@stigmer/runner 3.40.1 → 3.41.0

package/dist/shared/tool-rounds.js

@@ -1,18 +1,28 @@
 /**
- * ExecutionConfig.max_tool_rounds → LangGraph recursion_limit resolution.
+ * ExecutionConfig.max_tool_rounds: the round budget, its backstop, and the
+ * signal that the budget ended a turn.
  *
  * Implements the proto contract (agentexecution/v1/spec.proto):
- *   - 0 / unset = unlimited — no recursionLimit is placed on the invoke
- *     config, preserving the run-until-done + loop-detection posture.
+ *   - 0 / unset = unlimited: no round limit and no recursionLimit, preserving
+ *     the run-until-done + loop-detection posture.
  *   - When set, valid range is 10–1000 rounds; out-of-range values are
  *     clamped to the nearest bound with a warning log.
- *   - recursion_limit = rounds × 6: each model-tool round consumes multiple
- *     graph super-steps because every active middleware hook is its own
- *     node; ×6 is the contract's floor estimate.
+ *   - A round is one model response that proposes one or more tool calls,
+ *     followed by their execution; parallel calls are one round.
  *
- * The SAME resolved limit must feed both LangGraph's hard stop (the invoke
- * config) and the ExecutionBudgetMiddleware's wrap-up advisory, so the
- * "~80% of budget" warning and the enforcement point can never disagree.
+ * The budget is COUNTED, not estimated. `middleware/execution-budget.ts`
+ * counts rounds where the model is called and throws
+ * {@link ToolRoundLimitError} before round N+1's model call, so N rounds
+ * run on every middleware stack. The count and the "~80% of budget"
+ * advisory live in that one middleware, so they can never disagree. Until
+ * #1113 the budget was LangGraph's recursion limit at rounds × 6 super-steps,
+ * and because every middleware hook is its own graph node, how many rounds
+ * fitted moved whenever the stack did.
+ *
+ * LangGraph's recursion limit stays only as a backstop
+ * ({@link backstopRecursionLimit}): generous enough never to bind before the
+ * round count on any stack, it halts a graph that loops without calling the
+ * model. Either stop is the same outcome ({@link isToolCallBudgetStop}).
  *
  * The knob and its terminal copy live together (the `cost-guard.ts` shape):
  * when the budget is exhausted the adapter ends its turn `tool_call_limit`
@@ -20,24 +30,34 @@
  * below — the platform deliberately stopped the run, work is checkpointed,
  * and the conversation continues on the next message.
  */
-export const SUPER_STEPS_PER_ROUND = 6;
+import { unwrapModelError } from "./model-error.js";
 export const MIN_TOOL_ROUNDS = 10;
 export const MAX_TOOL_ROUNDS = 1000;
 /**
- * The advisory-only budget used when max_tool_rounds is unset: high enough
- * to never fire on a healthy run. Deliberately NOT enforced as a hard
- * recursionLimit — unset means unlimited per the proto contract.
+ * Super-steps per round the backstop allows: well above the graph nodes one
+ * round costs on any stack the runner builds (about five today), so the
+ * round count, never the backstop, is what a bounded run meets.
+ */
+export const SUPER_STEPS_BACKSTOP_PER_ROUND = 20;
+/**
+ * The advisory-only round budget used when max_tool_rounds is unset: high
+ * enough to never fire on a healthy run. Deliberately NOT enforced — unset
+ * means unlimited per the proto contract.
  */
-export const UNBOUNDED_ADVISORY_RECURSION_LIMIT = 6000;
+export const UNBOUNDED_ADVISORY_TOOL_ROUNDS = MAX_TOOL_ROUNDS;
 /**
- * The recursionLimit for the invoke config, or null when the execution is
- * unbounded (max_tool_rounds 0/unset — the pre-existing default posture).
+ * The round budget for a turn, clamped to the valid range, or null when the
+ * execution is unbounded (max_tool_rounds 0/unset — the default posture).
  */
-export function resolveRecursionLimit(maxToolRounds) {
+export function resolveToolRoundLimit(maxToolRounds) {
     if (!maxToolRounds || maxToolRounds <= 0) {
         return null;
     }
-    return clampToolRounds(maxToolRounds) * SUPER_STEPS_PER_ROUND;
+    return clampToolRounds(maxToolRounds);
+}
+/** The recursionLimit backstop for a bounded turn's invoke config; see {@link SUPER_STEPS_BACKSTOP_PER_ROUND}. */
+export function backstopRecursionLimit(toolRoundLimit) {
+    return toolRoundLimit * SUPER_STEPS_BACKSTOP_PER_ROUND;
 }
 function clampToolRounds(requested) {
     if (requested < MIN_TOOL_ROUNDS) {
@@ -75,13 +95,36 @@ export const TOOL_CALL_LIMIT_USER_COPY = "The agent reached the tool-call limit
     "Work completed so far has been saved. " +
     "Send another message to continue where the agent left off.";
 /**
- * Whether an error thrown out of a LangGraph run is the graph exhausting the
- * recursion limit `resolveRecursionLimit` placed on it — the budget's own
- * signal, not a failure: the adapter ends the turn `tool_call_limit`.
- * Matched by class name and message because the error class is not
- * exported on a stable path across `@langchain/langgraph` versions.
+ * The execution budget's stop: thrown by `middleware/execution-budget.ts` in
+ * place of round N+1's model call, so the graph ends on round N's tool
+ * results with no proposed call left unexecuted.
+ */
+export class ToolRoundLimitError extends Error {
+    toolRoundLimit;
+    constructor(toolRoundLimit) {
+        super(`Tool-round limit reached: ${toolRoundLimit} rounds`);
+        this.toolRoundLimit = toolRoundLimit;
+        this.name = "ToolRoundLimitError";
+    }
+}
+/**
+ * Whether an error thrown out of a LangGraph run is the tool-call budget
+ * ending the turn — the budget's own signal, not a failure: the adapter ends
+ * the turn `tool_call_limit`. Two producers, one outcome: the round count's
+ * {@link ToolRoundLimitError}, which reaches the turn wrapped in LangChain's
+ * `MiddlewareError` once per `wrapModelCall` layer (so the cause chain is
+ * walked, as `unwrapModelError` does for a model error), and the backstop's
+ * `GraphRecursionError`.
+ */
+export function isToolCallBudgetStop(err) {
+    return unwrapModelError(err) instanceof ToolRoundLimitError || isRecursionLimitError(err);
+}
+/**
+ * LangGraph exhausting the backstop recursion limit. Matched by class name and
+ * message because the error class is not exported on a stable path across
+ * `@langchain/langgraph` versions.
  */
-export function isGraphRecursionError(err) {
+function isRecursionLimitError(err) {
     if (err instanceof Error) {
         return err.constructor.name === "GraphRecursionError" ||
             err.message.includes("GraphRecursionError") ||

package/dist/shared/tool-rounds.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-rounds.js","sourceRoot":"","sources":["../../src/shared/tool-rounds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAiC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,aAAa,CAAC,GAAG,qBAAqB,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,iCAAiC,SAAS,yBAAyB;YACnE,IAAI,eAAe,IAAI,eAAe,kBAAkB,eAAe,EAAE,CAC1E,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,iCAAiC,SAAS,yBAAyB;YACnE,IAAI,eAAe,IAAI,eAAe,kBAAkB,eAAe,EAAE,CAC1E,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAEhF,6GAA6G;AAC7G,MAAM,UAAU,wBAAwB;IACtC,OAAO,GAAG,4BAA4B,sDAAsD,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,0DAA0D;IAC1D,wCAAwC;IACxC,4DAA4D,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,qBAAqB;YACnD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"tool-rounds.js","sourceRoot":"","sources":["../../src/shared/tool-rounds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,eAAe,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAiC;IACrE,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,sBAAsB,CAAC,cAAsB;IAC3D,OAAO,cAAc,GAAG,8BAA8B,CAAC;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,iCAAiC,SAAS,yBAAyB;YACnE,IAAI,eAAe,IAAI,eAAe,kBAAkB,eAAe,EAAE,CAC1E,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,IAAI,SAAS,GAAG,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,iCAAiC,SAAS,yBAAyB;YACnE,IAAI,eAAe,IAAI,eAAe,kBAAkB,eAAe,EAAE,CAC1E,CAAC;QACF,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mCAAmC,CAAC;AAEhF,6GAA6G;AAC7G,MAAM,UAAU,wBAAwB;IACtC,OAAO,GAAG,4BAA4B,sDAAsD,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,0DAA0D;IAC1D,wCAAwC;IACxC,4DAA4D,CAAC;AAE/D;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAArB,YAAqB,cAAsB;QACzC,KAAK,CAAC,6BAA6B,cAAc,SAAS,CAAC,CAAC;QADzC,mBAAc,GAAd,cAAc,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,YAAY,mBAAmB,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,qBAAqB;YACnD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/shared/workspace/platform-dir.d.ts

@@ -10,6 +10,8 @@
  *   a real repo never leaves Stigmer files behind in it (see issue #173); only
  *   a minimal, transient `.cursor/hooks.json` referencing the absolute script
  *   path is written into the workspace itself.
+ * - `displaced/` — a real `.stigmer` entry found in the workspace when the
+ *   platform link takes the name, kept rather than deleted (stigmer-link.ts).
  *
  * This module replaces the duplicated `getPlatformDir` helpers in
  * execute-cursor/skill-resolver.ts and shared/attachment-resolver.ts.
@@ -70,6 +72,19 @@ export declare function ensureCheckpointDbPath(sessionId: string): Promise<strin
  * safe to call multiple times for the same session.
  */
 export declare function ensurePlatformDir(sessionId: string): Promise<string>;
+/**
+ * Compute where a real `.stigmer` entry found in a workspace is moved when the
+ * platform link takes the name — `displaced/<stamp>` beside the session's
+ * `platform/` and `hitl/` trees (see stigmer-link.ts). Outside the workspace,
+ * so a real repo is never left holding it (issue #173) and a write-back never
+ * commits it; outside `platform/`, so the agent never reads it back as
+ * platform content.
+ *
+ * Takes the platform dir rather than a session id, unlike its siblings: the
+ * link step knows only the dir it links to, and the session dir is its parent.
+ * Pure function — performs no I/O.
+ */
+export declare function getDisplacedDir(platformDir: string, stamp: string): string;
 /**
  * Compute the HITL directory path for a session — the runner-owned home for the
  * approval gate's hook script, approval-state file, and denial ledger.

package/dist/shared/workspace/platform-dir.js

@@ -10,11 +10,13 @@
  *   a real repo never leaves Stigmer files behind in it (see issue #173); only
  *   a minimal, transient `.cursor/hooks.json` referencing the absolute script
  *   path is written into the workspace itself.
+ * - `displaced/` — a real `.stigmer` entry found in the workspace when the
+ *   platform link takes the name, kept rather than deleted (stigmer-link.ts).
  *
  * This module replaces the duplicated `getPlatformDir` helpers in
  * execute-cursor/skill-resolver.ts and shared/attachment-resolver.ts.
  */
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { createHash } from "node:crypto";
@@ -100,6 +102,21 @@ export async function ensurePlatformDir(sessionId) {
     await mkdir(dir, { recursive: true });
     return dir;
 }
+/**
+ * Compute where a real `.stigmer` entry found in a workspace is moved when the
+ * platform link takes the name — `displaced/<stamp>` beside the session's
+ * `platform/` and `hitl/` trees (see stigmer-link.ts). Outside the workspace,
+ * so a real repo is never left holding it (issue #173) and a write-back never
+ * commits it; outside `platform/`, so the agent never reads it back as
+ * platform content.
+ *
+ * Takes the platform dir rather than a session id, unlike its siblings: the
+ * link step knows only the dir it links to, and the session dir is its parent.
+ * Pure function — performs no I/O.
+ */
+export function getDisplacedDir(platformDir, stamp) {
+    return join(dirname(platformDir), "displaced", stamp);
+}
 /**
  * Compute the HITL directory path for a session — the runner-owned home for the
  * approval gate's hook script, approval-state file, and denial ledger.

package/dist/shared/workspace/platform-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform-dir.js","sourceRoot":"","sources":["../../../src/shared/workspace/platform-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,qFAAqF;AACrF,SAAS,cAAc;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"platform-dir.js","sourceRoot":"","sources":["../../../src/shared/workspace/platform-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,qFAAqF;AACrF,SAAS,cAAc;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,aAAqB;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB;IAC3D,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB;IAC5D,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB,EAAE,KAAa;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/shared/workspace/stigmer-link.d.ts

@@ -11,10 +11,10 @@
  * `.stigmer/…` paths those agents are prompted with (skill locations,
  * `.stigmer/inputs/…` attachments) actually resolve. The native harness's
  * FILE tools are the exception: their virtual-rooted backend refuses a path
- * whose real location leaves the workspace, so they read the platform dir
- * through a read-only `.stigmer/` route instead
- * (`activities/execute-deep-agent/platform-route.ts`), mounted on exactly
- * the turns this link exists ({@link stigmerSymlinkPointsAt}).
+ * whose real location leaves the workspace, so they reach `.stigmer/` through
+ * a route instead (`activities/execute-deep-agent/platform-route.ts`),
+ * mounted on every turn and exposing the platform dir on exactly the turns
+ * this link exists ({@link stigmerSymlinkPointsAt}).
  *
  * Lifecycle contract (same for both harnesses):
  * - Created per turn, under the workspace turn lock — the link is a
@@ -29,21 +29,28 @@
  * - {@link ensureStigmerSymlink} is idempotent, so multiple populaters may
  *   run in any order within a turn.
  *
- * OWNERSHIP SHARP EDGE: the platform owns the `.stigmer` name inside a
- * workspace. {@link ensureStigmerSymlink} REPLACES a real (non-symlink)
- * `.stigmer` directory it finds there — deliberate, so a directory left
- * behind by an older runner can never shadow the platform mount. (A user's
- * own `.stigmer` content is unreachable anyway: the runner's
- * `LocalWorkspaceBackend` routes every `.stigmer/…` path to the platform
- * dir.) Turn-end removal is the conservative half: it only ever removes a
- * SYMLINK.
+ * OWNERSHIP: the platform owns the `.stigmer` name inside a workspace, but
+ * never deletes what it did not make. A real (non-symlink) `.stigmer` entry
+ * found where the link goes — left by an older runner, or written by a shell
+ * command or a Cursor edit on a turn with no link, where nothing sits between
+ * those tools and the disk (#1123) — is MOVED out of the workspace to the
+ * session's `displaced/` dir (platform-dir.ts `getDisplacedDir`) and named in
+ * a warning; an empty directory is simply removed. Out of the workspace
+ * because a write-back commits everything the tree holds (`git add -A`) and
+ * git excludes only the exact `.stigmer` name. One case is refused outright:
+ * a `.stigmer` that is, or holds, the platform dir itself — a workspace
+ * rooted at the home directory, whose `.stigmer` is the Stigmer home (#1424).
+ * Turn-end removal is the conservative half: it only ever removes a SYMLINK.
  */
 /** The workspace-visible name of the platform namespace. */
 export declare const STIGMER_LOCAL_STATE_DIR = ".stigmer";
 /**
  * Ensure the workspace `.stigmer` symlink points to the platform dir.
- * Idempotent: an existing correct link is kept; a stale link (or a non-link
- * left behind by an older runner) is replaced.
+ * Idempotent: an existing correct link is kept and a stale link is
+ * re-pointed. A real entry in the link's place is moved to the session's
+ * `displaced/` dir first (an empty directory is removed); a real `.stigmer`
+ * that holds the platform dir is refused with an error naming it, before
+ * anything is touched. See the module header, OWNERSHIP.
  */
 export declare function ensureStigmerSymlink(workspaceDir: string, platformDir: string): Promise<void>;
 /**

package/dist/shared/workspace/stigmer-link.js

@@ -11,10 +11,10 @@
  * `.stigmer/…` paths those agents are prompted with (skill locations,
  * `.stigmer/inputs/…` attachments) actually resolve. The native harness's
  * FILE tools are the exception: their virtual-rooted backend refuses a path
- * whose real location leaves the workspace, so they read the platform dir
- * through a read-only `.stigmer/` route instead
- * (`activities/execute-deep-agent/platform-route.ts`), mounted on exactly
- * the turns this link exists ({@link stigmerSymlinkPointsAt}).
+ * whose real location leaves the workspace, so they reach `.stigmer/` through
+ * a route instead (`activities/execute-deep-agent/platform-route.ts`),
+ * mounted on every turn and exposing the platform dir on exactly the turns
+ * this link exists ({@link stigmerSymlinkPointsAt}).
  *
  * Lifecycle contract (same for both harnesses):
  * - Created per turn, under the workspace turn lock — the link is a
@@ -29,45 +29,107 @@
  * - {@link ensureStigmerSymlink} is idempotent, so multiple populaters may
  *   run in any order within a turn.
  *
- * OWNERSHIP SHARP EDGE: the platform owns the `.stigmer` name inside a
- * workspace. {@link ensureStigmerSymlink} REPLACES a real (non-symlink)
- * `.stigmer` directory it finds there — deliberate, so a directory left
- * behind by an older runner can never shadow the platform mount. (A user's
- * own `.stigmer` content is unreachable anyway: the runner's
- * `LocalWorkspaceBackend` routes every `.stigmer/…` path to the platform
- * dir.) Turn-end removal is the conservative half: it only ever removes a
- * SYMLINK.
+ * OWNERSHIP: the platform owns the `.stigmer` name inside a workspace, but
+ * never deletes what it did not make. A real (non-symlink) `.stigmer` entry
+ * found where the link goes — left by an older runner, or written by a shell
+ * command or a Cursor edit on a turn with no link, where nothing sits between
+ * those tools and the disk (#1123) — is MOVED out of the workspace to the
+ * session's `displaced/` dir (platform-dir.ts `getDisplacedDir`) and named in
+ * a warning; an empty directory is simply removed. Out of the workspace
+ * because a write-back commits everything the tree holds (`git add -A`) and
+ * git excludes only the exact `.stigmer` name. One case is refused outright:
+ * a `.stigmer` that is, or holds, the platform dir itself — a workspace
+ * rooted at the home directory, whose `.stigmer` is the Stigmer home (#1424).
+ * Turn-end removal is the conservative half: it only ever removes a SYMLINK.
  */
-import { symlink, readlink, unlink, rm, lstat } from "node:fs/promises";
-import { join } from "node:path";
+import { cp, lstat, mkdir, readdir, readlink, realpath, rename, rm, rmdir, symlink, unlink } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { getDisplacedDir } from "./platform-dir.js";
 /** The workspace-visible name of the platform namespace. */
 export const STIGMER_LOCAL_STATE_DIR = ".stigmer";
 /**
  * Ensure the workspace `.stigmer` symlink points to the platform dir.
- * Idempotent: an existing correct link is kept; a stale link (or a non-link
- * left behind by an older runner) is replaced.
+ * Idempotent: an existing correct link is kept and a stale link is
+ * re-pointed. A real entry in the link's place is moved to the session's
+ * `displaced/` dir first (an empty directory is removed); a real `.stigmer`
+ * that holds the platform dir is refused with an error naming it, before
+ * anything is touched. See the module header, OWNERSHIP.
  */
 export async function ensureStigmerSymlink(workspaceDir, platformDir) {
     const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
+    let entry;
     try {
-        const existing = await readlink(linkPath);
-        if (existing === platformDir)
+        entry = await lstat(linkPath);
+    }
+    catch (err) {
+        if (errnoCode(err) !== "ENOENT")
+            throw err;
+    }
+    if (entry?.isSymbolicLink()) {
+        if ((await readlink(linkPath)) === platformDir)
             return;
         await unlink(linkPath);
     }
-    catch (err) {
-        if (err.code === "ENOENT") {
-            // No existing symlink
-        }
-        else if (err.code === "EINVAL") {
-            // Exists but is not a symlink — remove the directory
-            await rm(linkPath, { recursive: true, force: true });
+    else if (entry !== undefined) {
+        await displaceRealEntry(linkPath, platformDir, entry);
+    }
+    await symlink(platformDir, linkPath, "dir");
+}
+/**
+ * Clear a real `.stigmer` entry out of the link's place without losing it:
+ * refuse the Stigmer home, remove an empty directory, move anything else.
+ */
+async function displaceRealEntry(linkPath, platformDir, entry) {
+    if (entry.isDirectory()) {
+        await refuseDirHoldingPlatform(linkPath, platformDir);
+        if ((await readdir(linkPath)).length === 0) {
+            await rmdir(linkPath);
+            return;
         }
-        else {
+    }
+    const destination = getDisplacedDir(platformDir, displacementStamp(new Date()));
+    await mkdir(dirname(destination), { recursive: true });
+    await moveEntry(linkPath, destination);
+    console.warn(`ensureStigmerSymlink: moved the real ${linkPath} out of the workspace to ${destination}; ` +
+        "the platform owns the .stigmer name, so the link to the session's platform dir takes its place");
+}
+/**
+ * Throw when the real `.stigmer` directory is, or contains, the platform dir:
+ * a workspace rooted at the home directory resolves `.stigmer` to the Stigmer
+ * home, where the platform dir, the CLI's config and every session live.
+ * Compared by real path, so a symlinked or `HOME`-overridden spelling of
+ * either side cannot slip past.
+ */
+async function refuseDirHoldingPlatform(linkPath, platformDir) {
+    const [realLink, realPlatform] = await Promise.all([realpath(linkPath), realpath(platformDir)]);
+    const fromLink = relative(realLink, realPlatform);
+    const outside = fromLink === ".." || fromLink.startsWith(`..${sep}`) || isAbsolute(fromLink);
+    if (!outside) {
+        throw new Error(`The workspace's ${linkPath} is the Stigmer home (it holds this session's platform dir, ${platformDir}); ` +
+            "use a project directory as the workspace, not the home directory");
+    }
+}
+/** Rename, or copy then remove when the destination is on another filesystem (a cloud workspace volume and `$HOME` are). */
+async function moveEntry(source, destination) {
+    try {
+        await rename(source, destination);
+    }
+    catch (err) {
+        if (errnoCode(err) !== "EXDEV")
             throw err;
-        }
+        await cp(source, destination, { recursive: true, errorOnExist: true, force: false, verbatimSymlinks: true });
+        await rm(source, { recursive: true, force: true });
     }
-    await symlink(platformDir, linkPath, "dir");
+}
+/** A compact UTC stamp with milliseconds (`20260929T101500123Z`): sortable, and free of the colons a path should not carry. */
+function displacementStamp(now) {
+    return now.toISOString().replace(/[-:.]/g, "");
+}
+/** The errno code of a Node filesystem error, or `undefined` for anything else. */
+function errnoCode(err) {
+    if (typeof err !== "object" || err === null || !("code" in err))
+        return undefined;
+    return typeof err.code === "string" ? err.code : undefined;
 }
 /**
  * Whether the workspace's `.stigmer` is, right now, the link
@@ -102,7 +164,7 @@ export async function removeStigmerSymlink(workspaceDir) {
         }
     }
     catch (err) {
-        if (err?.code !== "ENOENT") {
+        if (errnoCode(err) !== "ENOENT") {
             console.warn(`removeStigmerSymlink: failed to remove ${linkPath} (non-fatal): ` +
                 `${err instanceof Error ? err.message : err}`);
         }

package/dist/shared/workspace/stigmer-link.js.map

@@ -1 +1 @@
-{"version":3,"file":"stigmer-link.js","sourceRoot":"","sources":["../../../src/shared/workspace/stigmer-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,WAAW;YAAE,OAAO;QACrC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,sBAAsB;QACxB,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,qDAAqD;YACrD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB,EAAE,WAAmB;IACpF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CACV,0CAA0C,QAAQ,gBAAgB;gBAClE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"stigmer-link.js","sourceRoot":"","sources":["../../../src/shared/workspace/stigmer-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAErH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAE7D,IAAI,KAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAC7C,CAAC;IAED,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,WAAW;YAAE,OAAO;QACvD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,iBAAiB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,QAAgB,EAAE,WAAmB,EAAE,KAAY;IAClF,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,wBAAwB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CACV,wCAAwC,QAAQ,4BAA4B,WAAW,IAAI;QAC3F,gGAAgG,CACjG,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,wBAAwB,CAAC,QAAgB,EAAE,WAAmB;IAC3E,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,+DAA+D,WAAW,KAAK;YAC1G,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4HAA4H;AAC5H,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,WAAmB;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,OAAO;YAAE,MAAM,GAAG,CAAC;QAC1C,MAAM,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7G,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,+HAA+H;AAC/H,SAAS,iBAAiB,CAAC,GAAS;IAClC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAoB,EAAE,WAAmB;IACpF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,YAAoB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CACV,0CAA0C,QAAQ,gBAAgB;gBAClE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/tools/url-guard.d.ts

@@ -12,7 +12,11 @@
  * IPv4-mapped IPv6 is unwrapped, how every resolved address is judged) has
  * one home, `@stigmer/outbound/egress`, shared with the control plane, which
  * dials user-supplied URLs too. This module keeps what is the runner's:
- * deriving the posture from its mode, and the sentence a model reads.
+ * deriving the posture from its mode, and the sentence a model reads. What
+ * that sentence may say is the shared rule too (`refusalWithholdsResolution`):
+ * on a strict runner a name that does not resolve and one that resolves to
+ * a refused address read alike and name no address, because the runner
+ * resolves through a network its caller does not own.
  *
  * Posture is mode-aware because locality differs, not trust:
  *

package/dist/tools/url-guard.js

@@ -12,7 +12,11 @@
  * IPv4-mapped IPv6 is unwrapped, how every resolved address is judged) has
  * one home, `@stigmer/outbound/egress`, shared with the control plane, which
  * dials user-supplied URLs too. This module keeps what is the runner's:
- * deriving the posture from its mode, and the sentence a model reads.
+ * deriving the posture from its mode, and the sentence a model reads. What
+ * that sentence may say is the shared rule too (`refusalWithholdsResolution`):
+ * on a strict runner a name that does not resolve and one that resolves to
+ * a refused address read alike and name no address, because the runner
+ * resolves through a network its caller does not own.
  *
  * Posture is mode-aware because locality differs, not trust:
  *
@@ -37,7 +41,7 @@
  * The accepted DNS-rebinding limitation is stated in the shared check's
  * header.
  */
-import { checkEgress, egressPolicyForPosture, nodeLookup, blockedReason as sharedBlockedReason, } from "@stigmer/outbound/egress";
+import { checkEgress, egressPolicyForPosture, nodeLookup, refusalWithholdsResolution, blockedReason as sharedBlockedReason, } from "@stigmer/outbound/egress";
 /** Thrown for every guard rejection; message is safe to surface to the model. */
 export class UrlGuardError extends Error {
     constructor(message) {
@@ -75,6 +79,9 @@ export async function validateFetchUrl(rawUrl, posture) {
     if (check.ok)
         return check.url;
     const refusal = check.refusal;
+    if (refusalWithholdsResolution(refusal) && (refusal.kind === "unresolvable" || refusal.kind === "blocked")) {
+        throw new UrlGuardError(`Refusing to fetch ${refusal.hostname}: it does not resolve to a public address.`);
+    }
     switch (refusal.kind) {
         case "invalid-url":
             throw new UrlGuardError(`Invalid URL: ${refusal.url}`);

package/dist/tools/url-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../src/tools/url-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,aAAa,IAAI,mBAAmB,GAErC,MAAM,0BAA0B,CAAC;AAIlC,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,MAAM,IAAI,aAAa,CAAC,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,KAAK,oBAAoB;YACvB,MAAM,IAAI,aAAa,CACrB,2BAA2B,OAAO,CAAC,MAAM,sCAAsC,CAChF,CAAC;QACJ,KAAK,cAAc;YACjB,MAAM,IAAI,aAAa,CAAC,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,KAAK,SAAS;YACZ,MAAM,IAAI,aAAa,CACrB,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gDAAgD,CAC9I,CAAC;QACJ,KAAK,oBAAoB;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,IAAI,aAAa,CAAC,gCAAgC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;QACrF,KAAK,oBAAoB;YACvB,6DAA6D;YAC7D,MAAM,IAAI,aAAa,CAAC,8BAA8B,OAAO,CAAC,QAAQ,SAAS,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAqB;IAClE,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../src/tools/url-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,0BAA0B,EAC1B,aAAa,IAAI,mBAAmB,GAErC,MAAM,0BAA0B,CAAC;AAIlC,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,0BAA0B,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,aAAa,CAAC,qBAAqB,OAAO,CAAC,QAAQ,4CAA4C,CAAC,CAAC;IAC7G,CAAC;IACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,MAAM,IAAI,aAAa,CAAC,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,KAAK,oBAAoB;YACvB,MAAM,IAAI,aAAa,CACrB,2BAA2B,OAAO,CAAC,MAAM,sCAAsC,CAChF,CAAC;QACJ,KAAK,cAAc;YACjB,MAAM,IAAI,aAAa,CAAC,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,KAAK,SAAS;YACZ,MAAM,IAAI,aAAa,CACrB,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gDAAgD,CAC9I,CAAC;QACJ,KAAK,oBAAoB;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,IAAI,aAAa,CAAC,gCAAgC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;QACrF,KAAK,oBAAoB;YACvB,6DAA6D;YAC7D,MAAM,IAAI,aAAa,CAAC,8BAA8B,OAAO,CAAC,QAAQ,SAAS,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAqB;IAClE,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/worker.d.ts

@@ -11,7 +11,7 @@
  * - This TypeScript worker handles both workflow and activity tasks
  * - Activities are dispatched by name within the same queue
  */
-import { Worker } from "@temporalio/worker";
+import { NativeConnection, Worker } from "@temporalio/worker";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
 export interface WorkerActivities {
@@ -23,4 +23,13 @@ export interface StartWorkerOptions {
     /** Ordered codec chain from createPayloadCodecs (order is load-bearing). */
     payloadCodecs?: PayloadCodec[];
 }
-export declare function startWorker(opts: StartWorkerOptions): Promise<Worker>;
+/**
+ * The worker and the connection it polls on. The caller owns both: it runs
+ * and shuts down the worker, then closes the connection once `run()` has
+ * resolved (the SDK refuses to close a connection a worker still holds).
+ */
+export interface StartedWorker {
+    readonly worker: Worker;
+    readonly connection: NativeConnection;
+}
+export declare function startWorker(opts: StartWorkerOptions): Promise<StartedWorker>;

package/dist/worker.js

@@ -71,6 +71,6 @@ export async function startWorker(opts) {
             ...(workflowInterceptorModules.length > 0 ? { workflowModules: workflowInterceptorModules } : {}),
         },
     });
-    return worker;
+    return { worker, connection };
 }
 //# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAwD,MAAM,oBAAoB,CAAC;AAGpH,OAAO,EACL,qBAAqB,EACrB,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAa7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,GAAG,MAAM,CAAC,kBAAkB;KAC7B,CAAC,CAAC;IAEH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAE/F,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAE/C,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,uDAAuD;IACvD,sEAAsE;IACtE,MAAM,oBAAoB,GAAkC,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAuB,EAAE,GAAG,0BAA0B,EAAE,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAC9B,cAAc,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC5C,MAAM,EACJ,uCAAuC,EACvC,oBAAoB,GACrB,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACtF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE5E,oBAAoB,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;SAC7C,CAAC,CAAC;QACH,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAe,EAAE,QAAe,CAAkC,CAAC;QAC1G,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,0EAA0E;QAC1E,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU;QACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,UAAU;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE;YAC3D,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;QACnE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG;KACF,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAwD,MAAM,oBAAoB,CAAC;AAGpH,OAAO,EACL,qBAAqB,EACrB,sCAAsC,EACtC,gCAAgC,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2CAA2C,CAAC;AAuB7F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IAEnD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAChD,OAAO,EAAE,MAAM,CAAC,eAAe;QAC/B,GAAG,MAAM,CAAC,kBAAkB;KAC7B,CAAC,CAAC;IAEH,MAAM,EAAE,0BAA0B,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;IAE/F,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAE/C,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,uDAAuD;IACvD,sEAAsE;IACtE,MAAM,oBAAoB,GAAkC,CAAC,gCAAgC,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAuB,EAAE,GAAG,0BAA0B,EAAE,EAAE,CAAC;IACpE,MAAM,0BAA0B,GAC9B,cAAc,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC;QAC5C,MAAM,EACJ,uCAAuC,EACvC,oBAAoB,GACrB,GAAG,MAAM,MAAM,CAAC,wCAAwC,CAAC,CAAC;QAC3D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACtF,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE5E,oBAAoB,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,uCAAuC,CAAC,GAAG,CAAC,EAAE,CAAC,CACzE,CAAC;QAEF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B;SAC7C,CAAC,CAAC;QACH,iEAAiE;QACjE,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,SAAS,GAAG,oBAAoB,CAAC,QAAe,EAAE,QAAe,CAAkC,CAAC;QAC1G,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC;QAEnC,0EAA0E;QAC1E,sEAAsE;QACtE,6CAA6C;QAC7C,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,0BAA0B,CAAC,IAAI,CAC7B,UAAU,CAAC,OAAO,CAAC,gCAAgC,CAAC,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QACjC,UAAU;QACV,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,UAAU;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE;YAC3D,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,aAAa,EAAE,CAAC;QACpD,mCAAmC,EAAE,MAAM,CAAC,uBAAuB;QACnE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;QACpE,KAAK;QACL,YAAY,EAAE;YACZ,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClG;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/workflow-engine/tasks/human-input.d.ts

@@ -32,8 +32,24 @@
  * activation and attached to the approval_requested event — inline when
  * small, as an artifact reference when at/above the promotion threshold —
  * so the approval record captures exactly what the reviewer saw.
+ *
+ * Timeout policy lives here, whole. `ctx.awaitHumanInput()` only reports
+ * that the timer won; this module decides what that means. approve, deny and
+ * escalate resolve the gate to a declared outcome. fail logs an
+ * approval_resolved with `auto_resolved` set and no outcome, then fails the
+ * task with the error it has always raised, so every approval_requested in
+ * the event log is closed by an approval_resolved (stigmer/stigmer#1442).
+ * That emit is a new workflow command on an existing path, so it runs behind
+ * {@link HUMAN_INPUT_FAIL_TIMEOUT_RESOLVED_PATCH}: a history recorded before
+ * it replays the old order (no emit, then the throw).
  */
 import type { HumanInputTaskDef, WorkflowState, TaskExecutionContext } from "../types.js";
+/**
+ * Temporal patch id for logging approval_resolved before a fail-policy
+ * timeout fails the task. Wire bytes: a rename makes every history that
+ * carries the marker replay down the old path.
+ */
+export declare const HUMAN_INPUT_FAIL_TIMEOUT_RESOLVED_PATCH = "human-input-fail-timeout-resolved";
 /**
  * Executes a human_input task. Called from `runSingleTask` in do-executor
  * when the task kind is "human_input".