feat(forwarder): make checkpoint recovery idempotent

Preserve interrupted provider output, keep checkpoint projections deterministic, and enforce proto snapshot synchronization.

proto/check_proto_sync.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/cursor-proto-sync.XXXXXX")"
+
+cleanup() {
+  rm -rf "$TEMP_DIR"
+}
+trap cleanup EXIT
+
+for PROTO_NAME in agent_v1.proto aiserver_v1.proto; do
+  ROOT_PROTO="$SCRIPT_DIR/$PROTO_NAME"
+  EXTRACTED_PROTO="$SCRIPT_DIR/from_extensions/$PROTO_NAME"
+  if [[ ! -f "$ROOT_PROTO" || ! -f "$EXTRACTED_PROTO" ]]; then
+    echo "Missing proto pair for $PROTO_NAME" >&2
+    exit 1
+  fi
+
+  sed -E 's|^option go_package = ".*";$|option go_package = "__NORMALIZED__";|' "$ROOT_PROTO" > "$TEMP_DIR/root-$PROTO_NAME"
+  sed -E 's|^option go_package = ".*";$|option go_package = "__NORMALIZED__";|' "$EXTRACTED_PROTO" > "$TEMP_DIR/extracted-$PROTO_NAME"
+  if ! cmp -s "$TEMP_DIR/root-$PROTO_NAME" "$TEMP_DIR/extracted-$PROTO_NAME"; then
+    echo "Proto snapshot is out of sync: $PROTO_NAME" >&2
+    diff -u "$TEMP_DIR/root-$PROTO_NAME" "$TEMP_DIR/extracted-$PROTO_NAME" >&2 || true
+    exit 1
+  fi
+done

proto/extract_extensions_proto.sh

@@ -9,6 +9,23 @@ OUTPUT_DEFAULT="$SCRIPT_DIR/from_extensions"
 INPUT_PATH="${1:-$INPUT_DEFAULT}"
 OUTPUT_DIR="${2:-$OUTPUT_DEFAULT}"
 
+canonicalize_path() {
+  local path="$1"
+  local parent
+  local base
+  if [[ -d "$path" ]]; then
+    (cd "$path" && pwd -P)
+    return
+  fi
+  parent="$(dirname "$path")"
+  base="$(basename "$path")"
+  if [[ ! -d "$parent" ]]; then
+    echo "Parent directory does not exist: $parent" >&2
+    return 1
+  fi
+  printf '%s/%s\n' "$(cd "$parent" && pwd -P)" "$base"
+}
+
 # Resolve input: accept either a single JS file or an extensions root directory.
 if [[ -d "$INPUT_PATH" ]]; then
   CANDIDATES=(
@@ -26,7 +43,10 @@ if [[ -d "$INPUT_PATH" ]]; then
   if [[ -n "$FOUND_CANDIDATE" ]]; then
     INPUT_PATH="$FOUND_CANDIDATE"
   else
-    mapfile -t JS_FILES < <(find "$INPUT_PATH" -type f -path "*/dist/main.js" | sort)
+    JS_FILES=()
+    while IFS= read -r JS_FILE; do
+      JS_FILES+=("$JS_FILE")
+    done < <(find "$INPUT_PATH" -type f -path "*/dist/main.js" | sort)
     if [[ ${#JS_FILES[@]} -eq 1 ]]; then
       INPUT_PATH="${JS_FILES[0]}"
     elif [[ ${#JS_FILES[@]} -eq 0 ]]; then
@@ -48,11 +68,57 @@ if [[ ! -f "$INPUT_PATH" ]]; then
   exit 1
 fi
 
-rm -rf "$OUTPUT_DIR"
-mkdir -p "$OUTPUT_DIR"
+INPUT_PATH="$(canonicalize_path "$INPUT_PATH")"
+OUTPUT_DIR="$(canonicalize_path "$OUTPUT_DIR")"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+CURRENT_DIR="$(pwd -P)"
+
+case "$OUTPUT_DIR" in
+  "/"|"$HOME"|"$REPO_ROOT"|"$SCRIPT_DIR"|"$CURRENT_DIR")
+    echo "Refusing unsafe output directory: $OUTPUT_DIR" >&2
+    exit 1
+    ;;
+esac
+case "$INPUT_PATH" in
+  "$OUTPUT_DIR"|"$OUTPUT_DIR"/*)
+    echo "Refusing output directory that contains the input bundle: $OUTPUT_DIR" >&2
+    exit 1
+    ;;
+esac
+
+OUTPUT_PARENT="$(dirname "$OUTPUT_DIR")"
+OUTPUT_BASENAME="$(basename "$OUTPUT_DIR")"
+TEMP_DIR="$(mktemp -d "$OUTPUT_PARENT/.${OUTPUT_BASENAME}.tmp.XXXXXX")"
+BACKUP_DIR=""
+
+cleanup() {
+  if [[ -n "$TEMP_DIR" && -d "$TEMP_DIR" ]]; then
+    rm -rf "$TEMP_DIR"
+  fi
+  if [[ -n "$BACKUP_DIR" && -e "$BACKUP_DIR" ]]; then
+    if [[ ! -e "$OUTPUT_DIR" ]]; then
+      mv "$BACKUP_DIR" "$OUTPUT_DIR"
+    else
+      rm -rf "$BACKUP_DIR"
+    fi
+  fi
+}
+trap cleanup EXIT
 
 go run "$SCRIPT_DIR/ext_tool" \
   -input "$INPUT_PATH" \
-  -output "$OUTPUT_DIR" \
+  -output "$TEMP_DIR" \
   -skip-format \
   -strict
+
+if [[ -e "$OUTPUT_DIR" ]]; then
+  BACKUP_DIR="$(mktemp -d "$OUTPUT_PARENT/.${OUTPUT_BASENAME}.backup.XXXXXX")"
+  rmdir "$BACKUP_DIR"
+  mv "$OUTPUT_DIR" "$BACKUP_DIR"
+fi
+mv "$TEMP_DIR" "$OUTPUT_DIR"
+TEMP_DIR=""
+if [[ -n "$BACKUP_DIR" ]]; then
+  rm -rf "$BACKUP_DIR"
+  BACKUP_DIR=""
+fi