@stigmer/runner 3.15.1 → 3.15.2-dev.20260913223433

package/dist/activities/execute-cursor/capture-flow.js

@@ -1,285 +0,0 @@
-/**
- * Cursor adapter over the harness-agnostic capture-mode orchestration
- * ({@link ../../shared/filereview/capture.js}).
- *
- * The substrate (git snapshot/restore) and the orchestration (baseline/candidate/
- * reconcile authoring) live in `shared/filereview/` so the Cursor and deep-agent
- * harnesses author IDENTICAL ledger entries. This adapter binds the Cursor
- * specifics:
- *  - `harnessId = "cursor"` (stamped on the BASELINE payload the projection reads);
- *  - the Cursor gate files written into the workspace, excluded from the captured
- *    diff (`CURSOR_RUNNER_OWNED_PATHS`);
- *  - stamping the streamed file-edit transcript rows that flowed this turn with
- *    the change set id (`stampFlowedFileEditRows`) — the rows stay visible as
- *    observational/audit records at their transcript positions, while
- *    `file_change_sets` remains the single DECISION surface.
- *
- * The resume-time reconcile is NOT here since S2 M2: the turn runtime's
- * `reconcileReinvocation` (`harness/turn-context.ts`) calls the shared
- * reconcile directly under {@link CURSOR_FILE_REVIEW_IDENTITY}, the one
- * export that carries the two Cursor facts it needs. The two capture
- * functions keep their original signatures so the activity wiring (index.ts)
- * and the cutover tests are unchanged.
- */
-import { readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { FileCaptureClass } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { approvalCategory } from "./approval-policy.js";
-import { toolIdentity, primaryToken } from "./approval-state.js";
-import { readCasObservations } from "./cas-observations.js";
-import { contentDigest } from "../../shared/file-tools.js";
-import { isToolCallRowHidden, stampFileEditRow } from "../../shared/tool-row.js";
-import { captureBaselineToLedger as sharedCaptureBaselineToLedger, captureCandidateToLedger as sharedCaptureCandidateToLedger, } from "../../shared/filereview/capture.js";
-import { createGitProgressSubstrate, createHybridProgressSubstrate, } from "../../shared/filereview/progress.js";
-import { createCasProgressSubstrate, } from "../../shared/filereview/cas-progress.js";
-import { hasCandidateCaptured } from "../../shared/filereview/events.js";
-import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
-/** The harness id the projection reads from the BASELINE payload (load-bearing). */
-const HARNESS_ID = "cursor";
-/**
- * Workspace-relative paths the Cursor gate writes into the repo. They are excluded
- * from capture so a turn's diff never shows the gate's own machinery. (The
- * workspace-scoped gate dir and SDK state live under `~/.stigmer` / the
- * git-excluded `.stigmer`, so they need no exclusion here.)
- */
-const CURSOR_RUNNER_OWNED_PATHS = [
-    ".cursor/hooks.json",
-    ".cursor/rules/stigmer-tool-approval.mdc",
-];
-/**
- * The two facts the runtime's resume-time reconcile needs from this harness
- * (`harness/turn-context.ts` `reconcileReinvocation`): the same id and
- * exclude list the capture functions below stamp and apply, so the baseline a
- * turn authors and the reconcile a resume runs agree by construction.
- */
-export const CURSOR_FILE_REVIEW_IDENTITY = {
-    harnessId: HARNESS_ID,
-    excludePaths: CURSOR_RUNNER_OWNED_PATHS,
-};
-// `deriveCaptureMode` is the single capture-vs-deny-gate decision, now shared by
-// BOTH harnesses from `shared/filereview/capture.ts`. Re-exported here so existing
-// Cursor imports (index.ts, the deny-gate-exact-apply seam test) keep resolving
-// from this adapter.
-export { deriveCaptureMode } from "../../shared/filereview/capture.js";
-/**
- * Turn start: pin the pre-turn working tree behind the baseline ref and author
- * BASELINE_CAPTURED (harnessId "cursor"). Returns the baseline tree sha for the
- * turn-end diff.
- */
-export function captureBaselineToLedger(opts) {
-    return sharedCaptureBaselineToLedger({
-        ...opts,
-        harnessId: HARNESS_ID,
-        excludePaths: CURSOR_RUNNER_OWNED_PATHS,
-    });
-}
-/**
- * Turn end: capture the change set + author CANDIDATE_CAPTURED, then stamp the
- * streamed file-edit rows that flowed this turn with the change set id — the
- * rows stay visible in place as observational records while `file_change_sets`
- * remains the single decision surface. The working tree is LEFT applied
- * (Cursor parity).
- *
- * The change set is HYBRID (git tree) or CAS-only (non-git): the hook-staged
- * writes from the cas-observations sidecar this turn ({@link readCasObservations})
- * — the Cursor analog of deep-agent's `buildCasTurnCaptures` — composed with the
- * git-tracked diff when `gitWorkspace`. Non-secret staged paths become
- * `GIT_IGNORED_CAPTURED` (git tree) or `NON_GIT_CAS` (non-git) CAS captures
- * (before-bytes from the sidecar, after-bytes re-read from disk);
- * secret-blocked paths become content-less `DIFF_UNREVIEWABLE` entries. The
- * boundary re-runs {@link partitionIgnoredPathsBySecret} as a fail-closed
- * backstop, so a secret that ever slipped into the captured set still has its
- * bytes withheld from durable storage.
- *
- * `deniedTokens` are the identities the hook gated this turn (shell/MCP, or a
- * secret-like delete — non-secret CAS deletes flow since issue #303). A streamed
- * file-edit row whose identity is in that set is left for the deny-gate
- * reconcile path — it did NOT flow. A flowed gitignored write or delete is NOT
- * in that set (the hook allowed it), so it is stamped like any other flowed
- * edit and its captured delta surfaces as a CAS entry in the set.
- *
- * `hitlDir`/`storage` are omitted only by callers with no artifact storage
- * (captureIgnored off); the CAS half is then skipped and this is a git-only
- * capture exactly as before.
- *
- * Mutates `messages` and `status` in place. Returns the captured git changes.
- */
-export async function captureTurnToLedger(opts) {
-    const { status, gitRoot, executionId, changeSetId, baselineTree, messages, deniedTokens, hitlDir, storage, priorSubAgentToolCallIds, commandProvenance } = opts;
-    const gitWorkspace = opts.gitWorkspace ?? true;
-    // The CAS substrate class for this turn's staged writes: gitignored paths in a
-    // git tree, all touched paths in a non-git workspace.
-    const casCaptureClass = gitWorkspace
-        ? FileCaptureClass.GIT_IGNORED_CAPTURED
-        : FileCaptureClass.NON_GIT_CAS;
-    const { casCaptures, unreviewablePaths } = await buildCasTurnCaptures(gitRoot, hitlDir, storage, casCaptureClass);
-    const changes = await sharedCaptureCandidateToLedger({
-        status,
-        gitRoot,
-        executionId,
-        changeSetId,
-        baselineTree,
-        harnessId: HARNESS_ID,
-        excludePaths: CURSOR_RUNNER_OWNED_PATHS,
-        casCaptures,
-        storage,
-        unreviewablePaths,
-        unreviewableCaptureClass: casCaptureClass,
-        gitWorkspace,
-        commandProvenance,
-    });
-    // Observational rows: the reviewable diff lives on the file_review ledger
-    // (projected to file_change_sets); the streamed file-edit rows that flowed
-    // this turn stay visible in place, stamped with the change set id so clients
-    // badge them and anchor the decision surface. Denied (gitignored-delete/
-    // shell) rows stay on the deny-gate path. Gated on an authored CANDIDATE —
-    // a no-op turn (every edit reverted before the boundary) authors no event,
-    // and a row must never reference a change set that does not exist.
-    if (hasCandidateCaptured(status, changeSetId)) {
-        stampFlowedFileEditRows(messages, deniedTokens, changeSetId);
-        // Sub-agent edit rows fold their files into the SAME parent turn set, so they
-        // carry the same change set id. Walked separately (they live under
-        // subAgentExecutions, not the top-level transcript) and scoped to this turn
-        // via the pre-turn snapshot of seeded sub-agent tool-call ids.
-        for (const sa of status.subAgentExecutions) {
-            stampFlowedFileEditRows(sa.messages, deniedTokens, changeSetId, priorSubAgentToolCallIds);
-        }
-    }
-    return changes;
-}
-/**
- * Choose the mid-run progress substrate for this turn's workspace shape (DD-32 /
- * DD-33), returning `undefined` when there is nothing to observe (not capture
- * mode, or no workspace). Built ONCE per turn — the substrate owns its own
- * short-circuit cache across the loop's persists; the floor lives in the caller's
- * `ProgressCaptureState`. The live count and the turn-boundary reviewed set agree
- * by construction: the git slice binds the SAME `CURSOR_RUNNER_OWNED_PATHS`
- * exclusion {@link captureTurnToLedger} uses, and the CAS slice reads the SAME
- * hook sidecar ({@link readCasObservations}) the boundary reads.
- *
- *  - git tree, no storage      -> git substrate only (tracked-file `--numstat`);
- *  - git tree, storage (HYBRID) -> git + CAS (the gitignored writes the hook staged);
- *  - non-git workspace          -> CAS only (every tool-mediated write is CAS-staged).
- *
- * The CAS slice needs the hook sidecar, which exists only when `captureIgnored`
- * is on (storage configured). A non-git capture already required storage
- * (`deriveCaptureMode`), so its sidecar is always present; a git tree with no
- * storage simply gets the git-only substrate (parity with the pre-DD-33 behavior).
- */
-export function buildCursorProgressSubstrate(opts) {
-    const { captureMode, gitWorkspace, workspaceRoot, baselineTree, executionId, hitlDir, storage } = opts;
-    if (!captureMode || !workspaceRoot)
-        return undefined;
-    const casReader = hitlDir && storage ? createSidecarTouchedReader(hitlDir) : undefined;
-    if (gitWorkspace) {
-        if (!baselineTree)
-            return undefined;
-        const git = createGitProgressSubstrate({
-            workspaceRoot,
-            executionId,
-            baselineTree,
-            excludePaths: CURSOR_RUNNER_OWNED_PATHS,
-        });
-        return casReader
-            ? createHybridProgressSubstrate(git, createCasProgressSubstrate({ workspaceRoot, read: casReader }))
-            : git;
-    }
-    // Non-git: every tool-mediated write is CAS-staged; there is no git slice.
-    return casReader ? createCasProgressSubstrate({ workspaceRoot, read: casReader }) : undefined;
-}
-/**
- * A {@link CasTouchedReader} over the Cursor hook's on-disk sidecar. Each capture
- * reads the current observations ({@link readCasObservations}) and maps them to
- * the substrate's snapshot shape. Reads are bounded by the caller's capture floor
- * (default 2s), and the sidecar is small (one small marker + before-blob per
- * touched gitignored path), so re-reading per capture is cheap and always
- * reflects sub-agent writes staged since the last one.
- */
-function createSidecarTouchedReader(hitlDir) {
-    return async () => {
-        const { captured, secretPaths } = await readCasObservations(hitlDir);
-        const before = new Map();
-        for (const c of captured)
-            before.set(c.path, c.before);
-        return { before, blockedSecretPaths: new Set(secretPaths) };
-    };
-}
-/**
- * Compose this turn's CAS captures from the sidecar the hook staged, mirroring
- * deep-agent's `buildCasTurnCaptures`: for each non-secret observed path, the
- * before-bytes come from the sidecar and the after-bytes are re-read from disk now
- * (`null` = the file was removed after the write). Secret-blocked paths are
- * returned as `unreviewablePaths`. The secret partition is re-run as a
- * fail-closed backstop over the observed set. `captureClass` labels each captured
- * path's provenance (GIT_IGNORED_CAPTURED for a git tree's ignored paths,
- * NON_GIT_CAS for a non-git workspace).
- *
- * Returns empty when the harness has no storage (captureIgnored off) or the
- * sidecar is empty — leaving the shared capture unchanged.
- */
-async function buildCasTurnCaptures(gitRoot, hitlDir, storage, captureClass) {
-    if (!hitlDir || !storage)
-        return { casCaptures: [], unreviewablePaths: [] };
-    const { captured, secretPaths } = await readCasObservations(hitlDir);
-    const beforeByPath = new Map(captured.map((c) => [c.path, c.before]));
-    const { capturablePaths, unreviewablePaths } = partitionIgnoredPathsBySecret(beforeByPath.keys(), new Set(secretPaths));
-    const casCaptures = [];
-    for (const relPath of capturablePaths) {
-        const after = await readFileOrNull(join(gitRoot, relPath));
-        casCaptures.push({
-            path: relPath,
-            before: beforeByPath.get(relPath) ?? null,
-            after,
-            captureClass,
-        });
-    }
-    return { casCaptures, unreviewablePaths: [...unreviewablePaths] };
-}
-/** Raw bytes of a file, or `null` when it does not exist (an ADD-then-removed). */
-async function readFileOrNull(absolutePath) {
-    try {
-        return await readFile(absolutePath);
-    }
-    catch {
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// Cursor-specific presentation
-// ---------------------------------------------------------------------------
-/**
- * Stamp every streamed file-edit row (category write/delete) that flowed this
- * turn with the change set id, so the row stays visible as an observational
- * record and clients can badge it / anchor the decision surface. Skips:
- *  - already-stamped rows — the stamp is the idempotency AND cross-turn guard:
- *    a resume seeds prior turns' rows into this transcript, and re-stamping
- *    them with this turn's id would mis-attribute them ({@link stampFileEditRow});
- *  - legacy hidden rows (sessions persisted before stamping existed) — they
- *    belong to an earlier turn's change set, not this one;
- *  - denied identities (the deny-gate reconcile path owns those rows);
- *  - tool-call ids in `skipToolCallIds` — used for sub-agent rows, which lack
- *    the already-stamped/hidden shields the top-level transcript has, to scope
- *    the stamp to rows created this turn (the seeded prior sub-agents' ids).
- */
-function stampFlowedFileEditRows(messages, deniedTokens, changeSetId, skipToolCallIds) {
-    for (const msg of messages) {
-        for (const tc of msg.toolCalls) {
-            if (tc.fileChangeSetId)
-                continue;
-            if (skipToolCallIds?.has(tc.id))
-                continue;
-            if (isToolCallRowHidden(tc))
-                continue;
-            const category = approvalCategory(tc.name);
-            if (category !== "write" && category !== "delete")
-                continue;
-            const args = (tc.args ?? {});
-            const id = toolIdentity(tc.name, tc.mcpServerSlug, args);
-            const token = primaryToken(id.key, id.salient, contentDigest(args));
-            if (deniedTokens.has(token))
-                continue; // denied -> reconcile path owns it
-            stampFileEditRow(tc, changeSetId);
-        }
-    }
-}
-//# sourceMappingURL=capture-flow.js.map

package/dist/activities/execute-cursor/capture-flow.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"capture-flow.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/capture-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EACL,uBAAuB,IAAI,6BAA6B,EACxD,wBAAwB,IAAI,8BAA8B,GAC3D,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAE9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,0BAA0B,GAG3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAMxF,oFAAoF;AACpF,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B;;;;;GAKG;AACH,MAAM,yBAAyB,GAAsB;IACnD,oBAAoB;IACpB,yCAAyC;CAC1C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAuB;IAC7D,SAAS,EAAE,UAAU;IACrB,YAAY,EAAE,yBAAyB;CACxC,CAAC;AAEF,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,qBAAqB;AACrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAOvC;IACC,OAAO,6BAA6B,CAAC;QACnC,GAAG,IAAI;QACP,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,yBAAyB;KACxC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IA+BzC;IACC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC;IAChK,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAE/C,+EAA+E;IAC/E,sDAAsD;IACtD,MAAM,eAAe,GAAG,YAAY;QAClC,CAAC,CAAC,gBAAgB,CAAC,oBAAoB;QACvC,CAAC,CAAC,gBAAgB,CAAC,WAAW,CAAC;IACjC,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,MAAM,oBAAoB,CACnE,OAAO,EACP,OAAO,EACP,OAAO,EACP,eAAe,CAChB,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC;QACnD,MAAM;QACN,OAAO;QACP,WAAW;QACX,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,yBAAyB;QACvC,WAAW;QACX,OAAO;QACP,iBAAiB;QACjB,wBAAwB,EAAE,eAAe;QACzC,YAAY;QACZ,iBAAiB;KAClB,CAAC,CAAC;IAEH,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;QAC9C,uBAAuB,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC7D,8EAA8E;QAC9E,mEAAmE;QACnE,4EAA4E;QAC5E,+DAA+D;QAC/D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC3C,uBAAuB,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAQ5C;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvG,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAErD,MAAM,SAAS,GACb,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEvE,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QACpC,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,aAAa;YACb,WAAW;YACX,YAAY;YACZ,YAAY,EAAE,yBAAyB;SACxC,CAAC,CAAC;QACH,OAAO,SAAS;YACd,CAAC,CAAC,6BAA6B,CAAC,GAAG,EAAE,0BAA0B,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACpG,CAAC,CAAC,GAAG,CAAC;IACV,CAAC;IAED,2EAA2E;IAC3E,OAAO,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,0BAA0B,CAAC,OAAe;IACjD,OAAO,KAAK,IAAiC,EAAE;QAC7C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;IAC9D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAAe,EACf,OAA2B,EAC3B,OAAoC,EACpC,YAA8B;IAE9B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IAE5E,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAU,CAAC,CAAC,CAAC;IAC/E,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,6BAA6B,CAC1E,YAAY,CAAC,IAAI,EAAE,EACnB,IAAI,GAAG,CAAC,WAAW,CAAC,CACrB,CAAC;IAEF,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI;YACzC,KAAK;YACL,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,cAAc,CAAC,YAAoB;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAC9B,QAAiC,EACjC,YAAiC,EACjC,WAAmB,EACnB,eAAqC;IAErC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,eAAe;gBAAE,SAAS;YACjC,IAAI,eAAe,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAAE,SAAS;YAC1C,IAAI,mBAAmB,CAAC,EAAE,CAAC;gBAAE,SAAS;YACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YAC5D,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;YACxD,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YACzD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YACpE,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS,CAAC,mCAAmC;YAC1E,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/activities/execute-cursor/command-provenance.d.ts

@@ -1,48 +0,0 @@
-/**
- * Approved-command turn provenance (DD-28) — the CURSOR harness adapter over the
- * shared qualification rule ({@link qualifyTurnCommandProvenance}).
- *
- * The Cursor harness scopes a turn POSITIONALLY (messages from the turn's first
- * streamed index onward) and maps an executed command to its consent row through
- * the reinvocation grant tokens the deny-gate minted. Both mappings are Cursor's
- * own; the DD-28 rule they feed lives in `shared/filereview/command-provenance.ts`
- * so the Cursor and deep-agent qualifications cannot drift.
- *
- * (Trust boundary + fail-closed contract: see the shared module.)
- */
-import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
-export interface CommandProvenanceInputs {
-    /**
-     * The full transcript at capture time. Turn scoping is positional: messages
-     * from index {@link turnStartIndex} onward were produced by THIS turn's
-     * stream; everything before was seeded from prior turns. Lease consent rows
-     * (APPROVE_ALL) are looked up across the WHOLE transcript — a lease is
-     * run-lifetime, its granting row usually lives in a prior turn.
-     */
-    readonly messages: readonly AgentMessage[];
-    /** Index of the first message created by this turn's stream. */
-    readonly turnStartIndex: number;
-    /**
-     * Identity tokens the hook denied THIS turn (the denial ledger). A denied
-     * shell row never executed — it is this turn's pending gate, not a mutation
-     * source — so it neither needs consent nor disqualifies.
-     */
-    readonly deniedTokens: ReadonlySet<string>;
-    /**
-     * Grant token → the tool-call id of the approval row that minted the grant
-     * (the row carrying the server-authored approval_action). An executed shell
-     * command whose identity token is a key here was authorized by that
-     * per-command approval.
-     */
-    readonly grantTokenToConsentId: ReadonlyMap<string, string>;
-    /** True when the pre-armed spec.auto_approve_all bypassed the gate. */
-    readonly globalBypass: boolean;
-}
-/**
- * Derive the {@link TurnCommandProvenance} for the turn, or undefined when the
- * turn does not qualify. Scopes this turn's tool calls positionally, resolves
- * consent through the deny-gate grant tokens, and delegates the DD-28 rule to
- * {@link qualifyTurnCommandProvenance}.
- */
-export declare function deriveTurnCommandProvenance(inputs: CommandProvenanceInputs): TurnCommandProvenance | undefined;

package/dist/activities/execute-cursor/command-provenance.js

@@ -1,38 +0,0 @@
-/**
- * Approved-command turn provenance (DD-28) — the CURSOR harness adapter over the
- * shared qualification rule ({@link qualifyTurnCommandProvenance}).
- *
- * The Cursor harness scopes a turn POSITIONALLY (messages from the turn's first
- * streamed index onward) and maps an executed command to its consent row through
- * the reinvocation grant tokens the deny-gate minted. Both mappings are Cursor's
- * own; the DD-28 rule they feed lives in `shared/filereview/command-provenance.ts`
- * so the Cursor and deep-agent qualifications cannot drift.
- *
- * (Trust boundary + fail-closed contract: see the shared module.)
- */
-import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
-import { toolCallIdentityToken } from "./message-translator.js";
-/**
- * Derive the {@link TurnCommandProvenance} for the turn, or undefined when the
- * turn does not qualify. Scopes this turn's tool calls positionally, resolves
- * consent through the deny-gate grant tokens, and delegates the DD-28 rule to
- * {@link qualifyTurnCommandProvenance}.
- */
-export function deriveTurnCommandProvenance(inputs) {
-    const { messages, turnStartIndex, deniedTokens, grantTokenToConsentId, globalBypass } = inputs;
-    // This turn's tool calls are the positional tail from the first message this
-    // turn's stream produced; everything before was seeded from prior turns.
-    const turnToolCalls = messages.slice(turnStartIndex).flatMap((m) => m.toolCalls);
-    return qualifyTurnCommandProvenance({
-        turnToolCalls,
-        messages,
-        // A shell whose identity token is in the denial ledger was denied by the
-        // hook — this turn's pending gate, never executed.
-        isExecutedCommand: (tc) => !deniedTokens.has(toolCallIdentityToken(tc)),
-        // A grant token maps back to the consent row (the row carrying the
-        // server-authored approval_action) that authorized this reinvocation.
-        resolveDirectConsent: (tc) => grantTokenToConsentId.get(toolCallIdentityToken(tc)),
-        globalBypass,
-    });
-}
-//# sourceMappingURL=command-provenance.js.map

package/dist/activities/execute-cursor/command-provenance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"command-provenance.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/command-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA8BhE;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA+B;IAE/B,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAE/F,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEjF,OAAO,4BAA4B,CAAC;QAClC,aAAa;QACb,QAAQ;QACR,yEAAyE;QACzE,mDAAmD;QACnD,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACvE,mEAAmE;QACnE,sEAAsE;QACtE,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QAClF,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/activities/execute-deep-agent/attachment-injector.d.ts

@@ -1,134 +0,0 @@
-/**
- * Attachment injection for deep agent execution.
- *
- * Downloads attachments from artifact storage (cloud) or local filesystem,
- * validates ZIP archives with security guards, and writes files into the
- * workspace via the platform mount namespace (.stigmer/inputs/).
- *
- * Security model: attachments are untrusted user uploads. ZIP archives are
- * parsed from the central directory — the format's authoritative index —
- * via the shared structural layer (@stigmer/zip-structure; issue #567,
- * which killed this module's local-header walk: it silently truncated
- * stored streaming entries and rejected Go-default archives outright).
- * Every entry is validated for path traversal, zip bombs, and format
- * integrity BEFORE any extraction occurs, and because the central
- * directory's sizes are declarations an attacker controls, decompression
- * re-enforces them: an entry whose actual output disagrees with its
- * declared size aborts the injection.
- *
- * Error model: fail-hard. Any attachment failure aborts the entire injection
- * and propagates a descriptive error. Attachments are explicit user inputs —
- * running with partial inputs produces silently incorrect results. This is
- * deliberately the OPPOSITE policy from the skill-artifact reader
- * (shared/zip-extract.ts, non-fatal empty return): skill artifacts were
- * structurally vouched for by the push gates, attachments never are.
- *
- * Duplicate names are NOT a failure (issue #364): a default-derived mount
- * path that collides is renamed with the platform's `stem-2.ext` semantics
- * (shared/attachment-naming.ts) and the rename is disclosed in the prompt's
- * Input Files section. Only two attachments EXPLICITLY pinning the same
- * `mountPath` still abort — that is a user contradiction no rename can
- * honestly resolve.
- */
-import type { Attachment } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
-import type { WorkspaceBackend } from "../../shared/workspace/types.js";
-import type { ArtifactStorage } from "../../shared/artifact-storage.js";
-import type { VisionBudget, VisionDegradedReason, VisionImage } from "../../shared/attachment-vision.js";
-declare const MAX_ZIP_FILES = 1000;
-declare const MAX_ZIP_EXTRACTED_SIZE: number;
-export { MAX_ZIP_FILES, MAX_ZIP_EXTRACTED_SIZE };
-export interface InjectedFile {
-    /** The final on-disk basename — after any duplicate rename, so it always
-     * agrees with {@link path} and with the vision payload's image label. */
-    readonly filename: string;
-    readonly path: string;
-    readonly sizeBytes: number;
-    /**
-     * The attachment's original filename, present only when a duplicate name
-     * was renamed (shared/attachment-naming.ts) — rendered as disclosure in
-     * the prompt's Input Files section.
-     */
-    readonly renamedFrom?: string;
-    /** Present when the attachment was accepted into the turn's vision payload. */
-    readonly vision?: VisionImage;
-    /**
-     * Present when the attachment was plausibly an image but could not ride
-     * inline (see {@link VisionDegradedReason}) — disclosed in the system prompt
-     * so the agent never silently ignores a photo the user believes it can see.
-     * Attachments that were never image-shaped carry neither field.
-     */
-    readonly visionDegraded?: VisionDegradedReason;
-    /**
-     * A download URL for the attachment's stored object, listed in the system
-     * prompt's Input Files section so the agent can hand the file to a tool
-     * whose backend cannot read the sandbox filesystem (issue #532). Minted
-     * whenever the attachment has a `storageKey` and a usable storage; never
-     * present on extracted ZIP entries (no attachment-level object). Absent
-     * when there is nothing to mint or the mint failed (non-fatal — policy,
-     * degrade log, and prompt wording live in
-     * shared/attachment-download-urls.ts).
-     */
-    readonly downloadUrl?: string;
-}
-export interface InjectAttachmentsOptions {
-    readonly backend: WorkspaceBackend;
-    readonly attachments: readonly Attachment[];
-    /**
-     * Artifact storage for cloud-mode attachment download. `undefined` when the
-     * runner could not build a store (proxy misconfig). With no attachments this is
-     * never touched (the function early-returns); a cloud-mode attachment that
-     * genuinely needs storage surfaces a clear {@link AttachmentInjectionError}
-     * rather than dereferencing undefined.
-     */
-    readonly storage: ArtifactStorage | undefined;
-    readonly isLocalMode: boolean;
-    /**
-     * The turn's vision selector (attachment-vision.ts owns all policy).
-     * `undefined` disables inline image delivery; file materialization is
-     * identical either way — vision is strictly additive. Archives (`extract`)
-     * are never offered: an image inside a ZIP has no attachment-level bytes.
-     */
-    readonly visionBudget?: VisionBudget;
-}
-export interface ZipEntryInfo {
-    readonly relativePath: string;
-    readonly uncompressedSize: number;
-}
-export declare class AttachmentInjectionError extends Error {
-    readonly attachmentFilename: string;
-    readonly reason: string;
-    constructor(attachmentFilename: string, reason: string);
-}
-export declare class AttachmentValidationError extends Error {
-    readonly attachmentFilename: string;
-    readonly reason: string;
-    constructor(attachmentFilename: string, reason: string);
-}
-/**
- * Validate a ZIP archive for safe extraction. Returns the manifest of
- * file entries (directories excluded) if the archive passes all checks.
- *
- * Security checks enforced:
- * 1. Valid ZIP format (readable central directory; fail-hard, see module doc)
- * 2. No absolute paths (entries starting with / or \)
- * 3. No path traversal (.. components)
- * 4. No null bytes in filenames
- * 5. No duplicate entry paths (a contradictory manifest)
- * 6. Only supported compression methods (stored, deflate) — checked here
- *    so an unsupported entry can never abort extraction after earlier
- *    entries were already written
- * 7. Non-empty archive (at least one file entry)
- * 8. File count within limits (max 1000)
- * 9. Total declared uncompressed size within limits (max 100 MB) —
- *    declarations are re-enforced against actual output at decompression
- */
-export declare function validateZipForExtraction(zipData: Buffer, sourceFilename: string): ZipEntryInfo[];
-/**
- * Download, validate, and inject all attachments into the workspace.
- *
- * Resolves all mount paths before any downloads begin: duplicate
- * default-derived names are renamed (never fatal — see module doc), and an
- * explicit-mountPath contradiction throws before any bytes move.
- * On any failure, throws AttachmentInjectionError with an actionable message.
- */
-export declare function injectAttachments(opts: InjectAttachmentsOptions): Promise<InjectedFile[]>;