Merge commit 'abad2bd0d' into codex/runner-copilot-acp

* commit 'abad2bd0d':
  Bind Daytona image identity to Cursor isolation patch

tests/runner-e2e/daytona-image-content.ts

@@ -40,6 +40,7 @@ export const DAYTONA_IMAGE_INPUT_PATHS = [
   "packages/paperclip-runner/scripts/build-copilot-distribution.mjs",
   "packages/paperclip-runner/scripts/materialize-copilot-binary.mjs",
   "packages/paperclip-runner/scripts/materialize-cursor-distribution.mjs",
+  "packages/paperclip-runner/scripts/cursor-runtime-patch.mjs",
   "packages/paperclip-runner/scripts/build-verified-provider-entrypoints.mjs",
   "packages/paperclip-runner/scripts/generate-acpx-sidecar-contract.mjs",
   "packages/paperclip-runner/scripts/generate-protocol-schema-module.mjs",

tests/runner-e2e/daytona-image.test.ts

@@ -203,6 +203,7 @@ describe("runner E2E Daytona image contract", () => {
       "packages/paperclip-runner/scripts/build-copilot-distribution.mjs",
       "packages/paperclip-runner/scripts/materialize-copilot-binary.mjs",
       "packages/paperclip-runner/scripts/materialize-cursor-distribution.mjs",
+      "packages/paperclip-runner/scripts/cursor-runtime-patch.mjs",
       "packages/paperclip-runner/cursor-distributions.json",
       "packages/paperclip-runner/runner/crates",
       "packages/paperclip-runner/src",
@@ -333,6 +334,28 @@ describe("runner E2E Daytona image contract", () => {
     }
   });
 
+  it("invalidates the image when the Cursor runtime isolation patch changes", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "paperclip-cursor-image-id-"));
+    const patchPath = "packages/paperclip-runner/scripts/cursor-runtime-patch.mjs";
+    expect(DAYTONA_IMAGE_INPUT_PATHS).toContain(patchPath);
+    const options = {
+      repositoryRoot: root,
+      inputPaths: [patchPath],
+      baseImages: [`example.test/base:1@sha256:${"a".repeat(64)}`],
+      frontendDigest: `sha256:${"c".repeat(64)}`,
+      candidateProviders: ["cursor"],
+    } as const;
+    try {
+      await mkdir(path.dirname(path.join(root, patchPath)), { recursive: true });
+      await writeFile(path.join(root, patchPath), "export const policy = 'one';\n");
+      const baseline = await computeDaytonaImageContentId(options);
+      await writeFile(path.join(root, patchPath), "export const policy = 'two';\n");
+      expect(await computeDaytonaImageContentId(options)).not.toBe(baseline);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it("reuses the image for runner-only tests and documentation", async () => {
     const root = await mkdtemp(
       path.join(tmpdir(), "paperclip-daytona-runner-development-inputs-"),