@stigmer/runner 3.40.1 → 3.41.0

package/src/activities/execute-cursor/__tests__/hermetic/bypassed-tool-call.test.ts

@@ -0,0 +1,120 @@
+/**
+ * Hermetic: a GATED built-in that runs under the execution's global bypass
+ * (`spec.auto_approve_all`), through the whole `ExecuteCursor` activity.
+ *
+ * Invariant pinned (#1117): `requiresApproval` says whether THIS call was held
+ * for a person's decision, on every harness. A shell the bypass lets run is
+ * never held, so its row carries no approval fields — the same answer the
+ * native harness gives, where a call that starts was authorized by
+ * construction. The row still carries the provenance that explains why it
+ * ran (`AUTO_APPROVE_ALL`), which is the field that answers "which policy
+ * layer governed this call". Until #1117 the Cursor translator stamped the
+ * policy's category verdict on the row at tool start, lease- and bypass-blind,
+ * so this row read `requiresApproval: true` with an approval message nobody
+ * was ever shown.
+ */
+
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import { ApprovalPolicySource, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("@cursor/sdk", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSdkModule(),
+);
+vi.mock("@cursor/sdk/sqlite", async () =>
+  (await import("../../__test-utils__/scripted-sdk.js")).scriptedCursorSqliteModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { ScriptedCursorAgent, sdkEvents, step } from "../../__test-utils__/scripted-agent.js";
+import {
+  FIXTURE,
+  SDK_CATALOG,
+  beginCursorScenario,
+  cursorExecutionRecord,
+  runCursorTurn,
+} from "../../__test-utils__/hermetic-cursor.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+
+const AGENT_ID = "agent-hermetic-bypass-0001";
+const RUN_ID = "run-hermetic-bypass-0001";
+const CALL_ID = "call-hermetic-shell-0001";
+const USER_MESSAGE = "Run the tests.";
+const SHELL_ARGS = { command: "npm test" };
+const SHELL_RESULT = "ok 12 tests\n";
+const ASSISTANT_TEXT = "All twelve tests pass.";
+
+describe("ExecuteCursor hermetic — a gated built-in under the global bypass", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("persists the shell it ran as not held: no approval fields, AUTO_APPROVE_ALL provenance", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const ev = sdkEvents(AGENT_ID, RUN_ID);
+    const agent = new ScriptedCursorAgent({
+      agentId: AGENT_ID,
+      runIds: [RUN_ID],
+      observeStep: () => clock.tick(),
+      turns: [
+        [
+          step.event(ev.init()),
+          step.event(ev.assistant("Running them now.")),
+          step.event(ev.toolCall(CALL_ID, "shell", "running", SHELL_ARGS)),
+          step.event(ev.toolCall(CALL_ID, "shell", "completed", SHELL_ARGS, SHELL_RESULT)),
+          step.event(ev.assistant(ASSISTANT_TEXT)),
+          step.turnEnded({ inputTokens: 1_500, outputTokens: 40, cacheReadTokens: 0, cacheWriteTokens: 0 }),
+          step.finished({ result: ASSISTANT_TEXT, model: { id: FIXTURE.model, params: [] } }),
+        ],
+      ],
+    });
+    const record = cursorExecutionRecord({ message: USER_MESSAGE, autoApproveAll: true });
+    const scenario = beginCursorScenario({
+      env,
+      clock,
+      record,
+      sdk: { agents: [agent], catalog: SDK_CATALOG },
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runCursorTurn(scenario);
+
+    // ── Assert: the turn ran to completion, nothing parked ───────────────────
+    expect(invocation.outcome.kind).toBe("returned");
+    expect((invocation.outcome as { value: Record<string, unknown> }).value.phase).toBe("EXECUTION_COMPLETED");
+    expect(record.waitingToolCalls(), "a bypassed call is never parked").toHaveLength(0);
+    expect(agent.runs[0].cancelCalls, "nothing was denied, so nothing was cancelled").toHaveLength(0);
+
+    // ── Assert: the row says it ran, and why, and that nobody was asked ───────
+    const rows = record.toolCalls();
+    expect(rows).toHaveLength(1);
+    const row = rows[0];
+    expect(row.name).toBe("shell");
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(row.approvalPolicySource, "the layer that let it run").toBe(ApprovalPolicySource.AUTO_APPROVE_ALL);
+    expect(row.requiresApproval, "never held for a decision").toBe(false);
+    expect(row.approvalMessage, "no card was ever shown").toBe("");
+    expect(row.approvalRequestedAt, "no approval was ever requested").toBe("");
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+  });
+});

package/src/activities/execute-cursor/__tests__/hermetic/file-review-capture.test.ts

@@ -160,15 +160,15 @@ describe.skipIf(!hasBash)("ExecuteCursor hermetic — file-review capture on a g
     expect(candidate.value.changeSetId).toBe(CHANGE_SET_ID);
     expect(candidate.value.changes.map((c) => c.pathAfter)).toEqual([FILE]);
 
-    // The flowed edit row: the built-in policy still classifies `edit` as a
-    // gated category (`requiresApproval: true` is the policy's verdict, stamped
-    // at fold time), but capture mode let it FLOW — so the row is COMPLETED,
-    // never WAITING_APPROVAL, and the review happens on the file card instead.
+    // The flowed edit row: `edit` is a gated category, but capture mode let it
+    // FLOW, so nobody was asked — the row is COMPLETED, never WAITING_APPROVAL,
+    // carries no approval fields (#1117: `requiresApproval` means the call was
+    // held), and the review happens on the file card instead.
     const rows = record.toolCalls();
     expect(rows).toHaveLength(1);
     expect(rows[0].name).toBe("edit");
     expect(rows[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
-    expect(rows[0].requiresApproval, "policy verdict, not the gate outcome").toBe(true);
+    expect(rows[0].requiresApproval, "held for a decision? no: capture mode let it flow").toBe(false);
     expect(record.waitingToolCalls(), "no gate row — the review is on the file card").toHaveLength(0);
 
     // ── Assert: hermeticity ──────────────────────────────────────────────────

package/src/activities/execute-cursor/__tests__/hermetic/goldens/file-review-capture.status.json

@@ -16,8 +16,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:05.000Z",
           "completedAt": "2026-01-01T00:00:06.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Write file: notes.md",
           "argsPreview": "{\"path\":\"notes.md\",\"content\":\"# Notes\\n\\nA fixture file.\\n\\nReviewed by the hermetic run.\\n\"}",
           "toolKind": "TOOL_KIND_FILE_EDIT",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/resolution-error.status.json

@@ -12,7 +12,7 @@
     }
   ],
   "phase": "EXECUTION_FAILED",
-  "error": "Execution failed: [Error] hermetic fault injected at getAgent",
+  "error": "[Error] hermetic fault injected at getAgent",
   "startedAt": "2026-01-01T00:00:00.000Z",
   "completedAt": "2026-01-01T00:00:00.000Z"
 }

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.error-delta.status.json

@@ -15,9 +15,6 @@
           "startedAt": "2026-01-01T00:00:25.000Z",
           "completedAt": "2026-01-01T00:00:27.000Z",
           "error": "sh: npm: command not found",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
-          "approvalRequestedAt": "2026-01-01T00:00:27.000Z",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.output-first.status.json

@@ -15,8 +15,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:16.000Z",
           "completedAt": "2026-01-01T00:00:19.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/shell-output-delta.status.json

@@ -15,8 +15,6 @@
           "status": "TOOL_CALL_COMPLETED",
           "startedAt": "2026-01-01T00:00:03.000Z",
           "completedAt": "2026-01-01T00:00:08.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/stall.status.json

@@ -13,8 +13,6 @@
           },
           "status": "TOOL_CALL_RUNNING",
           "startedAt": "2026-01-01T00:00:03.000Z",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: npm test",
           "argsPreview": "{\"command\":\"npm test\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/goldens/unattributed-hook-block.status.json

@@ -15,9 +15,6 @@
           "startedAt": "2026-01-01T00:00:03.000Z",
           "completedAt": "2026-01-01T00:00:03.000Z",
           "error": "blocked by a hook",
-          "requiresApproval": true,
-          "approvalMessage": "Run command: rm -rf build",
-          "approvalRequestedAt": "2026-01-01T00:00:03.000Z",
           "argsPreview": "{\"command\":\"rm -rf build\"}",
           "toolKind": "TOOL_KIND_SHELL",
           "approvalPolicySource": "APPROVAL_POLICY_SOURCE_BUILTIN_CATEGORY",

package/src/activities/execute-cursor/__tests__/hermetic/shell-output-delta.test.ts

@@ -17,8 +17,9 @@
  * the stream's `running` instant; the live output reaches `result`
  * (`streamingSource: OUTPUT` while it streams, cleared at finalize); the
  * stream's `completed` stamps `completedAt` and its result wins; the shell
- * row is a gated built-in (`requiresApproval`, "Run command: …") that the
- * hook never saw, so no `approvalRequestedAt`. Predicted: NO move (the
+ * row is a gated built-in the hook never saw, so it was never held and
+ * carries no approval fields (#1117 moved `requiresApproval` and "Run
+ * command: …" off rows that ran). Predicted: NO move (the
  * translator drains the queued deltas AFTER the stream event of the
  * same window, as the enricher applied them, so the stream's instant wins
  * exactly as before).
@@ -33,9 +34,10 @@
  * Arm 3 — the completion delta reports an ERROR, and a model event sits
  * between it and the stream's own `error`. Pinned: the translator honours the
  * delta's `result.status: "error"` — the row is FAILED from the
- * instant the failure was observed (`completedAt` and, for a gated shell,
- * `approvalRequestedAt` at the delta's own tick), and the stream's `error`
- * event that follows supplies the text. Until #1097 (as this net first
+ * instant the failure was observed (`completedAt` at the delta's own tick),
+ * and the stream's `error` event that follows supplies the text. Until #1117
+ * a gated shell's ordinary failure also stamped `approvalRequestedAt`, though
+ * nobody was ever asked; a failure is not a request. Until #1097 (as this net first
  * pinned it) the enricher promoted every completion delta to
  * COMPLETED, the monotonic merge then refused the stream's FAILED, and the
  * row ended COMPLETED carrying an `error` — a row that lied. Moved in #1097
@@ -178,7 +180,7 @@ describe("ExecuteCursor hermetic — the delta channel on a shell row", () => {
     expect(row.result, "the live output reached the row").toBe(FULL_OUTPUT);
     expect(row.isStreaming, "finalize closed the OUTPUT stream").toBe(false);
     expect(row.startedAt < row.completedAt).toBe(true);
-    expect(row.requiresApproval, "a shell is a gated built-in the hook never saw").toBe(true);
+    expect(row.requiresApproval, "a shell the hook never saw was never held").toBe(false);
     expect(row.approvalRequestedAt).toBe("");
     expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
 
@@ -268,7 +270,7 @@ describe("ExecuteCursor hermetic — the delta channel on a shell row", () => {
     expect(row.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
     expect(row.error, "the stream's error event supplied the text").toBe(SHELL_ERROR);
     expect(row.result).toBe("");
-    expect(row.approvalRequestedAt, "a gated shell's gate stamp shares the observed instant").toBe(row.completedAt);
+    expect(row.approvalRequestedAt, "a failure is not an approval request").toBe("");
 
     const json = JSON.stringify(toJson(AgentExecutionStatusSchema, record.lastFullStatus!), null, 2) + "\n";
     await expect(json).toMatchFileSnapshot("./goldens/shell-output-delta.error-delta.status.json");

package/src/activities/execute-cursor/__tests__/hermetic/thrown-error-arms.test.ts

@@ -37,6 +37,11 @@
  * golden is unchanged: its turn fails before the workspace is provisioned,
  * so no capture is pinned.
  *
+ * Golden hunk since stigmer#1122: `resolution-error`'s `status.error` is
+ * `[Error] <message>`, the details row's text, where it was
+ * `Execution failed: [Error] <message>`; one grammar for a FAILED error,
+ * whichever side caught the fault.
+ *
  * Regenerate ONLY after a deliberate behavior change:
  *   npx vitest run src/activities/execute-cursor/__tests__/hermetic -u
  */
@@ -180,7 +185,7 @@ describe("ExecuteCursor hermetic — thrown-error arms of the outer catch", () =
     expect(slim.phase).toBe("EXECUTION_FAILED");
     expect(record.persistedPhases).toEqual([ExecutionPhase.EXECUTION_FAILED]);
     const final = record.lastFullStatus!;
-    expect(final.error).toBe(`Execution failed: [Error] ${CONTROL_PLANE_FAULT}`);
+    expect(final.error).toBe(`[Error] ${CONTROL_PLANE_FAULT}`);
     expect(final.completedAt).not.toBe("");
     expect(systemMessages(final)).toEqual([
       GENERIC_SYSTEM_MESSAGE,

package/src/activities/execute-cursor/__tests__/hitl-resume-history.test.ts

@@ -296,14 +296,13 @@ describe("Cursor HITL resume — append-only transcript", () => {
     expect(status.subAgentExecutions.some((s) => s.id === "sub_1")).toBe(true);
   });
 
-  it("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
-    // The transcript-superset fix keeps the run off the watchdog, but the OTHER
-    // half of "no loop" is that the approved tools' grants actually let the hook
-    // ALLOW the re-issued calls. Drive the real bash hook with the grants the
-    // resume mints from the persisted run-1 decisions and prove the two approved
-    // MCP tools pass while the genuinely-new `click` is still gated.
-    if (!hasBash) return; // hook tests require bash; mirrored skip of the d() guard.
-
+  // The transcript-superset fix keeps the run off the watchdog, but the OTHER
+  // half of "no loop" is that the approved tools' grants actually let the hook
+  // ALLOW the re-issued calls. Drive the real bash hook with the grants the
+  // resume mints from the persisted run-1 decisions and prove the two approved
+  // MCP tools pass while the genuinely-new `click` is still gated. The hook
+  // needs bash, mirroring the d() guard.
+  it.skipIf(!hasBash)("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(persistedRunOneMessages());
     const grants = buildApprovalGrants(pendingApprovals, decisions);
     const state = buildApprovalState(new Map(), false, new Set(), grants);
@@ -426,9 +425,7 @@ describe("Cursor HITL resume — two approvals then clean completion (no loop)",
     expect(guardRejectionReason(committed, seeded)).toBeUndefined();
   });
 
-  it("the built-in grants actually let the hook allow both re-issues (full closure)", () => {
-    if (!hasBash) return;
-
+  it.skipIf(!hasBash)("the built-in grants actually let the hook allow both re-issues (full closure)", () => {
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(committedBuiltInApprovals());
     const grants = buildApprovalGrants(pendingApprovals, decisions);
     const state = buildApprovalState(new Map(), false, new Set(), grants);

package/src/activities/execute-cursor/__tests__/sequential-gate-resume.test.ts

@@ -170,9 +170,7 @@ describe("Cursor sequential gates A->B across resume", () => {
     expect(guardRejectionReason(committed, seeded)).toBeUndefined();
   });
 
-  it("the hook ALLOWS gate A's re-issue and DENIES gate B (out-of-process closure)", () => {
-    if (!hasBash) return;
-
+  it.skipIf(!hasBash)("the hook ALLOWS gate A's re-issue and DENIES gate B (out-of-process closure)", () => {
     // Only gate A is approved going into the resume; its grant is what the hook
     // reads. Gate B has no grant yet (it gates for the first time this turn).
     const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(approvedGateA());

package/src/activities/execute-cursor/__tests__/translator.test.ts

@@ -17,10 +17,11 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { create } from "@bufbuild/protobuf";
 import type { InteractionUpdate, SDKMessage } from "@cursor/sdk";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ApprovalAction, MessageType, SubAgentStatus, ToolCallStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApprovalAction, ApprovalPolicySource, MessageType, SubAgentStatus, ToolCallStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import type { TranscriptEvent } from "../../../harness/transcript/events.js";
 import type { MergedToolPolicy } from "../../../shared/approval-policy.js";
+import type { ToolApprovalCategory } from "../../../shared/tool-kind.js";
 import { CursorFold, foldCursorEvents } from "../__test-utils__/fold.js";
 import { sdkEvents } from "../__test-utils__/scripted-agent.js";
 import { grantToken } from "../approval-state.js";
@@ -118,19 +119,26 @@ describe("CursorTranslator — a tool_call event is the row's start and, when te
     expect(started).toEqual({ kind: "tool_started", callId: "c1", name: "read", input: { path: "a.md" }, mcpServerSlug: "" });
   });
 
-  it("a gated built-in carries the policy's word: the category's message over the args", () => {
+  it("a gated built-in's start carries its provenance and no approval: only the boundary says a call was held (#1117)", () => {
     const [started] = translator().translate(ev.toolCall("c1", "shell", "running", { command: "npm test" }));
-    expect(started).toMatchObject({ kind: "tool_started", gate: { message: "Run command: npm test" }, provenance: "builtin_category" });
+    expect(started).toEqual({ kind: "tool_started", callId: "c1", name: "shell", input: { command: "npm test" }, mcpServerSlug: "", provenance: "builtin_category" });
     const fold = foldCursorEvents([ev.toolCall("c1", "shell", "running", { command: "npm test" })]);
-    expect(fold.row("c1").requiresApproval).toBe(true);
-    expect(fold.row("c1").approvalMessage).toBe("Run command: npm test");
-    expect(fold.row("c1").status, "gated but RUNNING: the boundary parks it, never the stream").toBe(ToolCallStatus.TOOL_CALL_RUNNING);
+    expect(fold.row("c1").requiresApproval, "not held yet: the hook has not denied it").toBe(false);
+    expect(fold.row("c1").approvalMessage).toBe("");
+    expect(fold.row("c1").status, "RUNNING: the boundary parks a denied call, never the stream").toBe(ToolCallStatus.TOOL_CALL_RUNNING);
   });
 
-  it("a leased category is still the policy's word (lease-blind, as the accumulator was; the harness difference is #1117)", () => {
-    const t = new CursorTranslator({ policies: new Map(), leases: { global: false, categories: new Set(["shell"]) }, seeded: [] });
-    const [started] = t.translate(ev.toolCall("c1", "shell", "running", { command: "ls" }));
-    expect(started).toMatchObject({ gate: { message: "Run command: ls" }, provenance: "approval_lease" });
+  it("a call under an approve-all lease runs as not held, the lease named as its provenance (#1117)", () => {
+    const leases = { global: false, categories: new Set<ToolApprovalCategory>(["shell"]) };
+    const fold = new CursorFold({ leases }).events(
+      ev.toolCall("c1", "shell", "running", { command: "ls" }),
+      ev.toolCall("c1", "shell", "completed", { command: "ls" }, "a.md"),
+    );
+    expect(fold.row("c1").status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(fold.row("c1").approvalPolicySource).toBe(ApprovalPolicySource.APPROVAL_LEASE);
+    expect(fold.row("c1").requiresApproval, "the lease let it run; nobody was asked").toBe(false);
+    expect(fold.row("c1").approvalMessage).toBe("");
+    expect(fold.row("c1").approvalRequestedAt).toBe("");
   });
 
   it("completed → tool_finished with the result rendered to the row's string; a string as-is, an envelope stringified", () => {
@@ -163,6 +171,28 @@ describe("CursorTranslator — a tool_call event is the row's start and, when te
     expect(fold.messages[0].toolCalls.map((tc) => tc.id)).toEqual(["c1"]);
   });
 
+  describe("one stream event is one instant, whatever the clock does between its folds (stigmer#1390)", () => {
+    beforeEach(() => {
+      vi.useFakeTimers({ toFake: ["Date"] });
+      vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    });
+    afterEach(() => {
+      vi.useRealTimers();
+    });
+
+    it("a completion or an error with no running before it starts and ends at the same instant", () => {
+      // The observer moves the clock 1 ms after every fold, so a start and a
+      // finish read separately would be a millisecond apart, as in the flake.
+      const fold = new CursorFold({ observer: () => vi.advanceTimersByTime(1) }).events(
+        ev.toolCall("c1", "read", "completed", { path: "x" }, "done"),
+        ev.toolCall("c2", "read", "error", { path: "y" }, "ENOENT"),
+      );
+      expect([fold.row("c1").startedAt, fold.row("c1").completedAt]).toEqual(["2026-01-01T00:00:00.000Z", "2026-01-01T00:00:00.000Z"]);
+      expect(fold.row("c2").startedAt).not.toBe("2026-01-01T00:00:00.000Z");
+      expect(fold.row("c2").completedAt).toBe(fold.row("c2").startedAt);
+    });
+  });
+
   it("a completion after later text lands on the row where it started, never on the new message (cross-message completion)", () => {
     const fold = foldCursorEvents([
       ev.assistant("Running two things."),
@@ -230,19 +260,19 @@ describe("CursorTranslator — the MCP envelope is unwrapped to the inner tool",
     expect(started).toEqual({ kind: "tool_started", callId: "m1", name: "search_services", input: { query: "db" }, mcpServerSlug: "planton", provenance: "classifier_default" });
   });
 
-  it("a policy that requires approval is the gate, its message resolved over the inner args", () => {
+  it("a policy that requires approval is the call's provenance; the row is not held until the boundary parks it", () => {
     const t = new CursorTranslator({ policies, leases: { global: false, categories: new Set() }, seeded: [] });
     const [started] = t.translate(ev.toolCall("m1", "mcp", "running", MCP_ARGS));
-    expect(started).toMatchObject({ gate: { message: "Search db on search_services" }, provenance: "pinned_override" });
+    expect(started).toEqual({ kind: "tool_started", callId: "m1", name: "search_services", input: { query: "db" }, mcpServerSlug: "planton", provenance: "pinned_override" });
     const fold = new CursorFold({ policies }).events(ev.toolCall("m1", "mcp", "running", MCP_ARGS));
     expect(fold.row("m1").toolKind).toBe(ToolKind.MCP);
+    expect(fold.row("m1").requiresApproval).toBe(false);
     expect(fold.row("m1").argsPreview, "the row's own args, never the envelope").toBe(JSON.stringify({ query: "db" }));
   });
 
   it("an mcp event with no toolName is an ordinary tool named mcp, and is never gated by a built-in category", () => {
     const [started] = translator().translate(ev.toolCall("m1", "mcp", "running", { providerIdentifier: "x" }));
-    expect(started).toMatchObject({ name: "mcp", mcpServerSlug: "", input: { providerIdentifier: "x" } });
-    expect((started as { gate?: unknown }).gate).toBeUndefined();
+    expect(started).toEqual({ kind: "tool_started", callId: "m1", name: "mcp", input: { providerIdentifier: "x" }, mcpServerSlug: "" });
   });
 });
 
@@ -314,6 +344,29 @@ describe("CursorTranslator — a task tool call is a sub-agent, its transcript d
     expect(fold.status.subAgentExecutions[0].messages).toHaveLength(2);
   });
 
+  describe("one stream event is one instant, whatever the clock does between its folds (stigmer#1390)", () => {
+    beforeEach(() => {
+      vi.useFakeTimers({ toFake: ["Date"] });
+      vi.setSystemTime(new Date("2026-01-01T00:00:00.000Z"));
+    });
+    afterEach(() => {
+      vi.useRealTimers();
+    });
+
+    it("a task completion with no running before it: the task row, the sub-agent row and the child's rows and messages share it", () => {
+      const fold = new CursorFold({ observer: () => vi.advanceTimersByTime(1) }).event(ev.toolCall("task-1", "task", "completed", TASK_ARGS, STEPS));
+      const task = fold.row("task-1");
+      const [sub] = fold.status.subAgentExecutions;
+      const read = sub.messages.flatMap((m) => m.toolCalls)[0];
+      expect([
+        task.startedAt, task.completedAt,
+        sub.startedAt, sub.completedAt,
+        read.startedAt, read.completedAt,
+        ...sub.messages.map((m) => m.timestamp),
+      ]).toEqual(Array(8).fill("2026-01-01T00:00:00.000Z"));
+    });
+  });
+
   it("error → the row's error then sub_agent_failed with the same text", () => {
     const t = translator();
     t.translate(ev.toolCall("task-1", "task", "running", TASK_ARGS));
@@ -549,7 +602,7 @@ describe("CursorTranslator — the delta channel is queued, held for unannounced
     fold.event(ev.thinking("It failed."));
     expect(fold.row("c2").status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
     expect(fold.row("c2").completedAt).toBe("2026-01-01T00:00:07.000Z");
-    expect(fold.row("c2").approvalRequestedAt, "a gated shell").toBe("2026-01-01T00:00:07.000Z");
+    expect(fold.row("c2").approvalRequestedAt, "a failure is not an approval request (#1117)").toBe("");
     fold.event(ev.toolCall("c2", "shell", "error", { command: "make" }, "sh: make: command not found"));
     expect(fold.row("c2").error).toBe("sh: make: command not found");
     expect(fold.row("c2").status).toBe(ToolCallStatus.TOOL_CALL_FAILED);

package/src/activities/execute-cursor/approval-policy.ts

@@ -27,9 +27,9 @@ export {
   mergeApprovalPolicies,
   lookupMcpToolPolicy,
   resolveApprovalMessage,
+  resolveBuiltInApprovalMessage,
   POLICY_ENGINE_VERSION,
 } from "../../shared/approval-policy.js";
-import { CATEGORY_APPROVAL_MESSAGE } from "../../shared/approval-policy.js";
 export type { MergedToolPolicy, PolicySource } from "../../shared/approval-policy.js";
 
 /**
@@ -43,6 +43,16 @@ export type { MergedToolPolicy, PolicySource } from "../../shared/approval-polic
  * taxonomy because it is consulted only to build the hook's gated set and its
  * name->category mapping. Cross-layer correlation never compares these raw
  * names — it uses {@link approvalCategory} (see below).
+ *
+ * Only mutating and destructive tools are gated; everything else (read-only
+ * built-ins, and auto-approved MCP tools) is allowed. This "gate the dangerous
+ * set, allow the rest" model is the platform's one approval rule, read through
+ * the shared `toolApprovalCategory` (`shared/tool-kind.ts`) that the native gate
+ * (`middleware/approval-gate.ts` `resolveToolApproval`) also reads: one
+ * taxonomy, two enforcement points. It is deliberately fail-OPEN for unknown
+ * tools: the merged MCP policy map carries only the tools that REQUIRE approval,
+ * so a fail-closed default would deny every auto-approved MCP tool, which the
+ * hook cannot distinguish from an unknown built-in by name.
  */
 const BUILT_IN_GATED: ReadonlySet<string> = new Set([
   "Write",
@@ -83,27 +93,6 @@ export const approvalCategory = toolApprovalCategory;
 export { SALIENT_ARG_FIELDS } from "../../shared/args-preview.js";
 import { SALIENT_ARG_FIELDS } from "../../shared/args-preview.js";
 
-/**
- * Check whether a built-in (non-MCP) Cursor tool requires user approval.
- *
- * Resolved via {@link approvalCategory} so it answers correctly for BOTH
- * taxonomies — the hook's `Write`/`Shell`/`Delete` and the stream's
- * `edit`/`shell`/`delete` all return true. Only mutating/destructive tools are
- * gated; everything else (read-only built-ins, and — at the hook layer —
- * auto-approved MCP tools) is allowed. This "gate the dangerous set, allow the
- * rest" model is the platform's one approval rule, read through the shared
- * `approvalCategory` / `toolApprovalCategory` (`shared/tool-kind.ts`) that the
- * native gate (`middleware/approval-gate.ts` `resolveToolApproval`) also
- * reads — one taxonomy, two enforcement points. It is deliberately fail-OPEN
- * for unknown tools: the merged MCP policy map carries
- * only the tools that REQUIRE approval, so a fail-closed default would wrongly
- * deny every auto-approved MCP tool, which the hook cannot distinguish from an
- * unknown built-in by name.
- */
-export function builtInRequiresApproval(toolName: string): boolean {
-  return approvalCategory(toolName) !== undefined;
-}
-
 /**
  * Returns the built-in tool names that require approval (the gated set the
  * preToolUse hook denies unless auto-approved or granted on reinvocation).
@@ -134,20 +123,6 @@ export function getBuiltInGatedCategories(): Array<[string, ApprovalCategory]> {
   return pairs;
 }
 
-/**
- * Approval-message template for a gated built-in tool (either taxonomy), or
- * undefined when the tool is not gated. Resolved via {@link approvalCategory}
- * so stream-side names (`edit`/`shell`/`delete`) and hook-side names
- * (`Write`/`Shell`/`Delete`) both map to the same template — the platform's
- * ONE table, `shared/approval-policy.ts` `CATEGORY_APPROVAL_MESSAGE`, shared
- * with the native gate since #1097. Callers resolve the
- * placeholders against the tool args via resolveApprovalMessage.
- */
-export function getBuiltInApprovalMessage(toolName: string): string | undefined {
-  const category = approvalCategory(toolName);
-  return category ? CATEGORY_APPROVAL_MESSAGE[category] : undefined;
-}
-
 /**
  * Extract the canonical "salient" argument value that identifies the resource a
  * built-in tool acts on (the file path, the shell command, …). Returns "" when

package/src/activities/execute-cursor/boundary-rows.ts

@@ -34,7 +34,7 @@ import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agent
 import { ApprovalPolicySource, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { TranscriptBuilder } from "../../harness/transcript/builder.js";
 import type { MergedToolPolicy } from "./approval-policy.js";
-import { lookupMcpToolPolicy, resolveApprovalMessage, getBuiltInApprovalMessage } from "./approval-policy.js";
+import { lookupMcpToolPolicy, resolveApprovalMessage, resolveBuiltInApprovalMessage } from "./approval-policy.js";
 import {
   POLICY_ENGINE_VERSION,
   resolveApprovalProvenance,
@@ -1125,8 +1125,8 @@ function resolveDeniedApprovalMessage(
     if (policy) return resolveApprovalMessage(policy.approvalMessage, name, args);
   }
   if (!mcpServerSlug) {
-    const template = getBuiltInApprovalMessage(name);
-    if (template) return resolveApprovalMessage(template, name, args);
+    const message = resolveBuiltInApprovalMessage(name, args);
+    if (message !== undefined) return message;
   }
   return `Tool requires approval: ${name}`;
 }