captureMode,
-    gitWorkspace,
-    workspaceRoot: primaryDir,
-    baselineTree,
-    executionId,
-    hitlDir,
-    storage: artifactStorage,
-  });
+  // What the hook observed touching gitignored (or, in a non-git tree, any)
+  // paths this turn — the sidecar it stages under `captureIgnored`. Bound as
+  // the runtime's CAS observations; each read is one small directory scan,
+  // and the runtime reads it at most once per progress floor and once at the
+  // boundary. Bound whenever the gate exists: without storage the runtime
+  // ignores it (a gitignored write is deny-gated then, never captured).
+  sink.bindCasObservations(() => readSidecarSnapshot(hitlDir));
 
   return {
     hitlDir,
     hitlGate,
     approvalGrants,
-    baselineTree,
-    progressSubstrate,
-    progressState: newProgressCaptureState(),
     stopDenialWatcher,
     removeGate: () => removeHitlGate(hitlGate),
   };
@@ -540,7 +501,6 @@ export async function createFreshAgent(engine: CursorEngine): Promise<AgentResol
 export async function buildTurnPrompt(input: TurnInput, sink: TurnSink, engine: CursorEngine, rows: AdjudicatedRows): Promise<CursorPrompt> {
   const { executionId, blueprint, standing, attachments, workspace, approvalDecisions, appliedToolCallIds, structuredOutputSchema } = input;
   const spec = input.execution.spec!;
-  const { attachmentEntries, visionPromptInfo } = prepareAttachmentPrompt(input);
   const interactionMode = spec.executionConfig?.interactionMode ?? InteractionMode.UNSPECIFIED;
   const buildFromPlan = spec.executionConfig?.buildFromPlan ?? false;
 
@@ -548,13 +508,13 @@ export async function buildTurnPrompt(input: TurnInput, sink: TurnSink, engine:
     approvalDecisions,
     instructions: blueprint.instructions,
     userMessage: spec.message,
-    skills: input.skills,
+    skills: input.skills.root,
     channelMessaging: input.mcp.channelMessaging,
     subAgents: blueprint.subAgents,
     workspaceDirs: [...workspace.dirs],
     workspaceFileRefs: spec.workspaceFileRefs ?? [],
-    attachments: attachmentEntries,
-    vision: visionPromptInfo,
+    attachments: attachments.results,
+    vision: visionPromptInfoOf(attachments),
     downloadUrlKind: input.artifactStorage?.downloadUrlKind,
     pendingApprovals: rows.adjudicatedApprovals,
     appliedToolCallIds,

package/src/activities/execute-cursor/turn-stream.ts

@@ -1,13 +1,12 @@
 /**
  * The Cursor harness's stream phase — the single per-event consumption loop that
- * turns a live Cursor SDK run into the streamed transcript, mid-run progress, and
- * the one flag that decides how the turn goes on (the first-denial stop).
+ * turns a live Cursor SDK run into the streamed transcript and the one flag
+ * that decides how the turn goes on (the first-denial stop).
  *
  * Extracted from the activity entry point so that BOTH the primary turn and
  * the two recovery retries (poisoned-handle / transport-timeout) drive the
  * exact same code. The retries previously re-implemented a stripped "bare"
- * loop that dropped live persist, DD-32/DD-33 mid-run progress, sub-agent
- * tracking, the first-denial early stop, and correct pause handling — so a
+ * loop that dropped live persist, sub-agent tracking, the first-denial early stop, and correct pause handling — so a
  * retry froze the UI and mis-handled a mid-retry pause. One loop removes that
  * drift by construction.
  *
@@ -34,11 +33,6 @@ import type { SDKMessage, InteractionUpdate } from "@cursor/sdk";
 import type { TurnSink } from "../../harness/types.js";
 import { shouldPersistStreamingStatus } from "../../shared/persist-decision.js";
 import { approvalDenials, readDenialLedger } from "./approval-state.js";
-import {
-  captureFileChangeProgress,
-  type ProgressCaptureState,
-  type ProgressSubstrate,
-} from "../../shared/filereview/progress.js";
 import type { MessageAccumulator } from "./message-translator.js";
 import type { DeltaEnricher } from "./delta-enricher.js";
 import type { TodoTracker } from "./todo-tracker.js";
@@ -117,9 +111,6 @@ export interface CursorTurnStreamDeps extends TurnOnDeltaDeps {
   readonly todoTracker: TodoTracker;
   readonly eventRecorder: CursorTurnEventRecorder | undefined;
   readonly scheduler: StreamingUpdateScheduler;
-  readonly progressSubstrate: ProgressSubstrate | undefined;
-  readonly progressState: ProgressCaptureState;
-  readonly changeSetId: string;
   /** Session HITL dir holding the denial ledger; undefined → no gate installed → no first-denial stop. */
   readonly hitlDir: string | undefined;
 }
@@ -178,9 +169,6 @@ export async function consumeCursorTurnStream(
     deltaEnricher,
     eventRecorder,
     scheduler,
-    progressSubstrate,
-    progressState,
-    changeSetId,
     hitlDir,
     executionId,
     state,
@@ -300,22 +288,11 @@ export async function consumeCursorTurnStream(
         state.eventCount,
       );
       if (shouldPersist) {
-        // Sync sub-agent executions into status before every persist so the live
-        // UI reflects delegation (including the IN_PROGRESS state) while the
-        // parent is still running — matching the native harness.
-        status.subAgentExecutions = accumulator.subAgentExecutions;
-        // Mid-run live capture (DD-32 / DD-33): attach the "N files changed so
-        // far" snapshot onto status.file_change_progress, throttled internally by
-        // the floor. Never authoritative — the turn-boundary candidate remains
-        // the reviewed diff.
-        if (progressSubstrate) {
-          await captureFileChangeProgress({
-            status,
-            changeSetId,
-            substrate: progressSubstrate,
-            state: progressState,
-          });
-        }
+        // The accumulator upserts sub-agent rows into `status.subAgentExecutions`
+        // in place (wrapped by reference at construction), so every persist
+        // already carries delegation, IN_PROGRESS included. The runtime attaches
+        // the mid-run file-change progress on this write (the chokepoint's
+        // step 2), as it does on every write.
         // Awaited: the runtime reads the control plane's answer to this write,
         // and a STOP must be seen at the next event boundary, not one event late.
         await sink.requestPersist();

package/src/activities/execute-cursor/turn.ts

@@ -82,7 +82,7 @@ export async function runCursorTurn(input: TurnInput, sink: TurnSink, config: Cu
     // gate so the denial watcher can write into them.
     const streamState = newTurnStreamState();
     const mode = resolveCursorMode(input, config);
-    const rows = readAdjudicatedRows(input);
+    const rows = readAdjudicatedRows(input, sink.status);
     gate = await installGate(input, sink, rows, streamState);
     if (sink.stopSignal.aborted) return (outcome = { kind: "interrupted" });
 
@@ -179,6 +179,10 @@ function disposeEngine(engine: CursorEngine, sessionId: string, outcome: TurnOut
     case "cancelled":
     case "awaiting_approval":
     case "interrupted":
+    // The Cursor SDK has no tool-round budget, so this adapter never ends a
+    // turn `tool_call_limit`; were it to, the engine would be parked like any
+    // other non-failed exit (the conversation continues on the next message).
+    case "tool_call_limit":
       park();
       return;
     case "failed":