@stigmer/runner 3.15.1 → 3.15.2-dev.20260913223433

package/dist/activities/execute-deep-agent/attachment-injector.js

@@ -1,386 +0,0 @@
-/**
- * Attachment injection for deep agent execution.
- *
- * Downloads attachments from artifact storage (cloud) or local filesystem,
- * validates ZIP archives with security guards, and writes files into the
- * workspace via the platform mount namespace (.stigmer/inputs/).
- *
- * Security model: attachments are untrusted user uploads. ZIP archives are
- * parsed from the central directory — the format's authoritative index —
- * via the shared structural layer (@stigmer/zip-structure; issue #567,
- * which killed this module's local-header walk: it silently truncated
- * stored streaming entries and rejected Go-default archives outright).
- * Every entry is validated for path traversal, zip bombs, and format
- * integrity BEFORE any extraction occurs, and because the central
- * directory's sizes are declarations an attacker controls, decompression
- * re-enforces them: an entry whose actual output disagrees with its
- * declared size aborts the injection.
- *
- * Error model: fail-hard. Any attachment failure aborts the entire injection
- * and propagates a descriptive error. Attachments are explicit user inputs —
- * running with partial inputs produces silently incorrect results. This is
- * deliberately the OPPOSITE policy from the skill-artifact reader
- * (shared/zip-extract.ts, non-fatal empty return): skill artifacts were
- * structurally vouched for by the push gates, attachments never are.
- *
- * Duplicate names are NOT a failure (issue #364): a default-derived mount
- * path that collides is renamed with the platform's `stem-2.ext` semantics
- * (shared/attachment-naming.ts) and the rename is disclosed in the prompt's
- * Input Files section. Only two attachments EXPLICITLY pinning the same
- * `mountPath` still abort — that is a user contradiction no rename can
- * honestly resolve.
- */
-import { readFile } from "node:fs/promises";
-import { createInflateRaw } from "node:zlib";
-import { posix } from "node:path";
-import { mintAttachmentDownloadUrl } from "../../shared/attachment-download-urls.js";
-import { allocateUniqueName } from "../../shared/attachment-naming.js";
-import { EOCD_MIN_SIZE, parseZipStructure, } from "@stigmer/zip-structure";
-// ── Constants ────────────────────────────────────────────────────────
-const MAX_ZIP_FILES = 1000;
-const MAX_ZIP_EXTRACTED_SIZE = 100 * 1024 * 1024; // 100 MB
-const DEFAULT_INPUTS_PREFIX = ".stigmer/inputs";
-export { MAX_ZIP_FILES, MAX_ZIP_EXTRACTED_SIZE };
-// ── Errors ───────────────────────────────────────────────────────────
-export class AttachmentInjectionError extends Error {
-    attachmentFilename;
-    reason;
-    constructor(attachmentFilename, reason) {
-        super(`Attachment '${attachmentFilename}': ${reason}`);
-        this.name = "AttachmentInjectionError";
-        this.attachmentFilename = attachmentFilename;
-        this.reason = reason;
-    }
-}
-export class AttachmentValidationError extends Error {
-    attachmentFilename;
-    reason;
-    constructor(attachmentFilename, reason) {
-        super(`Attachment '${attachmentFilename}': ${reason}`);
-        this.name = "AttachmentValidationError";
-        this.attachmentFilename = attachmentFilename;
-        this.reason = reason;
-    }
-}
-// ── ZIP Validation (pure functions) ──────────────────────────────────
-/**
- * Validate a ZIP archive for safe extraction. Returns the manifest of
- * file entries (directories excluded) if the archive passes all checks.
- *
- * Security checks enforced:
- * 1. Valid ZIP format (readable central directory; fail-hard, see module doc)
- * 2. No absolute paths (entries starting with / or \)
- * 3. No path traversal (.. components)
- * 4. No null bytes in filenames
- * 5. No duplicate entry paths (a contradictory manifest)
- * 6. Only supported compression methods (stored, deflate) — checked here
- *    so an unsupported entry can never abort extraction after earlier
- *    entries were already written
- * 7. Non-empty archive (at least one file entry)
- * 8. File count within limits (max 1000)
- * 9. Total declared uncompressed size within limits (max 100 MB) —
- *    declarations are re-enforced against actual output at decompression
- */
-export function validateZipForExtraction(zipData, sourceFilename) {
-    return parseAndValidateZip(zipData, sourceFilename).map(({ relativePath, uncompressedSize }) => ({ relativePath, uncompressedSize }));
-}
-function parseAndValidateZip(zipData, sourceFilename) {
-    if (zipData.length < EOCD_MIN_SIZE) {
-        throw new AttachmentValidationError(sourceFilename, "not a valid ZIP archive (file too small)");
-    }
-    let structural;
-    try {
-        structural = parseZipStructure(zipData);
-    }
-    catch (err) {
-        throw new AttachmentValidationError(sourceFilename, `not a valid ZIP archive (${err instanceof Error ? err.message : String(err)})`);
-    }
-    const entries = [];
-    const seenPaths = new Set();
-    let totalUncompressed = 0;
-    for (const entry of structural) {
-        if (entry.name.includes("\u0000")) {
-            throw new AttachmentValidationError(sourceFilename, "contains a filename with null bytes and cannot be safely extracted");
-        }
-        if (entry.isDirectory)
-            continue;
-        if (entry.name.startsWith("/") || entry.name.startsWith("\\")) {
-            throw new AttachmentValidationError(sourceFilename, `contains an absolute path entry and cannot be safely extracted: ${entry.name}`);
-        }
-        if (hasPathTraversal(entry.name)) {
-            throw new AttachmentValidationError(sourceFilename, `contains a path traversal entry and cannot be safely extracted: ${entry.name}`);
-        }
-        if (seenPaths.has(entry.name)) {
-            throw new AttachmentValidationError(sourceFilename, `contains duplicate entry '${entry.name}' and cannot be safely extracted`);
-        }
-        seenPaths.add(entry.name);
-        if (entry.compressionMethod !== 0 && entry.compressionMethod !== 8) {
-            throw new AttachmentValidationError(sourceFilename, `entry '${entry.name}' uses unsupported compression method ${entry.compressionMethod}`);
-        }
-        entries.push({
-            relativePath: entry.name,
-            uncompressedSize: entry.uncompressedSize,
-            compressionMethod: entry.compressionMethod,
-            compressedData: entry.compressedData,
-        });
-        totalUncompressed += entry.uncompressedSize;
-    }
-    if (entries.length === 0) {
-        throw new AttachmentValidationError(sourceFilename, "is an empty ZIP archive (no file entries)");
-    }
-    if (entries.length > MAX_ZIP_FILES) {
-        throw new AttachmentValidationError(sourceFilename, `contains ${entries.length} files (limit: ${MAX_ZIP_FILES})`);
-    }
-    if (totalUncompressed > MAX_ZIP_EXTRACTED_SIZE) {
-        const sizeMb = (totalUncompressed / (1024 * 1024)).toFixed(1);
-        const limitMb = (MAX_ZIP_EXTRACTED_SIZE / (1024 * 1024)).toFixed(0);
-        throw new AttachmentValidationError(sourceFilename, `would extract to ${sizeMb} MB (limit: ${limitMb} MB)`);
-    }
-    return entries.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-}
-// ── Attachment Injection ─────────────────────────────────────────────
-/**
- * Download, validate, and inject all attachments into the workspace.
- *
- * Resolves all mount paths before any downloads begin: duplicate
- * default-derived names are renamed (never fatal — see module doc), and an
- * explicit-mountPath contradiction throws before any bytes move.
- * On any failure, throws AttachmentInjectionError with an actionable message.
- */
-export async function injectAttachments(opts) {
-    const { backend, attachments, storage, isLocalMode, visionBudget } = opts;
-    if (attachments.length === 0)
-        return [];
-    // Phase 1: Pre-compute mount paths and detect collisions
-    const mountPaths = resolveMountPaths(attachments);
-    // Phase 2: Download, validate, and write each attachment
-    const injectedFiles = [];
-    for (const attachment of attachments) {
-        const content = await downloadAttachment(attachment, storage, isLocalMode);
-        const { path: mountPath, renamedFrom } = mountPaths.get(attachment);
-        if (attachment.extract) {
-            const entries = parseAndValidateZip(content, attachment.filename);
-            const extracted = await extractZipToWorkspace(entries, mountPath, backend, attachment.filename);
-            // A renamed mount DIR is visible through every extracted path; the
-            // entries themselves were not renamed, so they carry no renamedFrom
-            // (per-file disclosure would misattribute the rename). Extracted
-            // entries also carry no downloadUrl: the stored object is the ZIP, not
-            // any listed file, and a URL to bytes that differ from the listing
-            // would be a false promise.
-            injectedFiles.push(...extracted);
-        }
-        else {
-            await backend.writeFileBuffer(mountPath, content);
-            // The final basename is the canonical filename: after a duplicate
-            // rename the original attachment.filename no longer names the file on
-            // disk, and the vision label must match what the prompt lists or the
-            // agent sees two images with one indistinguishable name.
-            const filename = posix.basename(mountPath);
-            // The bytes are already in hand for the workspace write — offer them to
-            // the vision budget before they go out of scope (the sniff decides
-            // eligibility; the budget owns every size/count rule).
-            const vision = visionBudget?.offer(filename, attachment.contentType, content);
-            const downloadUrl = await mintAttachmentDownloadUrl(storage, attachment.storageKey, filename);
-            injectedFiles.push({
-                filename,
-                path: mountPath,
-                sizeBytes: content.length,
-                ...(renamedFrom !== undefined ? { renamedFrom } : {}),
-                ...(vision?.kind === "accepted" ? { vision: vision.image } : {}),
-                ...(vision?.kind === "degraded" ? { visionDegraded: vision.reason } : {}),
-                ...(downloadUrl !== undefined ? { downloadUrl } : {}),
-            });
-        }
-    }
-    console.log(`[attachment-injector] Injected ${injectedFiles.length} file(s) into workspace`);
-    return injectedFiles;
-}
-function resolveMountPaths(attachments) {
-    const result = new Map();
-    const pathToAttachment = new Map();
-    // Pass 1: explicit mount paths claim their exact targets first. Two
-    // attachments explicitly pinning the SAME path is a user contradiction no
-    // rename can honestly resolve — keep rejecting with the actionable message.
-    for (const attachment of attachments) {
-        if (!attachment.mountPath)
-            continue;
-        const mountPath = resolveExplicitMountPath(attachment);
-        const existing = pathToAttachment.get(mountPath);
-        if (existing) {
-            throw new AttachmentInjectionError(attachment.filename, `mount path '${mountPath}' collides with attachment '${existing.filename}'. ` +
-                "Set distinct mountPath values on the attachments to resolve this conflict.");
-        }
-        pathToAttachment.set(mountPath, attachment);
-        result.set(attachment, { path: mountPath });
-    }
-    // Pass 2: default-derived names (`.stigmer/inputs/{filename}`) uniquify
-    // around everything already taken — other defaults AND explicit paths that
-    // landed inside the inputs prefix — instead of failing the execution
-    // (issue #364). The taken-set is seeded with the basenames the explicit
-    // pass claimed directly under the prefix.
-    const takenNames = new Set();
-    for (const path of pathToAttachment.keys()) {
-        if (path.startsWith(`${DEFAULT_INPUTS_PREFIX}/`)) {
-            const rest = path.slice(DEFAULT_INPUTS_PREFIX.length + 1);
-            if (rest.length > 0 && !rest.includes("/"))
-                takenNames.add(rest);
-        }
-    }
-    for (const attachment of attachments) {
-        if (attachment.mountPath)
-            continue;
-        const { name, renamedFrom } = allocateUniqueName(deriveDefaultFilename(attachment), takenNames);
-        const path = `${DEFAULT_INPUTS_PREFIX}/${name}`;
-        pathToAttachment.set(path, attachment);
-        result.set(attachment, renamedFrom !== undefined ? { path, renamedFrom } : { path });
-    }
-    return result;
-}
-function resolveExplicitMountPath(attachment) {
-    const cleaned = attachment.mountPath.replace(/^\/+/, "");
-    if (cleaned.length === 0) {
-        throw new AttachmentInjectionError(attachment.filename, "mountPath resolves to an empty path after removing leading slashes");
-    }
-    // A caller-supplied mount path is untrusted. Stripping leading slashes does
-    // not stop `..` segments from climbing out of the workspace root on the
-    // non-`.stigmer/` branch (the `.stigmer/`-routed branch is already guarded
-    // by LocalWorkspaceBackend.resolvePath). Reject any path that normalizes to
-    // an escape before it reaches the backend write.
-    if (escapesRoot(cleaned)) {
-        throw new AttachmentInjectionError(attachment.filename, `mount path '${attachment.mountPath}' escapes the workspace root`);
-    }
-    return cleaned;
-}
-// Derives the single-component filename an attachment without an explicit
-// mountPath materializes under (the name that pass 2 uniquifies).
-function deriveDefaultFilename(attachment) {
-    const rawName = attachment.filename || deriveFilename(attachment.storageKey);
-    if (!rawName) {
-        throw new AttachmentInjectionError("(unknown)", "attachment has neither filename nor storageKey — cannot determine mount path");
-    }
-    // The filename is untrusted; reduce it to a single path component so it lands
-    // directly under the inputs prefix rather than steering the write elsewhere.
-    const filename = posix.basename(rawName);
-    if (filename === "" || filename === "." || filename === "..") {
-        throw new AttachmentInjectionError(rawName, `filename '${rawName}' does not yield a usable name for materialization`);
-    }
-    return filename;
-}
-// escapesRoot reports whether a workspace-relative mount path would climb out
-// of the workspace root once normalized. Mount paths are forward-slash,
-// workspace-relative strings, so posix normalization is the correct semantics.
-function escapesRoot(relPath) {
-    const normalized = posix.normalize(relPath);
-    return (normalized === ".." ||
-        normalized.startsWith("../") ||
-        posix.isAbsolute(normalized));
-}
-function deriveFilename(storageKey) {
-    if (!storageKey)
-        return "";
-    const parts = storageKey.split("/");
-    return parts[parts.length - 1] || "";
-}
-async function downloadAttachment(attachment, storage, isLocalMode) {
-    // Local mode fast path: read directly from filesystem
-    if (isLocalMode && attachment.localPath) {
-        try {
-            return await readFile(attachment.localPath);
-        }
-        catch (err) {
-            throw new AttachmentInjectionError(attachment.filename, `failed to read local file '${attachment.localPath}': ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    // Cloud mode: download via artifact storage
-    if (!attachment.storageKey) {
-        throw new AttachmentInjectionError(attachment.filename, "missing storageKey — cannot download attachment from storage");
-    }
-    // The attachment must come from storage, but the runner could not build one
-    // (proxy misconfig). Fail with an actionable message rather than dereferencing
-    // undefined — consistent with the degraded posture, never a silent skip.
-    if (!storage) {
-        throw new AttachmentInjectionError(attachment.filename, `artifact storage is unavailable, so this attachment (key: ${attachment.storageKey}) cannot be downloaded`);
-    }
-    try {
-        return await storage.download(attachment.storageKey);
-    }
-    catch (err) {
-        if (err instanceof AttachmentInjectionError)
-            throw err;
-        throw new AttachmentInjectionError(attachment.filename, `failed to download from storage (key: ${attachment.storageKey}): ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-async function extractZipToWorkspace(entries, mountDir, backend, sourceFilename) {
-    const cleanMountDir = mountDir.replace(/\/+$/, "");
-    const injected = [];
-    for (const entry of entries) {
-        const content = await decompressEntry(entry, sourceFilename);
-        const targetPath = `${cleanMountDir}/${entry.relativePath}`;
-        await backend.writeFileBuffer(targetPath, content);
-        injected.push({
-            filename: posix.basename(entry.relativePath),
-            path: targetPath,
-            sizeBytes: content.length,
-        });
-    }
-    return injected;
-}
-/**
- * Decompress a validated entry, enforcing its declared uncompressed size.
- *
- * The size cap in parseAndValidateZip budgets *declared* sizes, which the
- * archive author controls — a crafted archive can declare 1 KB and inflate
- * to gigabytes. Enforcement is therefore two-sided and fail-hard: inflation
- * aborts the moment output exceeds the declaration, and an undershoot (or a
- * stored payload whose length disagrees) fails too, because a manifest that
- * misdescribes its own contents is exactly the corrupt-input class this
- * module must never extract from.
- */
-async function decompressEntry(entry, sourceFilename) {
-    const declared = entry.uncompressedSize;
-    if (entry.compressionMethod === 0) {
-        if (entry.compressedData.length !== declared) {
-            throw new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' payload is ${entry.compressedData.length} bytes ` +
-                `but the archive declares ${declared} — corrupt or crafted archive`);
-        }
-        return Buffer.from(entry.compressedData);
-    }
-    // Deflate — the only other method parseAndValidateZip admits.
-    return new Promise((resolve, reject) => {
-        const inflate = createInflateRaw();
-        const chunks = [];
-        let produced = 0;
-        inflate.on("data", (chunk) => {
-            produced += chunk.length;
-            if (produced > declared) {
-                inflate.destroy();
-                reject(new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' decompresses past its declared size of ` +
-                    `${declared} bytes — corrupt or crafted archive`));
-                return;
-            }
-            chunks.push(chunk);
-        });
-        inflate.on("end", () => {
-            if (produced !== declared) {
-                reject(new AttachmentValidationError(sourceFilename, `entry '${entry.relativePath}' decompressed to ${produced} bytes ` +
-                    `but the archive declares ${declared} — corrupt or crafted archive`));
-                return;
-            }
-            resolve(Buffer.concat(chunks));
-        });
-        inflate.on("error", reject);
-        inflate.end(Buffer.from(entry.compressedData));
-    });
-}
-function hasPathTraversal(filePath) {
-    const normalized = posix.normalize(filePath);
-    if (normalized.startsWith("../") || normalized === "..")
-        return true;
-    const segments = filePath.split(/[/\\]/);
-    for (const seg of segments) {
-        if (seg === "..")
-            return true;
-    }
-    return false;
-}
-//# sourceMappingURL=attachment-injector.js.map

package/dist/activities/execute-deep-agent/attachment-injector.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"attachment-injector.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/attachment-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAIlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAMvE,OAAO,EACL,aAAa,EACb,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAEhC,wEAAwE;AAExE,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAC3D,MAAM,qBAAqB,GAAG,iBAAiB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,CAAC;AAgEjD,wEAAwE;AAExE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,cAAsB;IAEtB,OAAO,mBAAmB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,CACrD,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAC7E,CAAC;AACJ,CAAC;AAaD,SAAS,mBAAmB,CAC1B,OAAe,EACf,cAAsB;IAEtB,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI,UAAgC,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,WAAW;YAAE,SAAS;QAEhC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,KAAK,CAAC,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,mEAAmE,KAAK,CAAC,IAAI,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,6BAA6B,KAAK,CAAC,IAAI,kCAAkC,CAC1E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1B,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,UAAU,KAAK,CAAC,IAAI,yCAAyC,KAAK,CAAC,iBAAiB,EAAE,CACvF,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,YAAY,EAAE,KAAK,CAAC,IAAI;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC,CAAC;QACH,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,YAAY,OAAO,CAAC,MAAM,kBAAkB,aAAa,GAAG,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,CAAC,sBAAsB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,oBAAoB,MAAM,eAAe,OAAO,MAAM,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,wEAAwE;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAA8B;IACpE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IAE1E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,yDAAyD;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAElD,yDAAyD;IACzD,MAAM,aAAa,GAAmB,EAAE,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC3E,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC;QAErE,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,QAAQ,CACjD,CAAC;YACF,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,uEAAuE;YACvE,mEAAmE;YACnE,4BAA4B;YAC5B,aAAa,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAClD,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3C,wEAAwE;YACxE,mEAAmE;YACnE,uDAAuD;YACvD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC9E,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,CACzC,CAAC;YACF,aAAa,CAAC,IAAI,CAAC;gBACjB,QAAQ;gBACR,IAAI,EAAE,SAAS;gBACf,SAAS,EAAE,OAAO,CAAC,MAAM;gBACzB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,aAAa,CAAC,MAAM,yBAAyB,CAChF,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC;AAUD,SAAS,iBAAiB,CACxB,WAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IACxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,oEAAoE;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,SAAS;QACpC,MAAM,SAAS,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,eAAe,SAAS,+BAA+B,QAAQ,CAAC,QAAQ,KAAK;gBAC7E,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QAED,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,qEAAqE;IACrE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,SAAS;YAAE,SAAS;QACnC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAC9C,qBAAqB,CAAC,UAAU,CAAC,EACjC,UAAU,CACX,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,qBAAqB,IAAI,IAAI,EAAE,CAAC;QAChD,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CACR,UAAU,EACV,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAsB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,iDAAiD;IACjD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,eAAe,UAAU,CAAC,SAAS,8BAA8B,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,kEAAkE;AAClE,SAAS,qBAAqB,CAAC,UAAsB;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,IAAI,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,WAAW,EACX,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,wBAAwB,CAChC,OAAO,EACP,aAAa,OAAO,oDAAoD,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,CACL,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,UAAsB,EACtB,OAAoC,EACpC,WAAoB;IAEpB,sDAAsD;IACtD,IAAI,WAAW,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,+EAA+E;IAC/E,yEAAyE;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,6DAA6D,UAAU,CAAC,UAAU,wBAAwB,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB;YAAE,MAAM,GAAG,CAAC;QACvD,MAAM,IAAI,wBAAwB,CAChC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAqC,EACrC,QAAgB,EAChB,OAAyB,EACzB,cAAsB;IAEtB,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,GAAG,aAAa,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAE5D,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,OAAO,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,eAAe,CAC5B,KAAwB,EACxB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAExC,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,yBAAyB,CACjC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,gBAAgB,KAAK,CAAC,cAAc,CAAC,MAAM,SAAS;gBAChF,4BAA4B,QAAQ,+BAA+B,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,8DAA8D;IAC9D,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;YACzB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,yBAAyB,CAClC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,2CAA2C;oBACvE,GAAG,QAAQ,qCAAqC,CACjD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACrB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,yBAAyB,CAClC,cAAc,EACd,UAAU,KAAK,CAAC,YAAY,qBAAqB,QAAQ,SAAS;oBAClE,4BAA4B,QAAQ,+BAA+B,CACpE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/activities/execute-deep-agent/command-provenance.d.ts

@@ -1,61 +0,0 @@
-/**
- * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
- * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
- *
- * The deep-agent's consent model differs from Cursor's in exactly two ways, and
- * this adapter is precisely those two differences:
- *
- * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
- *    index its stream started at. The deep-agent cannot: an approved command
- *    executes IN PLACE at its seeded transcript position (it was proposed in a
- *    prior segment, seeded into this segment, and updated to COMPLETED by
- *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
- *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
- *    snapshot, and "executed" is a COMPLETED status.
- *
- * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
- *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
- *    same row, and the row keeps its id + `approval_action` when it executes on
- *    resume. So the executed command IS its own consent row — cite its own id.
- *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
- *    across the status write regardless of its new status, so the backend's
- *    verification finds it.)
- *
- * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
- * sub-agents"). A sub-agent's writes fold into the parent turn's change set
- * (DD-19) but are not attributable to a consented top-level command. The
- * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
- * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
- * the (currently-impossible under the replace-per-turn model) case of a sub-agent
- * that mutates across a turn boundary without a fresh top-level `task` row.
- *
- * (Trust boundary + fail-closed contract: see the shared module.)
- */
-import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
-export interface DeepAgentCommandProvenanceInputs {
-    /** The status at capture time — top-level messages + sub-agent executions. */
-    readonly status: AgentExecutionStatus;
-    /**
-     * The top-level tool-call ids that had already SETTLED before this turn's
-     * stream (from {@link collectSettledToolCallIds}). A top-level call whose id is
-     * absent is this-turn's; the shared rule then keeps only the COMPLETED ones.
-     */
-    readonly priorSettledToolCallIds: ReadonlySet<string>;
-    /**
-     * The sub-agent tool-call ids that existed before this turn's stream (from
-     * {@link collectSubAgentToolCallIds}). Any growth means a sub-agent acted this
-     * turn → fail closed.
-     */
-    readonly priorSubAgentToolCallIds: ReadonlySet<string>;
-    /** True when the pre-armed spec.auto_approve_all bypassed the gate. */
-    readonly globalBypass: boolean;
-}
-/**
- * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
- * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
- * resolves consent from the row's own server-authored `approval_action`, fails
- * closed on any sub-agent activity, and delegates the DD-28 rule to
- * {@link qualifyTurnCommandProvenance}.
- */
-export declare function deriveTurnCommandProvenance(inputs: DeepAgentCommandProvenanceInputs): TurnCommandProvenance | undefined;

package/dist/activities/execute-deep-agent/command-provenance.js

@@ -1,72 +0,0 @@
-/**
- * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
- * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
- *
- * The deep-agent's consent model differs from Cursor's in exactly two ways, and
- * this adapter is precisely those two differences:
- *
- * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
- *    index its stream started at. The deep-agent cannot: an approved command
- *    executes IN PLACE at its seeded transcript position (it was proposed in a
- *    prior segment, seeded into this segment, and updated to COMPLETED by
- *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
- *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
- *    snapshot, and "executed" is a COMPLETED status.
- *
- * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
- *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
- *    same row, and the row keeps its id + `approval_action` when it executes on
- *    resume. So the executed command IS its own consent row — cite its own id.
- *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
- *    across the status write regardless of its new status, so the backend's
- *    verification finds it.)
- *
- * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
- * sub-agents"). A sub-agent's writes fold into the parent turn's change set
- * (DD-19) but are not attributable to a consented top-level command. The
- * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
- * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
- * the (currently-impossible under the replace-per-turn model) case of a sub-agent
- * that mutates across a turn boundary without a fresh top-level `task` row.
- *
- * (Trust boundary + fail-closed contract: see the shared module.)
- */
-import { ApprovalAction, ToolCallStatus, } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
-/**
- * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
- * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
- * resolves consent from the row's own server-authored `approval_action`, fails
- * closed on any sub-agent activity, and delegates the DD-28 rule to
- * {@link qualifyTurnCommandProvenance}.
- */
-export function deriveTurnCommandProvenance(inputs) {
-    const { status, priorSettledToolCallIds, priorSubAgentToolCallIds, globalBypass } = inputs;
-    // DD-28 D1 cond 2: any sub-agent activity this turn disqualifies. A sub-agent
-    // that ran this turn contributes at least one tool-call id absent from the
-    // pre-stream snapshot.
-    for (const id of collectSubAgentToolCallIds(status.subAgentExecutions)) {
-        if (!priorSubAgentToolCallIds.has(id))
-            return undefined;
-    }
-    const messages = status.messages;
-    // This turn's top-level calls: those not already settled before the stream.
-    const turnToolCalls = messages
-        .flatMap((m) => m.toolCalls)
-        .filter((tc) => !priorSettledToolCallIds.has(tc.id));
-    return qualifyTurnCommandProvenance({
-        turnToolCalls,
-        messages,
-        // A deep-agent command executed iff its row reached COMPLETED this turn.
-        isExecutedCommand: (tc) => tc.status === ToolCallStatus.TOOL_CALL_COMPLETED,
-        // The gated command carries its own server-authored approval_action, written
-        // in place by SubmitApproval and preserved when the row executes on resume.
-        resolveDirectConsent: (tc) => tc.approvalAction === ApprovalAction.APPROVE ||
-            tc.approvalAction === ApprovalAction.APPROVE_ALL
-            ? tc.id
-            : undefined,
-        globalBypass,
-    });
-}
-//# sourceMappingURL=command-provenance.js.map

package/dist/activities/execute-deep-agent/command-provenance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"command-provenance.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/command-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,GACf,MAAM,8DAA8D,CAAC;AAGtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAqBtE;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAwC;IAExC,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAE3F,8EAA8E;IAC9E,2EAA2E;IAC3E,uBAAuB;IACvB,KAAK,MAAM,EAAE,IAAI,0BAA0B,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,4EAA4E;IAC5E,MAAM,aAAa,GAAG,QAAQ;SAC3B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvD,OAAO,4BAA4B,CAAC;QAClC,aAAa;QACb,QAAQ;QACR,yEAAyE;QACzE,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,cAAc,CAAC,mBAAmB;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3B,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,OAAO;YAC5C,EAAE,CAAC,cAAc,KAAK,cAAc,CAAC,WAAW;YAC9C,CAAC,CAAC,EAAE,CAAC,EAAE;YACP,CAAC,CAAC,SAAS;QACf,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/activities/execute-deep-agent/environment.d.ts

@@ -1,24 +0,0 @@
-/**
- * Environment variable resolution for deep agent execution.
- *
- * Resolves the merged environment from ExecutionContext — the single
- * source of truth for execution-scoped variables. The workflow injects
- * all resolved variables into ExecutionContext before the activity starts.
- *
- * The returned result separates plaintext keys from secret keys so that
- * downstream consumers (e.g., StatusBuilder in Phase 3b) can redact
- * secret values in user-facing displays.
- */
-import type { StigmerClient } from "../../client/stigmer-client.js";
-export interface EnvironmentResult {
-    readonly mergedEnvVars: Record<string, string>;
-    readonly secretKeys: ReadonlySet<string>;
-}
-/**
- * Fetch the ExecutionContext for the given execution and extract the
- * merged environment variables.
- *
- * If no ExecutionContext exists (e.g., the agent has no environment or
- * secrets configured), returns an empty result so execution can proceed.
- */
-export declare function resolveEnvironment(client: StigmerClient, executionId: string): Promise<EnvironmentResult>;

package/dist/activities/execute-deep-agent/environment.js

@@ -1,58 +0,0 @@
-/**
- * Environment variable resolution for deep agent execution.
- *
- * Resolves the merged environment from ExecutionContext — the single
- * source of truth for execution-scoped variables. The workflow injects
- * all resolved variables into ExecutionContext before the activity starts.
- *
- * The returned result separates plaintext keys from secret keys so that
- * downstream consumers (e.g., StatusBuilder in Phase 3b) can redact
- * secret values in user-facing displays.
- */
-/**
- * Fetch the ExecutionContext for the given execution and extract the
- * merged environment variables.
- *
- * If no ExecutionContext exists (e.g., the agent has no environment or
- * secrets configured), returns an empty result so execution can proceed.
- */
-export async function resolveEnvironment(client, executionId) {
-    // A desktop runner exchanges its bootstrap credential for a token scoped to
-    // this execution's session, so cloud's decrypt gate binds the read (#156).
-    // No-op for cloud sandbox and OSS runners. A failed exchange throws and
-    // fails the activity: the bootstrap credential no longer decrypts
-    // (stigmer-cloud#218), so proceeding would resolve redacted placeholders.
-    const scopedToken = await client.acquireScopedRunnerToken({
-        agentExecutionId: executionId,
-    });
-    let execCtx;
-    try {
-        execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
-    }
-    catch (err) {
-        // ConnectError uses numeric Code.NotFound (5); match the pattern
-        // from shared/env-resolver.ts.
-        const code = err?.code;
-        if (code === 5 || code === "not_found" || code === "NOT_FOUND") {
-            console.log(`[env] No ExecutionContext found for execution ${executionId} — ` +
-                `proceeding with empty environment.`);
-            return { mergedEnvVars: {}, secretKeys: new Set() };
-        }
-        throw err;
-    }
-    const mergedEnvVars = {};
-    const secretKeys = new Set();
-    const data = execCtx.spec?.data;
-    if (data) {
-        for (const [key, execValue] of Object.entries(data)) {
-            mergedEnvVars[key] = execValue.value;
-            if (execValue.isSecret) {
-                secretKeys.add(key);
-            }
-        }
-    }
-    console.log(`[env] Resolved environment: env_count=${Object.keys(mergedEnvVars).length}, ` +
-        `secret_count=${secretKeys.size}`);
-    return { mergedEnvVars, secretKeys };
-}
-//# sourceMappingURL=environment.js.map

package/dist/activities/execute-deep-agent/environment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/activities/execute-deep-agent/environment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB,EACrB,WAAmB;IAEnB,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC;QACxD,gBAAgB,EAAE,WAAW;KAC9B,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,iEAAiE;QACjE,+BAA+B;QAC/B,MAAM,IAAI,GAAI,GAAkC,EAAE,IAAI,CAAC;QACvD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CACT,iDAAiD,WAAW,KAAK;gBACjE,oCAAoC,CACrC,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,aAAa,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YACrC,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACvB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,yCAAyC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI;QAC9E,gBAAgB,UAAU,CAAC,IAAI,EAAE,CAClC,CAAC;IAEF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC"}