@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/dist/harness/types.d.ts

@@ -21,9 +21,8 @@
  * (`execute-cursor/turn-stream.ts` `CursorTurnStreamDeps`) or a fact the
  * runtime cannot read anywhere else. Nothing here is speculative: where the
  * program's original sketch and the code disagreed, the code won, and the
- * disagreement was ruled at the entry's gate
- * (stigmer-cloud `_projects/2026-09/20260911.02.sp.harness-contract-and-kit/`
- * for S1; `20260911.03.sp.turn-runtime-extraction/` M3 for the growth below).
+ * disagreement was ruled before the code landed (#1064; the growth below in
+ * #1070).
  *
  * What is deliberately NOT on this contract, and why:
  *
@@ -31,11 +30,13 @@
  *    (`maxConcurrentActivities`), so a per-turn teardown method on the
  *    adapter is a race. The adapter owns its per-turn teardown in its own
  *    `finally` inside `runTurn` (the Cursor harness parks its agent there).
- *  - No `isCancelled()`, no `heartbeat(details)`, no `ExecutionStatusWriter`
- *    base. Each would be a second way of saying something `stopSignal`,
- *    `recordActivity()` or `requestPersist()` already says, and two writers of
- *    one fact drift (the native builders' `forceNextUpdate` flag is the same
- *    fact as a `requestPersist()` call).
+ *  - No `isCancelled()`, no `heartbeat(details)`, and the sink does not
+ *    EXTEND a status-writer interface. Each would be a second way of saying
+ *    something `stopSignal`, `recordActivity()` or `requestPersist()` already
+ *    says, and two writers of one fact drift. The transcript builder rides
+ *    the sink as a MEMBER (`transcript`), and the distinction holds: its
+ *    `dirty` is a fact the adapter's persist decision reads, `requestPersist()`
+ *    is the act; one fact, one act, no second writer.
  *  - No `reason` on `interrupted`, no payload on `completed`, no `retryable`
  *    on `failed`. Every cause of stopping is the runtime's own evidence; the
  *    final text and structured output are already folded onto the status;
@@ -53,9 +54,9 @@
  *    propagates it.
  *  - No persist cadence. The runtime's chokepoint is single-flight and
  *    unconditional at settle; WHEN a streaming turn asks for a write is the
- *    adapter's (`shared/persist-decision.ts` over its own dirty flags, since
- *    what counts as a discrete change is engine knowledge). Revisited with
- *    both loops in view at S3 M4 and kept (Q-S3-13): the cadence RULE is
+ *    adapter's (`shared/persist-decision.ts` over the builder's `dirty`
+ *    flag, since WHEN to ask is engine cadence). Revisited with
+ *    both loops in view in #1096 and kept: the cadence RULE is
  *    shared, the timing is the engine's.
  *  - No capture. The file-review capture is the runtime's whole
  *    (`harness/capture.ts`): the baseline before `runTurn`, the candidate
@@ -88,6 +89,7 @@ import type { DeclaredPreferencesContent } from "../shared/declared-preferences.
 import type { RecalledMemoriesContent } from "../shared/recalled-memories.js";
 import type { CasTouchedReader } from "../shared/filereview/cas-touched.js";
 import type { HarnessCapabilities } from "./capabilities.js";
+import type { TranscriptBuilder } from "./transcript/builder.js";
 /**
  * One harness, as the runtime sees it. ONE adapter object exists per worker
  * process; it serves every concurrent turn of its harness and holds no
@@ -301,14 +303,36 @@ export interface TurnInput extends NormalizedActivityInput {
  * one status it folds into. One sink per turn, owned by the runtime; the
  * adapter never constructs one.
  *
- * Field ownership on `status` before the canonical transcript lands (S4):
- * the adapter appends the engine's transcript rows (assistant messages,
- * tool-call rows and their approval status, sub-agent rows, todos); the
- * runtime writes the phase, the terminal system messages, `streamingUsage`,
- * artifacts, write-backs, `fileChangeProgress`, the file-review ledger
- * events and the change-set stamp on a flowed edit row (S3 M4,
- * `harness/capture.ts`). An adapter never writes a phase or a terminal copy:
- * those are Temporal semantics the runtime owns once.
+ * Field ownership on `status` (since #1097, the canonical transcript):
+ *
+ *  - Transcript rows — messages, tool-call rows, sub-agent rows, todos — are
+ *    CREATED through `transcript` and nowhere else: the adapter translates
+ *    its engine's events and applies them; a reinvocation's prior rows are
+ *    seeded through it by the runtime. The one exception, the runtime's own
+ *    terminal system rows (`harness/terminal-table.ts`), is the second name
+ *    on the writer fence's allow-list (`__tests__/transcript-writers.test.ts`).
+ *  - Artifacts and write-backs a turn produces register through `transcript`
+ *    too (the native inline publisher; the runtime's write-back coordinator),
+ *    each dedupe rule owned once. The one artifact written beside it is the
+ *    epilogue's plan artifact (`shared/plan-artifact.ts`), the runtime's,
+ *    which supersedes by the plan's own name rule.
+ *  - Rows may be AMENDED by identity, never created, by the modules that own
+ *    a fact the builder cannot know, and this is the whole list: the runtime's
+ *    `harness/approval-decisions.ts` (a SKIP or REJECT settles its row),
+ *    `harness/capture.ts` (the change-set stamp on a flowed edit row),
+ *    `shared/exact-apply.ts` (an approved whole-file write applied by the
+ *    runtime completes its row), `shared/subagent-rows.ts` (a stopped turn's
+ *    sub-agents CANCELLED); the Cursor boundary (`execute-cursor/
+ *    boundary-rows.ts`: the identity-token collapses, #205, #965, the
+ *    unattended stamp); the native settle (`execute-deep-agent/hitl.ts`: the
+ *    gate's unattended skips). A harness that amends says so in its settle's
+ *    header.
+ *  - The runtime alone writes the phase, `startedAt`, `completedAt`,
+ *    `error`, the terminal system rows, `streamingUsage`,
+ *    `fileChangeProgress`, the file-review ledger events and the change-set
+ *    stamp (`harness/capture.ts`, since #1096), and closes every streaming flag
+ *    once `runTurn` returns. An adapter never writes a phase or a terminal
+ *    copy: those are Temporal semantics the runtime owns once.
  */
 export interface TurnSink {
     /**
@@ -317,6 +341,23 @@ export interface TurnSink {
      * the adapter wrote last time, and their decisions, are already on it.
      */
     readonly status: AgentExecutionStatus;
+    /**
+     * The one transcript builder over `status`, constructed by the runtime
+     * per turn and already holding a reinvocation's seeded rows. The ONE way
+     * a transcript row is created: a harness translates its engine's events
+     * into `TranscriptEvent`s and `apply`s them; its post-stream facts (a
+     * gate parked by a boundary, a disclosure) go in as events too. Artifacts
+     * and write-backs a turn produces register here as well (`addArtifact`,
+     * `addWriteBack`, one dedupe rule each). Read `dirty` to decide a
+     * streaming persist and call `markPersisted()` as you request it; read
+     * `awaitingApproval` to learn a proposal was parked. The runtime calls
+     * `finalize()` once `runTurn` returns, on every path, so no streaming flag
+     * outlives a turn; a harness may call it earlier when it persists on the
+     * settled rows itself. A source-walking fence
+     * (`harness/__tests__/transcript-writers.test.ts`) refuses any other
+     * creator of a row.
+     */
+    readonly transcript: TranscriptBuilder;
     /**
      * The ONE way a turn is told to stop, whatever the cause: user pause,
      * worker shutdown, stall, cost cap, platform STOP. The runtime knows why
@@ -372,7 +413,7 @@ export interface TurnSink {
      * step only the adapter knows ("Initializing Cursor agent"). The runtime
      * reports its own resolution labels itself; the adapter reports the labels
      * of its setup steps exactly as the orchestrator did, so the UI's spinner
-     * copy is unchanged by the extraction (Q-S2-5). Resolves once the label is
+     * copy is unchanged by the extraction. Resolves once the label is
      * written; the write carries no phase, so it never advances the execution.
      */
     reportProgress(label: string): Promise<void>;
@@ -384,7 +425,7 @@ export interface TurnSink {
      * cleared, the agnostic quirk of `BuildUpdateStateStep`); the adapter may
      * set its own harness-specific `SessionSpec` fields on that record before
      * binding, one writer per field (`harnessStateId` the runtime's,
-     * `cursorMode` the adapter's; Q-S2-11). Called only by adapters whose
+     * `cursorMode` the adapter's). Called only by adapters whose
      * `capabilities.stateIdSource` is `"engine-minted"`, and before their first
      * `requestPersist`; a `deterministic` harness never calls it. Rejects when
      * the session write fails; the adapter then ends the turn `failed` with
@@ -415,7 +456,7 @@ export interface TurnSink {
  * Token counts for one engine turn, priced. The four counts are what the
  * Cursor loop reads from the SDK's `turn-ended` delta; `estimatedCostUsd` is
  * the adapter's price for them at its vendor's rates (the runtime cannot
- * price without the vendor's table and must not import it; Q-S2-12), and
+ * price without the vendor's table and must not import it), and
  * `model` / `requestedModelParams` name the basis it priced against, which
  * the runtime records into `streamingUsage` (`model` is the catalog-validated
  * id, `requestedModelParams` the JSON of the params sent — a string on the

package/dist/harness/types.js

@@ -21,9 +21,8 @@
  * (`execute-cursor/turn-stream.ts` `CursorTurnStreamDeps`) or a fact the
  * runtime cannot read anywhere else. Nothing here is speculative: where the
  * program's original sketch and the code disagreed, the code won, and the
- * disagreement was ruled at the entry's gate
- * (stigmer-cloud `_projects/2026-09/20260911.02.sp.harness-contract-and-kit/`
- * for S1; `20260911.03.sp.turn-runtime-extraction/` M3 for the growth below).
+ * disagreement was ruled before the code landed (#1064; the growth below in
+ * #1070).
  *
  * What is deliberately NOT on this contract, and why:
  *
@@ -31,11 +30,13 @@
  *    (`maxConcurrentActivities`), so a per-turn teardown method on the
  *    adapter is a race. The adapter owns its per-turn teardown in its own
  *    `finally` inside `runTurn` (the Cursor harness parks its agent there).
- *  - No `isCancelled()`, no `heartbeat(details)`, no `ExecutionStatusWriter`
- *    base. Each would be a second way of saying something `stopSignal`,
- *    `recordActivity()` or `requestPersist()` already says, and two writers of
- *    one fact drift (the native builders' `forceNextUpdate` flag is the same
- *    fact as a `requestPersist()` call).
+ *  - No `isCancelled()`, no `heartbeat(details)`, and the sink does not
+ *    EXTEND a status-writer interface. Each would be a second way of saying
+ *    something `stopSignal`, `recordActivity()` or `requestPersist()` already
+ *    says, and two writers of one fact drift. The transcript builder rides
+ *    the sink as a MEMBER (`transcript`), and the distinction holds: its
+ *    `dirty` is a fact the adapter's persist decision reads, `requestPersist()`
+ *    is the act; one fact, one act, no second writer.
  *  - No `reason` on `interrupted`, no payload on `completed`, no `retryable`
  *    on `failed`. Every cause of stopping is the runtime's own evidence; the
  *    final text and structured output are already folded onto the status;
@@ -53,9 +54,9 @@
  *    propagates it.
  *  - No persist cadence. The runtime's chokepoint is single-flight and
  *    unconditional at settle; WHEN a streaming turn asks for a write is the
- *    adapter's (`shared/persist-decision.ts` over its own dirty flags, since
- *    what counts as a discrete change is engine knowledge). Revisited with
- *    both loops in view at S3 M4 and kept (Q-S3-13): the cadence RULE is
+ *    adapter's (`shared/persist-decision.ts` over the builder's `dirty`
+ *    flag, since WHEN to ask is engine cadence). Revisited with
+ *    both loops in view in #1096 and kept: the cadence RULE is
  *    shared, the timing is the engine's.
  *  - No capture. The file-review capture is the runtime's whole
  *    (`harness/capture.ts`): the baseline before `runTurn`, the candidate

package/dist/harness/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/harness/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG"}

package/dist/harness/usage-accumulator.d.ts

@@ -4,7 +4,7 @@
  * the persist chokepoint writes before every status write, and the running
  * cost the `max_cost_usd` cap is enforced against.
  *
- * Who owns what (Q-S2-12): the ADAPTER prices, because only it has its
+ * Who owns what: the ADAPTER prices, because only it has its
  * vendor's rate table and variant semantics (`execute-cursor/usage-pricing.ts`
  * for Cursor); the RUNTIME accounts and enforces, because the cap and the
  * summary are the platform's, the same for every engine. A delta therefore
@@ -14,7 +14,7 @@
  * preferences (`TurnInput.model`), the audit trail that the account default
  * was never left in control (#357, #772).
  *
- * Moved from `activities/execute-cursor/usage-accumulator.ts` at S2 M3, the
+ * Moved from `activities/execute-cursor/usage-accumulator.ts` in #1070, the
  * pricing call split out; the sums, the snapshot shape and the empty
  * snapshot are unchanged, so `streamingUsage` is byte-for-byte what the
  * Cursor orchestrator wrote.

package/dist/harness/usage-accumulator.js

@@ -4,7 +4,7 @@
  * the persist chokepoint writes before every status write, and the running
  * cost the `max_cost_usd` cap is enforced against.
  *
- * Who owns what (Q-S2-12): the ADAPTER prices, because only it has its
+ * Who owns what: the ADAPTER prices, because only it has its
  * vendor's rate table and variant semantics (`execute-cursor/usage-pricing.ts`
  * for Cursor); the RUNTIME accounts and enforces, because the cap and the
  * summary are the platform's, the same for every engine. A delta therefore
@@ -14,7 +14,7 @@
  * preferences (`TurnInput.model`), the audit trail that the account default
  * was never left in control (#357, #772).
  *
- * Moved from `activities/execute-cursor/usage-accumulator.ts` at S2 M3, the
+ * Moved from `activities/execute-cursor/usage-accumulator.ts` in #1070, the
  * pricing call split out; the sums, the snapshot shape and the empty
  * snapshot are unchanged, so `streamingUsage` is byte-for-byte what the
  * Cursor orchestrator wrote.

package/dist/harness-adapters.d.ts

@@ -14,7 +14,7 @@
  * adapter's interceptors must patch `node:http2` before anything dials the
  * control plane, so it boots first. The native deep-agent adapter boots
  * second; its `boot` registers the deepagents harness profiles and loads
- * LangChain, both after the patch (S3 M2b, 2026-09-13; until then the roots
+ * LangChain, both after the patch (#1096, 2026-09-13; until then the roots
  * imported the native orchestrator directly beside this table).
  *
  * THIS MODULE'S STATIC GRAPH MUST STAY CONNECT- AND SDK-FREE. The roots
@@ -22,9 +22,10 @@
  * where `node:http2` is patched and `@cursor/sdk` first loaded; an adapter
  * factory that imported its SDK statically would defeat both. Every adapter
  * named here loads its vendor SDK inside `boot` (`execute-cursor/adapter.ts`
- * and `execute-deep-agent/adapter.ts` show the shape; each has a fence that
- * walks its static graph). `__tests__/harness-boot-order.test.ts` boots a
- * fresh process through this module — both rows — and fails if the graph
+ * and `execute-deep-agent/adapter.ts` show the shape; the native adapter's
+ * `__tests__/adapter-graph-is-sdk-free.test.ts` walks its static graph off
+ * the syntax tree). `__tests__/harness-boot-order.test.ts` boots a fresh
+ * process through this module — both rows — and fails if either graph
  * regresses.
  */
 import type { HarnessRow } from "./harness/registry.js";

package/dist/harness-adapters.js

@@ -14,7 +14,7 @@
  * adapter's interceptors must patch `node:http2` before anything dials the
  * control plane, so it boots first. The native deep-agent adapter boots
  * second; its `boot` registers the deepagents harness profiles and loads
- * LangChain, both after the patch (S3 M2b, 2026-09-13; until then the roots
+ * LangChain, both after the patch (#1096, 2026-09-13; until then the roots
  * imported the native orchestrator directly beside this table).
  *
  * THIS MODULE'S STATIC GRAPH MUST STAY CONNECT- AND SDK-FREE. The roots
@@ -22,9 +22,10 @@
  * where `node:http2` is patched and `@cursor/sdk` first loaded; an adapter
  * factory that imported its SDK statically would defeat both. Every adapter
  * named here loads its vendor SDK inside `boot` (`execute-cursor/adapter.ts`
- * and `execute-deep-agent/adapter.ts` show the shape; each has a fence that
- * walks its static graph). `__tests__/harness-boot-order.test.ts` boots a
- * fresh process through this module — both rows — and fails if the graph
+ * and `execute-deep-agent/adapter.ts` show the shape; the native adapter's
+ * `__tests__/adapter-graph-is-sdk-free.test.ts` walks its static graph off
+ * the syntax tree). `__tests__/harness-boot-order.test.ts` boots a fresh
+ * process through this module — both rows — and fails if either graph
  * regresses.
  */
 import { createCursorAdapter } from "./activities/execute-cursor/adapter.js";

package/dist/harness-adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-adapters.js","sourceRoot":"","sources":["../src/harness-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGpF,MAAM,CAAC,MAAM,gBAAgB,GAA0B;IACrD,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE;IACrD,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;CAC7D,CAAC"}
+{"version":3,"file":"harness-adapters.js","sourceRoot":"","sources":["../src/harness-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGpF,MAAM,CAAC,MAAM,gBAAgB,GAA0B;IACrD,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE;IACrD,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;CAC7D,CAAC"}

package/dist/interceptors/run-credential-activity.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The activity boundary's ONE entry into the run-credential store.
+ *
+ * Every activity a worker runs — the server-dispatched turn activities, the
+ * server-dispatched GenerateSessionSubject, and every local or remote
+ * activity the runner's own serverless-workflow engine schedules — passes
+ * through this inbound interceptor. It reads the run credential from
+ * whichever channel the dispatch used (`shared/run-credential.ts`: the
+ * Temporal header the runner's workflow stamps, else the input object's
+ * key the server's workflow sets) and runs the activity inside
+ * `withRunCredential`, so that every control-plane request the activity
+ * makes — however deep, however detached — is made as the run's human.
+ *
+ * Header before input: a runner-dispatched activity's header is the nearer
+ * authority; in practice a dispatch carries exactly one of the two. An
+ * activity whose dispatch carried neither runs with no credential in the
+ * store, and the client falls back to the process credential exactly as it
+ * did before the store existed — an older server, and the cloud, see no
+ * change.
+ *
+ * Both worker roots (`worker.ts`, `runner-manager.ts`) register this
+ * unconditionally; it is inert without a credential. It logs nothing: a
+ * credential is never written to a log, and the arguments it inspects may
+ * carry anything.
+ */
+import type { ActivityInterceptorsFactory } from "@temporalio/worker";
+/** The inbound interceptor factory both worker roots register. */
+export declare const runCredentialActivityInterceptor: ActivityInterceptorsFactory;

package/dist/interceptors/run-credential-activity.js

@@ -0,0 +1,56 @@
+/**
+ * The activity boundary's ONE entry into the run-credential store.
+ *
+ * Every activity a worker runs — the server-dispatched turn activities, the
+ * server-dispatched GenerateSessionSubject, and every local or remote
+ * activity the runner's own serverless-workflow engine schedules — passes
+ * through this inbound interceptor. It reads the run credential from
+ * whichever channel the dispatch used (`shared/run-credential.ts`: the
+ * Temporal header the runner's workflow stamps, else the input object's
+ * key the server's workflow sets) and runs the activity inside
+ * `withRunCredential`, so that every control-plane request the activity
+ * makes — however deep, however detached — is made as the run's human.
+ *
+ * Header before input: a runner-dispatched activity's header is the nearer
+ * authority; in practice a dispatch carries exactly one of the two. An
+ * activity whose dispatch carried neither runs with no credential in the
+ * store, and the client falls back to the process credential exactly as it
+ * did before the store existed — an older server, and the cloud, see no
+ * change.
+ *
+ * Both worker roots (`worker.ts`, `runner-manager.ts`) register this
+ * unconditionally; it is inert without a credential. It logs nothing: a
+ * credential is never written to a log, and the arguments it inspects may
+ * carry anything.
+ */
+import { defaultPayloadConverter } from "@temporalio/common";
+import { RUN_CREDENTIAL_HEADER, readRunCredentialFromInput, } from "../shared/run-credential.js";
+import { withRunCredential } from "../shared/run-credential-store.js";
+/** The inbound interceptor factory both worker roots register. */
+export const runCredentialActivityInterceptor = () => ({
+    inbound: {
+        async execute(input, next) {
+            const credential = readRunCredentialFromHeader(input.headers[RUN_CREDENTIAL_HEADER]) ??
+                readRunCredentialFromInput(input.args[0]);
+            if (credential === undefined) {
+                return next(input);
+            }
+            return withRunCredential(credential, () => next(input));
+        },
+    },
+});
+/**
+ * The credential a header payload carries, or `undefined` when there is no
+ * such header or it does not decode to a non-empty string. Decoding uses the
+ * default converter, never the worker's data converter: headers bypass the
+ * payload codecs by SDK design, and the stamping side encodes with the same
+ * default converter.
+ */
+function readRunCredentialFromHeader(payload) {
+    if (payload === undefined) {
+        return undefined;
+    }
+    const value = defaultPayloadConverter.fromPayload(payload);
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+//# sourceMappingURL=run-credential-activity.js.map

package/dist/interceptors/run-credential-activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-credential-activity.js","sourceRoot":"","sources":["../../src/interceptors/run-credential-activity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EACL,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,kEAAkE;AAClE,MAAM,CAAC,MAAM,gCAAgC,GAC3C,GAAG,EAAE,CAAC,CAAC;IACL,OAAO,EAAE;QACP,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,UAAU,GACd,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;gBACjE,0BAA0B,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,OAAO,iBAAiB,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;KACF;CACF,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,OAAgB;IACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAY,uBAAuB,CAAC,WAAW,CACxD,OAAoE,CACrE,CAAC;IACF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC"}

package/dist/middleware/approval-gate.d.ts

@@ -24,6 +24,12 @@
  * unrecognized mutating built-in (e.g. `bash`, `overwrite_file`) is therefore
  * gated by what it does, not by whether someone remembered to list it.
  *
+ * The decision itself — `resolveToolApproval` — lives in
+ * `shared/approval-policy.ts` beside its provenance twin since #1097:
+ * the native translator reports the same answer on every
+ * `tool_started`, so the transcript row and this gate can never disagree
+ * about whether a call waits. This module is where the decision is ACTED on.
+ *
  * Gateway invariant (Phase 2): this middleware IS the in-process execution
  * gateway for the deep-agent harness — `handler(request)` is the side effect. A
  * side effect runs only with a backing authorization: either (a) the tool was

package/dist/middleware/approval-gate.js

@@ -24,6 +24,12 @@
  * unrecognized mutating built-in (e.g. `bash`, `overwrite_file`) is therefore
  * gated by what it does, not by whether someone remembered to list it.
  *
+ * The decision itself — `resolveToolApproval` — lives in
+ * `shared/approval-policy.ts` beside its provenance twin since #1097:
+ * the native translator reports the same answer on every
+ * `tool_started`, so the transcript row and this gate can never disagree
+ * about whether a call waits. This module is where the decision is ACTED on.
+ *
  * Gateway invariant (Phase 2): this middleware IS the in-process execution
  * gateway for the deep-agent harness — `handler(request)` is the side effect. A
  * side effect runs only with a backing authorization: either (a) the tool was
@@ -44,20 +50,11 @@
  */
 import { ToolMessage } from "@langchain/core/messages";
 import { interrupt } from "@langchain/langgraph";
-import { POLICY_ENGINE_VERSION, resolveApprovalMessage, unattendedSkipMessage, } from "../shared/approval-policy.js";
+import { POLICY_ENGINE_VERSION, resolveToolApproval, unattendedSkipMessage, } from "../shared/approval-policy.js";
 import { toolApprovalCategory } from "../shared/tool-kind.js";
 import { extractFilePath } from "../shared/file-tools.js";
 import { isSecretLikePath } from "../shared/filereview/secret-paths.js";
 import { computeApprovalFingerprint, } from "../shared/approval-fingerprint.js";
-// Approval-message template per mutating category. Keyed by category (not raw
-// tool name) so every alias of a mutation renders one message; placeholders
-// resolve against the deep-agent stream arg shape (`path`/`command`). Mirrors
-// the Cursor side's CATEGORY_APPROVAL_MESSAGE.
-const CATEGORY_APPROVAL_MESSAGE = {
-    write: "Write file: {{args.path}}",
-    delete: "Delete: {{args.path}}",
-    shell: "Execute command: {{args.command}}",
-};
 /**
  * The ToolMessage returned when a secret-like write is hard-blocked (DD-E /
  * DD-26 #2): the write is NEVER applied and the graph continues (this replaces
@@ -236,53 +233,6 @@ export function createApprovalGateMiddleware(config) {
         },
     };
 }
-function resolveToolApproval(toolName, serverSlug, args, policies, leasedCategories) {
-    if (serverSlug) {
-        // MCP tools stay governed by the connect-flow classifier + four-level policy
-        // chain. The policy map carries only the tools that REQUIRE approval, so an
-        // absent entry means the classifier already auto-approved it — fail-OPEN is
-        // correct here (a fail-closed default would re-gate everything the classifier
-        // cleared). This is deliberately NOT changed by the built-in fail-closed flip.
-        //
-        // A server-scoped lease surfaces here as an absent entry too: the leased
-        // server's tools are dropped from `policies` upstream (mergeApprovalPolicies),
-        // so a lease-cleared MCP tool takes this same auto-approve path. (Its shadow
-        // receipt therefore reads classifier_default rather than approval_lease; a
-        // faithful per-server lease provenance would need the lease set threaded here
-        // and is deferred with the rest of the persisted-receipt work.)
-        const key = `${serverSlug}/${toolName}`;
-        const policy = policies.get(key);
-        if (policy) {
-            return {
-                requiresApproval: policy.requiresApproval,
-                message: resolveApprovalMessage(policy.approvalMessage, toolName, args),
-                source: policy.source,
-            };
-        }
-        // Absent = cleared by the MCP four-level chain (classifier base) or by a
-        // server-scoped lease (dropped upstream).
-        return { requiresApproval: false, message: "", source: "classifier_default" };
-    }
-    // Built-in/platform tool: gate exactly the mutating categories via the shared
-    // classifier. Fail-CLOSED for the mutating set — any built-in classifyTool
-    // deems write/edit/delete/shell requires approval. Read-only and unclassified
-    // built-ins are not mutating, so they remain fail-open.
-    const category = toolApprovalCategory(toolName);
-    if (category) {
-        // Run-lifetime category lease: the user chose "approve all <category>"
-        // earlier in this run, so every built-in of that category is auto-approved
-        // for the rest of the run (the scoped successor to auto-approve-all).
-        if (leasedCategories.has(category)) {
-            return { requiresApproval: false, message: "", source: "approval_lease" };
-        }
-        return {
-            requiresApproval: true,
-            message: resolveApprovalMessage(CATEGORY_APPROVAL_MESSAGE[category], toolName, args),
-            source: "builtin_category",
-        };
-    }
-    return { requiresApproval: false, message: "", source: "builtin_category" };
-}
 /** Shared empty set so a config without leases allocates nothing per call. */
 const EMPTY_CATEGORY_SET = new Set();
 /**

package/dist/middleware/approval-gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-gate.js","sourceRoot":"","sources":["../../src/middleware/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAGL,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAA6B,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EACL,0BAA0B,GAE3B,MAAM,mCAAmC,CAAC;AAyG3C,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAyC;IACtE,KAAK,EAAE,2BAA2B;IAClC,MAAM,EAAE,uBAAuB;IAC/B,KAAK,EAAE,mCAAmC;CAC3C,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAY,EAAE,UAAkB;IAChF,OAAO,IAAI,WAAW,CAAC;QACrB,OAAO,EACL,SAAS,QAAQ,gCAAgC,IAAI,cAAc;YACnE,4EAA4E;QAC9E,YAAY,EAAE,UAAU;QACxB,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IAEvE,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAEhF,OAAO;QACL,IAAI,EAAE,wBAAwB;QAE9B,KAAK,CAAC,YAAY,CAAC,OAAwB,EAAE,OAAO;YAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEhD,4EAA4E;YAC5E,2EAA2E;YAC3E,yEAAyE;YACzE,uBAAuB;YACvB,IACE,MAAM,CAAC,eAAe;gBACtB,MAAM,CAAC,gBAAgB;gBACvB,CAAC,UAAU;gBACX,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,EAC/C,CAAC;gBACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,IAAI,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxC,oEAAoE;wBACpE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;wBAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;oBACD,iEAAiE;oBACjE,kEAAkE;oBAClE,sEAAsE;oBACtE,uCAAuC;oBACvC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;wBAC1B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;4BACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC3B,4DAA4D;gCAC5D,4DAA4D;gCAC5D,4DAA4D;gCAC5D,uDAAuD;gCACvD,iCAAiC;gCACjC,MAAM,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;gCACnC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,mEAAmE;4BACnE,oEAAoE;4BACpE,wBAAwB;4BACxB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;4BAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAChC,CAAC;wBACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;4BACnF,iEAAiE;4BACjE,iEAAiE;4BACjE,kEAAkE;4BAClE,kEAAkE;4BAClE,EAAE;4BACF,mEAAmE;4BACnE,mEAAmE;4BACnE,+DAA+D;4BAC/D,mEAAmE;4BACnE,2DAA2D;4BAC3D,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;4BACvC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;4BAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,yEAAyE;YACzE,4EAA4E;YAC5E,uEAAuE;YACvE,4EAA4E;YAC5E,sEAAsE;YACtE,mCAAmC;YACnC,IAAI,CAAC,UAAU,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5C,MAAM,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;oBACnC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,UAAU,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,EACR,gBAAgB,CACjB,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;gBAClC,wEAAwE;gBACxE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACjG,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YAED,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACzC,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC;oBACxC,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG;gBACtB,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,SAAS,EAAE,QAAQ;gBACnB,eAAe,EAAE,UAAU;gBAC3B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,mEAAmE;gBACnE,wEAAwE;gBACxE,kEAAkE;gBAClE,aAAa,EAAE,WAAW,CAAC,MAAM;aAClC,CAAC;YAEF,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAqB,CAAC;YAEhE,MAAM,MAAM,GAAG,CACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;gBAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;gBACzB,CAAC,CAAC,EAAE,CACP,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;YAE3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,OAAO;oBACzB,CAAC,CAAC,SAAS,QAAQ,0BAA0B,OAAO,0CAA0C;oBAC9F,CAAC,CAAC,SAAS,QAAQ,+DAA+D,CAAC;gBAErF,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,uEAAuE;gBACvE,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvC,MAAM,aAAa,GAAG,OAAO;oBAC3B,CAAC,CAAC,SAAS,QAAQ,+BAA+B,OAAO,oEAAoE;oBAC7H,CAAC,CAAC,SAAS,QAAQ,8FAA8F,CAAC;gBACpH,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,aAAa;oBACtB,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,WAAW,CAAC;gBACrB,OAAO,EAAE,SAAS,QAAQ,wCAAwC,MAAM,sBAAsB;gBAC9F,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AASD,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,UAAkB,EAClB,IAA6B,EAC7B,QAA+C,EAC/C,gBAAmD;IAEnD,IAAI,UAAU,EAAE,CAAC;QACf,6EAA6E;QAC7E,4EAA4E;QAC5E,4EAA4E;QAC5E,8EAA8E;QAC9E,+EAA+E;QAC/E,EAAE;QACF,yEAAyE;QACzE,+EAA+E;QAC/E,6EAA6E;QAC7E,2EAA2E;QAC3E,8EAA8E;QAC9E,gEAAgE;QAChE,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,CAAC;gBACvE,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,0CAA0C;QAC1C,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAChF,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,uEAAuE;QACvE,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO;YACL,gBAAgB,EAAE,IAAI;YACtB,OAAO,EAAE,sBAAsB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC;YACpF,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,MAAM,kBAAkB,GAAsC,IAAI,GAAG,EAAE,CAAC;AAIxE;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,MAA0B,EAC1B,QAAqE,EACrE,UAAkB,EAClB,QAA0C,EAC1C,MAA2B,EAC3B,YAA0B;IAE1B,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO;IAErC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc;QACvC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,CAAC,GAAG,CACT,yBAAyB;QACzB,IAAI,CAAC,SAAS,CAAC;YACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,aAAa,EAAE,MAAM;YACrB,YAAY;YACZ,mBAAmB,EAAE,qBAAqB;YAC1C,WAAW;YACX,SAAS,EAAE,YAAY;SACxB,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"approval-gate.js","sourceRoot":"","sources":["../../src/middleware/approval-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAGL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAA6B,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EACL,0BAA0B,GAE3B,MAAM,mCAAmC,CAAC;AAyG3C;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,IAAY,EAAE,UAAkB;IAChF,OAAO,IAAI,WAAW,CAAC;QACrB,OAAO,EACL,SAAS,QAAQ,gCAAgC,IAAI,cAAc;YACnE,4EAA4E;QAC9E,YAAY,EAAE,UAAU;QACxB,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAA0B;IAE1B,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IAEvE,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAEhF,OAAO;QACL,IAAI,EAAE,wBAAwB;QAE9B,KAAK,CAAC,YAAY,CAAC,OAAwB,EAAE,OAAO;YAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;YAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YAEhD,4EAA4E;YAC5E,2EAA2E;YAC3E,yEAAyE;YACzE,uBAAuB;YACvB,IACE,MAAM,CAAC,eAAe;gBACtB,MAAM,CAAC,gBAAgB;gBACvB,CAAC,UAAU;gBACX,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,EAC/C,CAAC;gBACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAClB,IAAI,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;wBACxC,oEAAoE;wBACpE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;wBAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;oBACD,iEAAiE;oBACjE,kEAAkE;oBAClE,sEAAsE;oBACtE,uCAAuC;oBACvC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;wBAC1B,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;4BACzB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC3B,4DAA4D;gCAC5D,4DAA4D;gCAC5D,4DAA4D;gCAC5D,uDAAuD;gCACvD,iCAAiC;gCACjC,MAAM,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;gCACnC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,mEAAmE;4BACnE,oEAAoE;4BACpE,wBAAwB;4BACxB,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;4BAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAChC,CAAC;wBACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;4BACnF,iEAAiE;4BACjE,iEAAiE;4BACjE,kEAAkE;4BAClE,kEAAkE;4BAClE,EAAE;4BACF,mEAAmE;4BACnE,mEAAmE;4BACnE,+DAA+D;4BAC/D,mEAAmE;4BACnE,2DAA2D;4BAC3D,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;4BACvC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;4BAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;wBAChC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,yEAAyE;YACzE,4EAA4E;YAC5E,uEAAuE;YACvE,4EAA4E;YAC5E,sEAAsE;YACtE,mCAAmC;YACnC,IAAI,CAAC,UAAU,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5C,MAAM,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC;oBACnC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,EACR,UAAU,EACV,QAAQ,CAAC,IAAI,EACb,QAAQ,EACR,gBAAgB,CACjB,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;gBAClC,wEAAwE;gBACxE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBACjG,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YAED,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,wEAAwE;YACxE,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBACtB,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACzC,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC;oBACxC,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,MAAM,eAAe,GAAG;gBACtB,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,SAAS,EAAE,QAAQ;gBACnB,eAAe,EAAE,UAAU;gBAC3B,OAAO,EAAE,WAAW,CAAC,OAAO;gBAC5B,mEAAmE;gBACnE,wEAAwE;gBACxE,kEAAkE;gBAClE,aAAa,EAAE,WAAW,CAAC,MAAM;aAClC,CAAC;YAEF,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAqB,CAAC;YAEhE,MAAM,MAAM,GAAG,CACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;gBAC/C,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;gBACzB,CAAC,CAAC,EAAE,CACP,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;YAE3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC7F,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvC,MAAM,WAAW,GAAG,OAAO;oBACzB,CAAC,CAAC,SAAS,QAAQ,0BAA0B,OAAO,0CAA0C;oBAC9F,CAAC,CAAC,SAAS,QAAQ,+DAA+D,CAAC;gBAErF,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,WAAW;oBACpB,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,uEAAuE;gBACvE,iEAAiE;gBACjE,mEAAmE;gBACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBACvC,MAAM,aAAa,GAAG,OAAO;oBAC3B,CAAC,CAAC,SAAS,QAAQ,+BAA+B,OAAO,oEAAoE;oBAC7H,CAAC,CAAC,SAAS,QAAQ,8FAA8F,CAAC;gBACpH,OAAO,IAAI,WAAW,CAAC;oBACrB,OAAO,EAAE,aAAa;oBACtB,YAAY,EAAE,QAAQ,CAAC,EAAE;oBACzB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,WAAW,CAAC;gBACrB,OAAO,EAAE,SAAS,QAAQ,wCAAwC,MAAM,sBAAsB;gBAC9F,YAAY,EAAE,QAAQ,CAAC,EAAE;gBACzB,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,kBAAkB,GAAsC,IAAI,GAAG,EAAE,CAAC;AAIxE;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,MAA0B,EAC1B,QAAqE,EACrE,UAAkB,EAClB,QAA0C,EAC1C,MAA2B,EAC3B,YAA0B;IAE1B,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;QAAE,OAAO;IAErC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc;QACvC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,aAAa,EAAE,UAAU;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,CAAC,GAAG,CACT,yBAAyB;QACzB,IAAI,CAAC,SAAS,CAAC;YACb,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;YACrC,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,aAAa,EAAE,UAAU;YACzB,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,aAAa,EAAE,MAAM;YACrB,YAAY;YACZ,mBAAmB,EAAE,qBAAqB;YAC1C,WAAW;YACX,SAAS,EAAE,YAAY;SACxB,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/middleware/cost-advisory.d.ts

@@ -11,17 +11,17 @@
  * shape `execution-budget.ts` already has beside LangGraph's `recursionLimit`:
  * the middleware warns inside the graph, the engine's own limit enforces.
  *
- * Until S3 M2b (Q-S3-3) this module was `cost-cap.ts` and did both: it also
+ * Until #1096 this module was `cost-cap.ts` and did both: it also
  * blocked every tool call once the running cost passed the cap and gave the
  * model one tool-free round to summarize. That second enforcement lived
  * inside the graph, where the runtime could not see it, and a platform STOP
  * had a sibling (`graceful-stop.ts`, deleted with it) that let the run spend
  * a summary round after the platform said stop. Both went when the runtime
- * became the one place a turn is stopped (harness runtime program, S3).
+ * became the one place a turn is stopped.
  *
  * afterModel — reads `usage_metadata` off the latest AIMessage, prices the
  *   call at the parent's rates (a sub-agent on its own model is priced the
- *   same way the enforcement prices it; per-sub-agent pricing is an S5 item),
+ *   same way the enforcement prices it; per-sub-agent pricing is #1121),
  *   accumulates the running total, and injects the warning SystemMessage once
  *   at `warningPct` of the cap.
  *

package/dist/middleware/cost-advisory.js

@@ -11,17 +11,17 @@
  * shape `execution-budget.ts` already has beside LangGraph's `recursionLimit`:
  * the middleware warns inside the graph, the engine's own limit enforces.
  *
- * Until S3 M2b (Q-S3-3) this module was `cost-cap.ts` and did both: it also
+ * Until #1096 this module was `cost-cap.ts` and did both: it also
  * blocked every tool call once the running cost passed the cap and gave the
  * model one tool-free round to summarize. That second enforcement lived
  * inside the graph, where the runtime could not see it, and a platform STOP
  * had a sibling (`graceful-stop.ts`, deleted with it) that let the run spend
  * a summary round after the platform said stop. Both went when the runtime
- * became the one place a turn is stopped (harness runtime program, S3).
+ * became the one place a turn is stopped.
  *
  * afterModel — reads `usage_metadata` off the latest AIMessage, prices the
  *   call at the parent's rates (a sub-agent on its own model is priced the
- *   same way the enforcement prices it; per-sub-agent pricing is an S5 item),
+ *   same way the enforcement prices it; per-sub-agent pricing is #1121),
  *   accumulates the running total, and injects the warning SystemMessage once
  *   at `warningPct` of the cap.
  *

package/dist/middleware/index.d.ts

@@ -21,7 +21,7 @@
  * Every middleware here either shapes the graph's tool surface or ADVISES
  * the model; none of them stops the run. A stop — the platform's, the
  * cost cap's, a stall's — is the turn runtime's, delivered to the graph
- * through its abort signal (harness runtime program, S3 Q-S3-3; until M2b a
+ * through its abort signal (since #1096; until then a
  * graceful-stop middleware and the cost cap's tool block were second stops
  * inside the graph that the runtime could not see).
  *

package/dist/middleware/index.js

@@ -21,7 +21,7 @@
  * Every middleware here either shapes the graph's tool surface or ADVISES
  * the model; none of them stops the run. A stop — the platform's, the
  * cost cap's, a stall's — is the turn runtime's, delivered to the graph
- * through its abort signal (harness runtime program, S3 Q-S3-3; until M2b a
+ * through its abort signal (since #1096; until then a
  * graceful-stop middleware and the cost cap's tool block were second stops
  * inside the graph that the runtime could not see).
  *

package/dist/runner-manager.js

@@ -19,7 +19,8 @@ import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TI
 // same. Inert unless a mode emits the boot timeline (pool mode does; the
 // desktop manager never calls emitRunnerBootTiming, so marks cost nothing).
 import { markBoot } from "./shared/cold-start-timing.js";
-import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
+import { resolveWorkflowSource, runCredentialWorkflowInterceptorModule, OTEL_WORKFLOW_INTERCEPTOR_MODULE, } from "./workflow-source.js";
+import { runCredentialActivityInterceptor } from "./interceptors/run-credential-activity.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
 import { assertLlmBackendsPreflight } from "./preflight.js";
 import { captureRunnerSecrets, getRunnerSecret, setRunnerSecret, } from "./shared/runner-credential-store.js";
@@ -451,7 +452,7 @@ export function mapManagerOptionsToConfig(options, tokenRef, runnerTokenRef) {
         // The manager's proxy credential is the minted runner token once adopted
         // (the control-plane token in lockstep before that), so it is this ref and
         // not `tokenRef`: binding `tokenRef` would keep sending the desktop's own
-        // Auth0 token as x-stigmer-auth after the mint (Q-S2-7).
+        // Auth0 token as x-stigmer-auth after the mint.
         proxyTokenRef: runnerTokenRef,
         cursorApiKey: proxyActive
             ? (options.cursorApiKey ?? "proxy-managed")
@@ -522,9 +523,14 @@ async function createAllActivities(config) {
 }
 async function buildInterceptorConfig() {
     const { createWorkflowMetricsSinks } = await import("./interceptors/workflow-metrics-sink.js");
-    const activityInterceptors = [];
+    // The run credential's two ends (shared/run-credential.ts), always on and
+    // inert without a credential — the same pair the static root registers
+    // (worker.ts). The workflow module reaches the bundle through
+    // `workflowInterceptorModules` on the runtime path and is baked in on the
+    // pre-built path (scripts/bundle-slim.mjs).
+    const activityInterceptors = [runCredentialActivityInterceptor];
     let sinks = { ...createWorkflowMetricsSinks() };
-    const workflowInterceptorModules = [];
+    const workflowInterceptorModules = [runCredentialWorkflowInterceptorModule()];
     // In-flight activity counter: keeps a session/wfexec worker alive while one of
     // its activities (notably the long ExecuteCursor) is running, so a view close
     // can no longer reap the worker mid-run. Always installed; cheap and global.