fix: keep task completion, cancel, pause, and undo honest

Pending earlier-revision jobs no longer skip completion repair; late
cancels preserve real exits; begin clears pause; partial undo keeps
snapshots; permissions and worktree failure paths are hardened.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/agent_loop.c

@@ -979,7 +979,20 @@ static void sandbox_escalate(turn_t *t, cst_tool_ctx_t *ctx,
     cst_perms_allow_tool(a->perms, c->name);
   }
   hook_status(t, "rerunning outside the sandbox");
-  if (a->cancel || !cst_runtime_check(a->cfg.runtime, t->revision, 1, 0)) return;
+  if (a->cancel || !cst_runtime_check(a->cfg.runtime, t->revision, 1, 0)) {
+    const char *note =
+        "\n[cst: the user allowed rerunning outside the sandbox, but the "
+        "task was cancelled or its instructions changed before the "
+        "rerun; sandbox output above is unchanged]\n";
+    cst_buf_t b = {0};
+    if (tr->out)
+      cst_buf_append(&b, tr->out, tr->out_len);
+    cst_buf_puts(&b, note);
+    free(tr->out);
+    tr->out_len = b.len;
+    tr->out = cst_buf_steal(&b);
+    return;
+  }
   cst_tool_result_free(tr);
   memset(tr, 0, sizeof(*tr));
   ctx->sandbox = 0;
@@ -3200,15 +3213,34 @@ static int run_turn_once(cst_agent_t *a, const char *user_text,
       }
       if (!a->cfg.depth && a->cfg.tool_profile != CST_TOOLS_MINIMAL) {
         char why[256];
-        if (cst_runtime_jobs_pending(a->cfg.runtime))
-          cst_runtime_finish(a->cfg.runtime, "partial", "Earlier-revision jobs remain active; inspect task_state for their outcomes.", 0, why, sizeof(why));
-        if (cst_runtime_finish(a->cfg.runtime, "completed", body, tools_ran, why, sizeof(why))) {
+        /* Do not pre-mark partial before finish(completed): that made the
+         * intentional no-op (already partial → return 0) look like success and
+         * skipped the one-shot completion repair. Pending earlier-revision
+         * jobs fail completed with an explicit reason instead. */
+        if (cst_runtime_jobs_pending(a->cfg.runtime)) {
+          snprintf(why, sizeof(why),
+                   "Earlier-revision jobs remain active; inspect task_state "
+                   "for their outcomes.");
           if (!completion_repairs++) {
             append_reply(&t, body, NULL, meta_json("progress", proto));
-            append_msg(a, CST_ROLE_USER, why, NULL, NULL, NULL, meta_json("completion_repair", proto));
-            turn_free(&t); continue;
+            append_msg(a, CST_ROLE_USER, why, NULL, NULL, NULL,
+                       meta_json("completion_repair", proto));
+            turn_free(&t);
+            continue;
           }
-          cst_runtime_finish(a->cfg.runtime, "partial", body, 0, why, sizeof(why));
+          cst_runtime_finish(a->cfg.runtime, "partial", body, 0, why,
+                             sizeof(why));
+        } else if (cst_runtime_finish(a->cfg.runtime, "completed", body,
+                                      tools_ran, why, sizeof(why))) {
+          if (!completion_repairs++) {
+            append_reply(&t, body, NULL, meta_json("progress", proto));
+            append_msg(a, CST_ROLE_USER, why, NULL, NULL, NULL,
+                       meta_json("completion_repair", proto));
+            turn_free(&t);
+            continue;
+          }
+          cst_runtime_finish(a->cfg.runtime, "partial", body, 0, why,
+                             sizeof(why));
         }
       }
       append_reply(&t, body, NULL, meta_json(NULL, proto));

src/permissions.c

@@ -83,12 +83,21 @@ static int save(const cst_perms_t *p) {
   cJSON_Delete(root);
   if (!txt)
     return -1;
-  FILE *fp = fopen(p->path, "wb");
+  char tmp[OS_PATH_MAX + 8];
+  if (snprintf(tmp, sizeof(tmp), "%s.tmp", p->path) >= (int)sizeof(tmp)) {
+    free(txt);
+    return -1;
+  }
+  FILE *fp = fopen(tmp, "wb");
   int rc = -1;
   if (fp) {
     rc = fputs(txt, fp) >= 0 && fputs("\n", fp) >= 0 ? 0 : -1;
     if (fclose(fp) != 0)
       rc = -1;
+    if (rc == 0)
+      rc = os_rename_replace(tmp, p->path);
+    if (rc != 0)
+      remove(tmp);
   }
   free(txt);
   return rc;

src/runtime.c

@@ -184,6 +184,9 @@ unsigned long cst_runtime_begin(cst_runtime_t *r, const char *goal) {
   if (!r) return 0;
   pthread_mutex_lock(&r->mu);
   r->revision++; r->evidence = r->failures = r->mutations = r->last_failure = 0;
+  /* A new user turn clears pause: pause is a control for the previous turn,
+   * not a sticky lock across messages (resume is still available mid-turn). */
+  r->paused = 0;
   replace(&r->goal, goal); replace(&r->summary, ""); r->cause[0] = 0;
   snprintf(r->status, sizeof(r->status), "running");
   event_locked(r, "task_started", ""); save_locked(r);
@@ -318,10 +321,16 @@ static void *job_main(void *p) {
   if (!cancelled) { os_set_cancel_flag(&j->cancel); os_set_output_observer(&observer); rc = j->run(j->data, &j->cancel, &result); os_set_output_observer(NULL); os_set_cancel_flag(NULL); }
   if (j->destroy) j->destroy(j->data);
   pthread_mutex_lock(&r->mu);
-  /* A cancellation request arriving after a successful side effect must not
-   * rewrite that success into "cancelled". Keep the request source separately. */
-  j->exit_code = cancelled ? 130 : rc ? (j->cancel ? 130 : 1) : result.exit_code;
-  if (j->cancel && j->exit_code != 0) j->exit_code = 130;
+  /* Cancellation before/during the run yields 130. A cancel that arrives
+   * after the run returns must not rewrite a real exit: success stays
+   * completed, and a failed command stays failed (cause still records the
+   * cancel source). */
+  if (cancelled)
+    j->exit_code = 130;
+  else if (rc)
+    j->exit_code = j->cancel ? 130 : 1;
+  else
+    j->exit_code = result.exit_code;
   if (j->revision == r->revision) r->last_failure = j->exit_code != 0;
   j->output = result.out ? result.out : strdup(""); result.out = NULL;
   char artifact[OS_PATH_MAX + 64]; snprintf(artifact, sizeof(artifact), "%s.%s", r->path, j->id);
@@ -445,7 +454,10 @@ int cst_runtime_shell(const cst_tool_ctx_t *ctx, const ctl_tool_call_t *c, cst_t
       free(out->out); out->out = strdup(cfg->runtime->jobs[i].output); break;
     }
     pthread_mutex_unlock(&cfg->runtime->mu);
-    out->exit_code = cJSON_GetObjectItemCaseSensitive(j, "exit_code")->valueint;
+    {
+      const cJSON *ex = cJSON_GetObjectItemCaseSensitive(j, "exit_code");
+      out->exit_code = cJSON_IsNumber(ex) ? ex->valueint : 1;
+    }
     free(text);
   } else { out->out = text; out->exit_code = 0; }
   cJSON_Delete(j); out->out_len = out->out ? strlen(out->out) : 0; return 0;

src/undo.c

@@ -269,7 +269,10 @@ int cst_undo_restore_last(const char *ws, const char *sid, char *report,
     }
     fclose(fp);
   }
-  rm_dir(dir);
+  /* Keep the snapshot if anything failed so /undo can be retried; only
+   * drop it when every targeted file was handled. */
+  if (!failed)
+    rm_dir(dir);
   if (!rep.buf)
     cst_buf_puts(&rep, "nothing changed\n");
   snprintf(report, report_sz, "%s", rep.buf);

src/worktree.c

@@ -87,7 +87,14 @@ int cst_worktree_create(const char *ws, const char *files, char *out, size_t n,
   if (code) { snprintf(err, en, "git worktree add failed"); pthread_mutex_unlock(&git_mu); return -1; }
   snprintf(meta, sizeof(meta), "%s.scope.json", out);
   FILE *f = fopen(meta, "wb"); if (f) { fputs(files, f); fclose(f); }
-  pthread_mutex_unlock(&git_mu); return f ? 0 : -1;
+  if (!f) {
+    cst_buf_puts(&cmd, "git worktree remove --force "); quote(&cmd, out);
+    free(run(ws, &cmd, &code));
+    snprintf(err, en, "cannot write worktree scope manifest");
+    pthread_mutex_unlock(&git_mu);
+    return -1;
+  }
+  pthread_mutex_unlock(&git_mu); return 0;
 }
 char *cst_worktree_diff(const char *ws, const char *wt, int integrate, int *code) {
   char prefix[OS_PATH_MAX], meta[OS_PATH_MAX + 16];