@stigmer/runner 3.40.0 → 3.41.0

package/src/activities/discover-mcp-server.ts

@@ -31,6 +31,12 @@ import {
 } from "../shared/mcp-transport-guard.js";
 import { detectOAuthChallenge } from "../shared/mcp-oauth-detect.js";
 import { injectAnonymousCallerIdentityForDiscovery } from "../shared/caller-identity.js";
+import {
+  fillPlatformServerAddress,
+  platformServerAddress,
+  SERVER_ADDRESS_ENV_KEY,
+  type PlatformEndpoints,
+} from "../shared/platform-server-address.js";
 import { startHeartbeat } from "../shared/heartbeat.js";
 import { withTimeout } from "../shared/with-timeout.js";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
@@ -70,10 +76,6 @@ const STDIO_INIT_TIMEOUT_MS = 270_000;
  */
 const REDACTED_MARKER = "***REDACTED***";
 
-const PLATFORM_INJECTABLE_MAP: Record<string, string> = {
-  STIGMER_SERVER_ADDRESS: "STIGMER_MCP_PUBLIC_ENDPOINT",
-};
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Types
 // ─────────────────────────────────────────────────────────────────────────────
@@ -237,36 +239,6 @@ function structToPlainObject(struct: unknown): Record<string, unknown> | null {
   }
 }
 
-// ─────────────────────────────────────────────────────────────────────────────
-// Platform Env Injection
-// ─────────────────────────────────────────────────────────────────────────────
-
-export function injectPlatformEnv(
-  declaredEnvKeys: Set<string>,
-  envVars: Record<string, string>,
-): Record<string, string> {
-  if (declaredEnvKeys.size === 0) return envVars;
-
-  let result: Record<string, string> | undefined;
-
-  for (const [targetKey, sourceKey] of Object.entries(PLATFORM_INJECTABLE_MAP)) {
-    if (!declaredEnvKeys.has(targetKey)) continue;
-    const value = process.env[sourceKey];
-    if (!value) continue;
-
-    if (!result) result = { ...envVars };
-    if (targetKey in result && result[targetKey] !== value) {
-      console.info(
-        `Platform env var '${targetKey}' overrides value from ExecutionContext ` +
-        `(platform infra vars are authoritative)`,
-      );
-    }
-    result[targetKey] = value;
-  }
-
-  return result ?? envVars;
-}
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Core Discovery Logic (no Temporal coupling)
 // ─────────────────────────────────────────────────────────────────────────────
@@ -281,6 +253,12 @@ export interface DiscoverDeps {
    * tool enumeration.
    */
   transportPosture: McpTransportPosture;
+  /**
+   * The runner's endpoints a missing STIGMER_SERVER_ADDRESS is filled from
+   * (the runner Config satisfies it) — the same fill execution applies, so
+   * discovery dials what the run will dial.
+   */
+  platformEndpoints: PlatformEndpoints;
 }
 
 export async function discoverMcpServer(
@@ -305,16 +283,25 @@ export async function discoverMcpServer(
   const previousState = extractPreviousState(mcpServer);
 
   const declaredEnv = mcpServer.spec.env ?? {};
+  // A key the platform fills for this transport is not a credential the
+  // connect flow must deliver, so it never makes an empty EC a failure.
+  const platformFillsAddress =
+    platformServerAddress(mcpServer.spec.serverType.case, deps.platformEndpoints) !== null;
+  const credentialDeclarations = platformFillsAddress
+    ? Object.fromEntries(
+        Object.entries(declaredEnv).filter(([key]) => key !== SERVER_ADDRESS_ENV_KEY),
+      )
+    : declaredEnv;
   const envVars = await resolveEnvVarsForDiscovery(
     stigmerClient,
     executionContextId ?? null,
     executionContextToken ?? null,
     slug,
-    declaredEnv,
+    credentialDeclarations,
   );
 
   const declaredEnvKeys = new Set(Object.keys(declaredEnv));
-  const platformEnv = injectPlatformEnv(declaredEnvKeys, envVars);
+  const platformEnv = fillPlatformServerAddress(mcpServer, envVars, deps.platformEndpoints);
 
   // Discovery runs with no session, so every declared caller-identity key
   // resolves to the anonymous sentinel — without it, a server templating
@@ -385,7 +372,9 @@ export async function discoverMcpServer(
  *   sentinel can only produce a misleading 401.
  * - No non-optional declarations → the old lenient path (warn and continue):
  *   servers declaring nothing (or only optional/injected keys like the
- *   caller-identity family) legitimately discover without an EC.
+ *   caller-identity family) legitimately discover without an EC. A
+ *   STIGMER_SERVER_ADDRESS the platform fills for the server's transport is
+ *   left out of the count by the caller (platform-server-address.ts).
  */
 async function resolveEnvVarsForDiscovery(
   client: StigmerClient,
@@ -635,6 +624,7 @@ export function createDiscoverMcpServerActivities(config: Config) {
         return await discoverMcpServer(input, {
           stigmerClient,
           transportPosture: resolveMcpTransportPosture(config.mode),
+          platformEndpoints: config,
         });
       } finally {
         hb.stop();

package/src/activities/execute-cursor/__test-utils__/fold.ts

@@ -21,7 +21,7 @@ import { create } from "@bufbuild/protobuf";
 import type { InteractionUpdate, SDKMessage } from "@cursor/sdk";
 import { AgentExecutionStatusSchema, type AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import { TranscriptBuilder } from "../../../harness/transcript/builder.js";
+import { TranscriptBuilder, type TranscriptObserver } from "../../../harness/transcript/builder.js";
 import { CursorTranslator, type CursorTranslatorOptions } from "../translator.js";
 
 export interface CursorFoldOptions {
@@ -35,6 +35,8 @@ export interface CursorFoldOptions {
   readonly messages?: AgentMessage[];
   readonly policies?: CursorTranslatorOptions["policies"];
   readonly leases?: CursorTranslatorOptions["leases"];
+  /** The builder's observer, as the runtime passes its turn timeline; a test that moves a fake clock between folds passes one. */
+  readonly observer?: TranscriptObserver;
 }
 
 export class CursorFold {
@@ -50,12 +52,12 @@ export class CursorFold {
       leases: options.leases ?? { global: false, categories: new Set() },
       seeded: this.status.messages,
     });
-    this.builder = new TranscriptBuilder("exec-fold", this.status);
+    this.builder = new TranscriptBuilder("exec-fold", this.status, options.observer);
   }
 
-  /** One stream event, translated and folded, then the deltas queued so far — the loop's order. */
+  /** One stream event, translated and folded as one observation, then the deltas queued so far — the loop's order. */
   event(event: SDKMessage): this {
-    for (const e of this.translator.translate(event)) this.builder.apply(e);
+    this.builder.applyObservation(this.translator.translate(event));
     this.drain();
     return this;
   }

package/src/activities/execute-cursor/__test-utils__/hermetic-cursor.ts

@@ -148,6 +148,7 @@ export function hermeticCursorConfig(env: HermeticEnvironment): Config {
     temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
     mcpBridgeEndpoint: null,
+    mcpPublicEndpoint: null,
     stigmerTokenRef: { current: null },
     cursorApiKey: FIXTURE.cursorApiKey,
     workspaceRootDir: env.workspaceRootDir,

package/src/activities/execute-cursor/__tests__/approval-gate.test.ts

@@ -23,8 +23,6 @@ import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecutio
 
 import {
   approvalCategory,
-  builtInRequiresApproval,
-  getBuiltInApprovalMessage,
   getBuiltInGatedList,
   getBuiltInGatedCategories,
   extractArgKey,
@@ -81,22 +79,10 @@ describe("approvalCategory (cross-taxonomy drift-guard)", () => {
   });
 });
 
-describe("builtInRequiresApproval", () => {
-  it("gates mutating/destructive tools in BOTH taxonomies", () => {
-    for (const t of ["Write", "StrReplace", "EditNotebook", "Shell", "Delete", "edit", "shell", "delete", "execute", "write"]) {
-      expect(builtInRequiresApproval(t)).toBe(true);
-    }
-  });
-
-  it("allows read-only built-in tools", () => {
-    for (const t of ["Read", "read", "Grep", "grep", "Glob", "glob", "ls", "think", "task"]) {
-      expect(builtInRequiresApproval(t)).toBe(false);
-    }
-  });
-
-  it("fails open for unknown tools (parity with native, avoids denying auto-approved MCP)", () => {
-    expect(builtInRequiresApproval("SomeFutureTool")).toBe(false);
-    expect(builtInRequiresApproval("search_services")).toBe(false);
+describe("the hook's gated set", () => {
+  it("fails open for unknown tools: no category, so the hook allows them (parity with native, avoids denying auto-approved MCP)", () => {
+    expect(approvalCategory("SomeFutureTool")).toBeUndefined();
+    expect(approvalCategory("search_services")).toBeUndefined();
   });
 
   it("exposes the gated set in the HOOK taxonomy (what the hook matches)", () => {
@@ -114,17 +100,6 @@ describe("builtInRequiresApproval", () => {
   });
 });
 
-describe("getBuiltInApprovalMessage", () => {
-  it("returns a category template for gated tools in EITHER taxonomy", () => {
-    expect(getBuiltInApprovalMessage("Write")).toContain("{{args.path}}");
-    expect(getBuiltInApprovalMessage("edit")).toContain("{{args.path}}");
-    expect(getBuiltInApprovalMessage("Shell")).toContain("{{args.command}}");
-    expect(getBuiltInApprovalMessage("shell")).toContain("{{args.command}}");
-    expect(getBuiltInApprovalMessage("Read")).toBeUndefined();
-    expect(getBuiltInApprovalMessage("read")).toBeUndefined();
-  });
-});
-
 describe("extractArgKey (spans both taxonomies' field names)", () => {
   it("extracts the salient value regardless of field name (file_path or path)", () => {
     expect(extractArgKey({ file_path: "a.txt" })).toBe("a.txt"); // hook shape

package/src/activities/execute-cursor/__tests__/hermetic/bypassed-tool-call.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Hermetic: a GATED built-in that runs under the execution's global bypass
+ * (`spec.auto_approve_all`), through the whole `ExecuteCursor` activity.
+ *
+ * Invariant pinned (#1117): `requiresApproval` says whether THIS call was held
+ * for a person's decision, on every harness. A shell the bypass lets run is
+ * never held, so its row carries no approval fields — the same answer the
+ * native harness gives, where a call that starts was authorized by
+ * construction. The row still carries the provenance that explains why it
+ * ran (`AUTO_APPROVE_ALL`), which is the field that answers "which policy
+ * layer governed this call". Until #1117 the Cursor translator stamped the
+ * policy's category verdict on the row at tool start, lease- and bypass-blind,
+ * so this row read `requiresApproval: true` with an approval message nobody
+ * was ever shown.
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { ApprovalPolicySource, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("@cursor/sdk/sqlite", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSqliteModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  runCursorTurn,
+} from "../../__test-utils__/hermetic-cursor.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+
+const AGENT_ID = "agent-hermetic-bypass-0001";
+const RUN_ID = "run-hermetic-bypass-0001";
+const CALL_ID = "call-hermetic-shell-0001";
+const USER_MESSAGE = "Run the tests.";
+const SHELL_ARGS = { command: "npm test" };
+const SHELL_RESULT = "ok 12 tests\n";
+const ASSISTANT_TEXT = "All twelve tests pass.";
+
+describe("ExecuteCursor hermetic — a gated built-in under the global bypass", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("persists the shell it ran as not held: no approval fields, AUTO_APPROVE_ALL provenance", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const ev = sdkEvents(AGENT_ID, RUN_ID);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_ID],
+      observeStep: () => clock.tick(),
+      turns: [
+        [
+          step.event(ev.init()),
+          step.event(ev.assistant("Running them now.")),
+          step.event(ev.toolCall(CALL_ID, "shell", "running", SHELL_ARGS)),
+          step.event(ev.toolCall(CALL_ID, "shell", "completed", SHELL_ARGS, SHELL_RESULT)),
+          step.event(ev.assistant(ASSISTANT_TEXT)),
+          step.turnEnded({ inputTokens: 1_500, outputTokens: 40, cacheReadTokens: 0, cacheWriteTokens: 0 }),
+          step.finished({ result: ASSISTANT_TEXT, model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({ message: USER_MESSAGE, autoApproveAll: true });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runCursorTurn(scenario);
+
+    // ── Assert: the turn ran to completion, nothing parked ───────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect((invocation.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
+    expect(record.waitingToolCalls(), "a bypassed call is never parked").toHaveLength(0);
+    expect(agent.runs[0].cancelCalls, "nothing was denied, so nothing was cancelled").toHaveLength(0);
+
+    // ── Assert: the row says it ran, and why, and that nobody was asked ───────
+    const rows = record.toolCalls();
+    expect(rows).toHaveLength(1);
+    const row = rows[0];
+    expect(row.name).toBe("shell");
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(row.approvalPolicySource, "the layer that let it run").toBe(ApprovalPolicySource.AUTO_APPROVE_ALL);
+    expect(row.requiresApproval, "never held for a decision").toBe(false);
+    expect(row.approvalMessage, "no card was ever shown").toBe("");
+    expect(row.approvalRequestedAt, "no approval was ever requested").toBe("");
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/file-review-capture.test.ts

@@ -160,15 +160,15 @@ describe.skipIf(!hasBash)("ExecuteCursor hermetic — file-review capture on a g
     expect(candidate.value.changeSetId).toBe(CHANGE_SET_ID);
     expect(candidate.value.changes.map((c) => c.pathAfter)).toEqual([FILE]);
 
-    // The flowed edit row: the built-in policy still classifies `edit` as a
-    // gated category (`requiresApproval: true` is the policy's verdict, stamped
-    // at fold time), but capture mode let it FLOW — so the row is COMPLETED,
-    // never WAITING_APPROVAL, and the review happens on the file card instead.
+    // The flowed edit row: `edit` is a gated category, but capture mode let it
+    // FLOW, so nobody was asked — the row is COMPLETED, never WAITING_APPROVAL,
+    // carries no approval fields (#1117: `requiresApproval` means the call was
+    // held), and the review happens on the file card instead.
     const rows = record.toolCalls();
     expect(rows).toHaveLength(1);
     expect(rows[0].name).toBe("edit");
     expect(rows[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
-    expect(rows[0].requiresApproval, "policy verdict, not the gate outcome").toBe(true);
+    expect(rows[0].requiresApproval, "held for a decision? no: capture mode let it flow").toBe(false);
     expect(record.waitingToolCalls(), "no gate row — the review is on the file card").toHaveLength(0);
 
     // ── Assert: hermeticity ──────────────────────────────────────────────────

package/src/activities/execute-cursor/__tests__/hermetic/goldens/file-review-capture.status.json

@@ -16,8 +16,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:05.000Z",
           "completedAt": "2026-01-01T00:00:06.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Write file: notes.md",
           "argsPreview": "{\"path\":\"notes.md\",\"content\":\"# Notes\\n\\nA fixture file.\\n\\nReviewed by the hermetic run.\\n\"}",
           "toolKind": "TOOL_KIND_FILE_EDIT",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/resolution-error.status.json

@@ -12,7 +12,7 @@
     }
   ],
   "phase": "EXECUTION_FAILED",
-  "error": "Execution failed: [Error] hermetic fault injected at getAgent",
+  "error": "[Error] hermetic fault injected at getAgent",
   "startedAt": "2026-01-01T00:00:00.000Z",
   "completedAt": "2026-01-01T00:00:00.000Z"
 }

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.error-delta.status.json

@@ -15,9 +15,6 @@
           "startedAt": "2026-01-01T00:00:25.000Z",
           "completedAt": "2026-01-01T00:00:27.000Z",
           "error": "sh: npm: command not found",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
-          "approvalRequestedAt": "2026-01-01T00:00:27.000Z",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.output-first.status.json

@@ -15,8 +15,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:16.000Z",
           "completedAt": "2026-01-01T00:00:19.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.status.json

@@ -15,8 +15,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:03.000Z",
           "completedAt": "2026-01-01T00:00:08.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/stall.status.json

@@ -13,8 +13,6 @@
           },
           "status": "TOOL_CALL_RUNNING",
           "startedAt": "2026-01-01T00:00:03.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/unattributed-hook-block.status.json

@@ -15,9 +15,6 @@
           "startedAt": "2026-01-01T00:00:03.000Z",
           "completedAt": "2026-01-01T00:00:03.000Z",
           "error": "blocked by a hook",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: rm -rf build",
-          "approvalRequestedAt": "2026-01-01T00:00:03.000Z",
           "argsPreview": "{\"command\":\"rm -rf build\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/shell-output-delta.test.ts

@@ -17,8 +17,9 @@
  * the stream's `running` instant; the live output reaches `result`
  * (`streamingSource: OUTPUT` while it streams, cleared at finalize); the
  * stream's `completed` stamps `completedAt` and its result wins; the shell
- * row is a gated built-in (`requiresApproval`, "Run command: …") that the
- * hook never saw, so no `approvalRequestedAt`. Predicted: NO move (the
+ * row is a gated built-in the hook never saw, so it was never held and
+ * carries no approval fields (#1117 moved `requiresApproval` and "Run
+ * command: …" off rows that ran). Predicted: NO move (the
  * translator drains the queued deltas AFTER the stream event of the
  * same window, as the enricher applied them, so the stream's instant wins
  * exactly as before).
@@ -33,9 +34,10 @@
  * Arm 3 — the completion delta reports an ERROR, and a model event sits
  * between it and the stream's own `error`. Pinned: the translator honours the
  * delta's `result.status: "error"` — the row is FAILED from the
- * instant the failure was observed (`completedAt` and, for a gated shell,
- * `approvalRequestedAt` at the delta's own tick), and the stream's `error`
- * event that follows supplies the text. Until #1097 (as this net first
+ * instant the failure was observed (`completedAt` at the delta's own tick),
+ * and the stream's `error` event that follows supplies the text. Until #1117
+ * a gated shell's ordinary failure also stamped `approvalRequestedAt`, though
+ * nobody was ever asked; a failure is not a request. Until #1097 (as this net first
  * pinned it) the enricher promoted every completion delta to
  * COMPLETED, the monotonic merge then refused the stream's FAILED, and the
  * row ended COMPLETED carrying an `error` — a row that lied. Moved in #1097
@@ -178,7 +180,7 @@ describe("ExecuteCursor hermetic — the delta channel on a shell row", () => {
     expect(row.result, "the live output reached the row").toBe(FULL_OUTPUT);
     expect(row.isStreaming, "finalize closed the OUTPUT stream").toBe(false);
     expect(row.startedAt < row.completedAt).toBe(true);
-    expect(row.requiresApproval, "a shell is a gated built-in the hook never saw").toBe(true);
+    expect(row.requiresApproval, "a shell the hook never saw was never held").toBe(false);
     expect(row.approvalRequestedAt).toBe("");
     expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
 
@@ -268,7 +270,7 @@ describe("ExecuteCursor hermetic — the delta channel on a shell row", () => {
     expect(row.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
     expect(row.error, "the stream's error event supplied the text").toBe(SHELL_ERROR);
     expect(row.result).toBe("");
-    expect(row.approvalRequestedAt, "a gated shell's gate stamp shares the observed instant").toBe(row.completedAt);
+    expect(row.approvalRequestedAt, "a failure is not an approval request").toBe("");
 
     const json = JSON.stringify(toJson(AgentExecutionStatusSchema, record.lastFullStatus!), null, 2) + "\n";
     await expect(json).toMatchFileSnapshot("./goldens/shell-output-delta.error-delta.status.json");

package/src/activities/execute-cursor/__tests__/hermetic/thrown-error-arms.test.ts

@@ -37,6 +37,11 @@
  * golden is unchanged: its turn fails before the workspace is provisioned,
  * so no capture is pinned.
  *
+ * Golden hunk since stigmer#1122: `resolution-error`'s `status.error` is
+ * `[Error] <message>`, the details row's text, where it was
+ * `Execution failed: [Error] <message>`; one grammar for a FAILED error,
+ * whichever side caught the fault.
+ *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
  */
@@ -180,7 +185,7 @@ describe("ExecuteCursor hermetic — thrown-error arms of the outer catch", () =
     expect(slim.phase).toBe("EXECUTION_FAILED");
     expect(record.persistedPhases).toEqual([ExecutionPhase.EXECUTION_FAILED]);
     const final = record.lastFullStatus!;
-    expect(final.error).toBe(`Execution failed: [Error] ${CONTROL_PLANE_FAULT}`);
+    expect(final.error).toBe(`[Error] ${CONTROL_PLANE_FAULT}`);
     expect(final.completedAt).not.toBe("");
     expect(systemMessages(final)).toEqual([
       GENERIC_SYSTEM_MESSAGE,

package/src/activities/execute-cursor/__tests__/hitl-resume-history.test.ts

@@ -296,14 +296,13 @@ describe("Cursor HITL resume — append-only transcript", () => {
     expect(status.subAgentExecutions.some((s) => s.id === "sub_1")).toBe(true);
   });
 
-  it("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
-    // The transcript-superset fix keeps the run off the watchdog, but the OTHER
-    // half of "no loop" is that the approved tools' grants actually let the hook
-    // ALLOW the re-issued calls. Drive the real bash hook with the grants the
-    // resume mints from the persisted run-1 decisions and prove the two approved
-    // MCP tools pass while the genuinely-new `click` is still gated.
-    if (!hasBash) return; // hook tests require bash; mirrored skip of the d() guard.
-
+  // The transcript-superset fix keeps the run off the watchdog, but the OTHER
+  // half of "no loop" is that the approved tools' grants actually let the hook
+  // ALLOW the re-issued calls. Drive the real bash hook with the grants the
+  // resume mints from the persisted run-1 decisions and prove the two approved
+  // MCP tools pass while the genuinely-new `click` is still gated. The hook
+  // needs bash, mirroring the d() guard.
+  it.skipIf(!hasBash)("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(persistedRunOneMessages());
     const grants = buildApprovalGrants(pendingApprovals, decisions);
     const state = buildApprovalState(new Map(), false, new Set(), grants);
@@ -426,9 +425,7 @@ describe("Cursor HITL resume — two approvals then clean completion (no loop)",
     expect(guardRejectionReason(committed, seeded)).toBeUndefined();
   });
 
-  it("the built-in grants actually let the hook allow both re-issues (full closure)", () => {
-    if (!hasBash) return;
-
+  it.skipIf(!hasBash)("the built-in grants actually let the hook allow both re-issues (full closure)", () => {
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(committedBuiltInApprovals());
     const grants = buildApprovalGrants(pendingApprovals, decisions);
     const state = buildApprovalState(new Map(), false, new Set(), grants);

package/src/activities/execute-cursor/__tests__/sequential-gate-resume.test.ts

@@ -170,9 +170,7 @@ describe("Cursor sequential gates A->B across resume", () => {
     expect(guardRejectionReason(committed, seeded)).toBeUndefined();
   });
 
-  it("the hook ALLOWS gate A's re-issue and DENIES gate B (out-of-process closure)", () => {
-    if (!hasBash) return;
-
+  it.skipIf(!hasBash)("the hook ALLOWS gate A's re-issue and DENIES gate B (out-of-process closure)", () => {
     // Only gate A is approved going into the resume; its grant is what the hook
     // reads. Gate B has no grant yet (it gates for the first time this turn).
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(approvedGateA());