@stigmer/runner 3.0.9-dev.20260616060535 → 3.1.0

package/src/activities/execute-deep-agent/__tests__/cas-capture-observer.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { CasCaptureObserver } from "../cas-capture-observer.js";
+import { CasCaptureFilesystemBackend } from "../cas-capture-backend.js";
+
+/**
+ * The observer is the single, shared owner of one turn's CAS-capture state. It
+ * records the PRE-TURN bytes of first-touched gitignored paths (gate-independently,
+ * at the mutation point) and the gitignored paths the gate hard-blocked as
+ * secret-like. These tests assert the recording contract — only gitignored paths,
+ * only the first touch, never a post-write baseline — AND the cross-instance
+ * guarantee that makes sub-agent capture safe: the parent and every sub-agent
+ * backend share ONE observer, so first-touch-wins holds even when concurrent
+ * graphs touch the same path (Session 26, DD-19).
+ */
+describe("CasCaptureObserver", () => {
+  let root: string;
+
+  /** Paths under `ignored/` are gitignored; everything else is git-tracked. */
+  const ignoredPredicate = (relPath: string): boolean => relPath.startsWith("ignored/");
+
+  function makeObserver(isIgnored = async (p: string) => ignoredPredicate(p)): CasCaptureObserver {
+    return new CasCaptureObserver({ rootDir: root, isIgnored });
+  }
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "cas-observer-"));
+    await mkdir(join(root, "ignored"), { recursive: true });
+    await mkdir(join(root, "src"), { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  describe("recordBefore", () => {
+    it("records before=null for a not-yet-existing gitignored path (an ADD)", async () => {
+      const observer = makeObserver();
+
+      await observer.recordBefore("ignored/new.txt");
+
+      expect(observer.before.has("ignored/new.txt")).toBe(true);
+      expect(observer.before.get("ignored/new.txt")).toBeNull();
+    });
+
+    it("records the pre-turn bytes for an existing gitignored file (a MODIFY)", async () => {
+      await writeFile(join(root, "ignored/cfg.txt"), "v0");
+      const observer = makeObserver();
+
+      await observer.recordBefore("ignored/cfg.txt");
+
+      const before = observer.before.get("ignored/cfg.txt");
+      expect(before).not.toBeNull();
+      expect(Buffer.from(before!).toString("utf8")).toBe("v0");
+    });
+
+    it("first-touch-wins: a later touch does not overwrite the recorded baseline", async () => {
+      await writeFile(join(root, "ignored/log.txt"), "a");
+      const observer = makeObserver();
+
+      await observer.recordBefore("ignored/log.txt");
+      // Simulate the file changing mid-turn, then a second mutation touches it.
+      await writeFile(join(root, "ignored/log.txt"), "b");
+      await observer.recordBefore("ignored/log.txt");
+
+      expect(Buffer.from(observer.before.get("ignored/log.txt")!).toString("utf8")).toBe("a");
+    });
+
+    it("does NOT record git-tracked paths (the boundary git diff owns those)", async () => {
+      const observer = makeObserver();
+
+      await observer.recordBefore("src/app.ts");
+
+      expect(observer.before.has("src/app.ts")).toBe(false);
+      expect(observer.before.size).toBe(0);
+    });
+
+    it("normalizes virtual-root ('/'-prefixed) paths to workspace-relative keys", async () => {
+      const observer = makeObserver();
+
+      await observer.recordBefore("/ignored/rooted.txt");
+
+      expect(observer.before.has("ignored/rooted.txt")).toBe(true);
+    });
+
+    it("memoizes the gitignore classification (one check per distinct path)", async () => {
+      const isIgnored = vi.fn(async (p: string) => ignoredPredicate(p));
+      const observer = makeObserver(isIgnored);
+
+      await observer.recordBefore("ignored/a.txt");
+      await observer.recordBefore("ignored/a.txt");
+      await observer.recordBefore("ignored/b.txt");
+
+      expect(isIgnored).toHaveBeenCalledTimes(2); // a.txt once, b.txt once
+    });
+  });
+
+  describe("recordBlockedSecret", () => {
+    it("resolves the raw path to a workspace-relative key and dedupes", () => {
+      const observer = makeObserver();
+
+      observer.recordBlockedSecret("/ignored/.env");
+      observer.recordBlockedSecret("ignored/.env");
+
+      expect([...observer.blockedSecretPaths]).toEqual(["ignored/.env"]);
+    });
+
+    it("blockedSecretPaths is empty until something is recorded", () => {
+      expect([...makeObserver().blockedSecretPaths]).toEqual([]);
+    });
+  });
+
+  describe("shared across backends (cross-instance first-touch)", () => {
+    /** Two backends on the SAME observer — the parent + sub-agent shape. */
+    function twoBackends(observer: CasCaptureObserver): [CasCaptureFilesystemBackend, CasCaptureFilesystemBackend] {
+      return [
+        new CasCaptureFilesystemBackend({ rootDir: root }, { observer }),
+        new CasCaptureFilesystemBackend({ rootDir: root }, { observer }),
+      ];
+    }
+
+    it("a write through either backend feeds the one shared before-map", async () => {
+      const observer = makeObserver();
+      const [parent, sub] = twoBackends(observer);
+
+      await parent.write("ignored/from-parent.txt", "p");
+      await sub.write("ignored/from-sub.txt", "s");
+
+      expect(observer.before.get("ignored/from-parent.txt")).toBeNull();
+      expect(observer.before.get("ignored/from-sub.txt")).toBeNull();
+    });
+
+    it("keeps the first backend's pre-turn baseline when a second backend touches the same path", async () => {
+      await writeFile(join(root, "ignored/shared.txt"), "orig");
+      const observer = makeObserver();
+      const [parent, sub] = twoBackends(observer);
+
+      await parent.edit("ignored/shared.txt", "orig", "parent");
+      await sub.edit("ignored/shared.txt", "parent", "sub");
+
+      expect(Buffer.from(observer.before.get("ignored/shared.txt")!).toString("utf8")).toBe("orig");
+    });
+
+    it("under CONCURRENT writes from two backends to one path, records the pre-turn baseline exactly once", async () => {
+      await writeFile(join(root, "ignored/race.txt"), "orig");
+      const observer = makeObserver();
+      const [a, b] = twoBackends(observer);
+
+      // The synchronous shared reservation must ensure only the pre-turn bytes
+      // are recorded — never a post-write value — even across backend instances
+      // with separate identities (the sub-agent concurrency case).
+      await Promise.allSettled([
+        a.edit("ignored/race.txt", "orig", "A"),
+        b.edit("ignored/race.txt", "orig", "B"),
+      ]);
+
+      expect(observer.before.size).toBe(1);
+      expect(Buffer.from(observer.before.get("ignored/race.txt")!).toString("utf8")).toBe("orig");
+    });
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl-integration.test.ts

@@ -41,10 +41,11 @@ describe("HITL approval integration", () => {
             mcpServerSlug: "my-server",
             requiresApproval: true,
             approvalMessage: "Execute dangerous_tool",
+            source: "classifier_default",
           }],
         ]),
         toolServerMap: new Map([["dangerous_tool", "my-server"]]),
-        autoApproveAll: false,
+        globalBypass: false,
       });
 
       sb.processEvent({
@@ -83,7 +84,7 @@ describe("HITL approval integration", () => {
       sb.setApprovalProvider({
         policies: new Map(),
         toolServerMap: new Map([["safe_tool", "my-server"]]),
-        autoApproveAll: false,
+        globalBypass: false,
       });
 
       sb.processEvent({
@@ -110,7 +111,7 @@ describe("HITL approval integration", () => {
       expect(tc?.requiresApproval).toBe(false);
     });
 
-    it("does NOT set WAITING_FOR_APPROVAL when autoApproveAll", () => {
+    it("does NOT set WAITING_FOR_APPROVAL under the global bypass", () => {
       const status = create(AgentExecutionStatusSchema, {});
       const sb = new StatusBuilder("exec-3", status);
 
@@ -121,10 +122,11 @@ describe("HITL approval integration", () => {
             mcpServerSlug: "srv",
             requiresApproval: true,
             approvalMessage: "msg",
+            source: "classifier_default",
           }],
         ]),
         toolServerMap: new Map([["tool", "srv"]]),
-        autoApproveAll: true,
+        globalBypass: true,
       });
 
       sb.processEvent({
@@ -159,10 +161,11 @@ describe("HITL approval integration", () => {
             mcpServerSlug: "srv",
             requiresApproval: true,
             approvalMessage: "Run tool_x",
+            source: "classifier_default",
           }],
         ]),
         toolServerMap: new Map([["tool_x", "srv"]]),
-        autoApproveAll: false,
+        globalBypass: false,
       });
 
       sb.processEvent({

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -0,0 +1,342 @@
+/**
+ * Diagnostic regression test (triangulation — RUNNER boundary).
+ *
+ * Reproduces the user-reported scenario exactly: a gated `getAppState` call
+ * (open-computer-use MCP) is approved with APPROVE_ALL, which leases the whole
+ * server so the resume runs `getAppState` AND every following computer-use tool
+ * to completion in ONE durable-checkpoint resume — no further interrupts.
+ *
+ * The reported symptom is that the LEADING thinking block and the FIRST tool
+ * call (`getAppState`) vanish from the transcript after approve-all, while the
+ * later auto-executed tools remain. This test pins what the RUNNER persists at
+ * its single gRPC chokepoint (`updateStatus`). If the runner is faithful, the
+ * final status it sends must be a SUPERSET of run-1's transcript: the leading
+ * thinking block survives, the gated tool call is reconciled in place (exactly
+ * one copy, now COMPLETED), and the leased follow-up tool is appended.
+ *
+ * Models the cloud path deterministically, mirroring hitl-resume-history.test.ts:
+ *   - the persisted execution already holds the run-1 transcript
+ *     (THINKING + AI(getAppState WAITING_APPROVAL, approvalAction=APPROVE_ALL));
+ *   - the durable checkpoint exists (getState reports prior values + a pending
+ *     interrupt), so streamEvents re-emits ONLY post-interrupt events;
+ *   - the lease drops open-computer-use from the policy map, so the follow-up
+ *     `click` is NOT re-gated (its key is absent from approvalPolicies) and the
+ *     resume reaches a terminal COMPLETED phase.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
+import { create, clone } from "@bufbuild/protobuf";
+import {
+  AgentExecutionStatusSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  ApprovalAction,
+  ExecutionPhase,
+  MessageType,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { V3ProtocolEvent } from "../v3-event-recorder.js";
+import type { Config } from "../../../config.js";
+import type { SetupResult } from "../setup.js";
+
+// The Temporal activity context is unavailable outside a worker.
+vi.mock("@temporalio/activity", () => ({
+  Context: {
+    current: () => ({
+      cancellationSignal: { aborted: false },
+      heartbeat: vi.fn(),
+    }),
+  },
+  CancelledFailure: class CancelledFailure extends Error {},
+}));
+
+vi.mock("../../../idle-watchdog.js", () => ({
+  activityStarted: vi.fn(),
+  activityFinished: vi.fn(),
+}));
+
+// Capture every persisted status (the gRPC chokepoint) for assertions.
+const { persistedStatuses } = vi.hoisted(() => ({
+  persistedStatuses: [] as AgentExecutionStatus[],
+}));
+
+vi.mock("../../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(() => ({
+    updateStatus: vi.fn(async (_id: string, status: AgentExecutionStatus) => {
+      // Snapshot point-in-time: persistStatus mutates the same object in place.
+      persistedStatuses.push(clone(AgentExecutionStatusSchema, status));
+      return { signal: 0 };
+    }),
+    getExecution: vi.fn(),
+  })),
+}));
+
+// performSetup is mocked per-test to return a fake durable-resume SetupResult.
+vi.mock("../setup.js", () => ({ performSetup: vi.fn() }));
+
+import { createDeepAgentActivities } from "../index.js";
+import { performSetup } from "../setup.js";
+
+const MCP_SLUG = "open-computer-use";
+const GATED_TOOL_CALL_ID = "toolu_getappstate_01";
+const LEASED_TOOL_CALL_ID = "toolu_click_01";
+const THINKING_TEXT = "Let me capture the current app state before clicking anything.";
+const PRE_RESUME_AI_TEXT = "I'll capture the app state first.";
+const POST_RESUME_AI_TEXT = "Captured the app state and clicked the element.";
+
+function v3Event(
+  seq: number,
+  method: string,
+  data: unknown,
+  namespace: string[] = [],
+): V3ProtocolEvent {
+  return {
+    type: "event",
+    seq,
+    method,
+    params: { namespace, timestamp: Date.now(), data },
+  };
+}
+
+function toolMessageOutput(content: string, toolCallId: string): unknown {
+  return {
+    lc: 1,
+    type: "constructor",
+    id: ["langchain_core", "messages", "ToolMessage"],
+    kwargs: { content, tool_call_id: toolCallId },
+  };
+}
+
+/**
+ * The events a durable resume re-emits after APPROVE_ALL: the gated tool
+ * executes (reconciled in place), then the leased follow-up tool auto-runs,
+ * then the assistant produces a final turn. No interrupts — the lease dropped
+ * open-computer-use from the policy map.
+ */
+function resumeEvents(): V3ProtocolEvent[] {
+  return [
+    // 1. Gated getAppState now runs (reconciled to the seeded WAITING call).
+    v3Event(0, "tools", {
+      event: "tool-started",
+      tool_call_id: GATED_TOOL_CALL_ID,
+      tool_name: "getAppState",
+      input: {},
+    }, [`tools:${GATED_TOOL_CALL_ID}`]),
+    v3Event(1, "tools", {
+      event: "tool-finished",
+      tool_call_id: GATED_TOOL_CALL_ID,
+      output: toolMessageOutput("app-state-captured: 3 windows", GATED_TOOL_CALL_ID),
+    }, [`tools:${GATED_TOOL_CALL_ID}`]),
+    // 2. The model decides to click; the leased tool auto-runs (no gate).
+    v3Event(2, "messages", { event: "message-start", run_id: "r2" }),
+    v3Event(3, "tools", {
+      event: "tool-started",
+      tool_call_id: LEASED_TOOL_CALL_ID,
+      tool_name: "click",
+      input: { x: 10, y: 20 },
+    }, [`tools:${LEASED_TOOL_CALL_ID}`]),
+    v3Event(4, "tools", {
+      event: "tool-finished",
+      tool_call_id: LEASED_TOOL_CALL_ID,
+      output: toolMessageOutput("clicked at (10,20)", LEASED_TOOL_CALL_ID),
+    }, [`tools:${LEASED_TOOL_CALL_ID}`]),
+    // 3. Final assistant turn.
+    v3Event(5, "messages", { event: "message-start", run_id: "r3" }),
+    v3Event(6, "messages", {
+      event: "content-block-delta",
+      index: 0,
+      delta: { type: "text-delta", text: POST_RESUME_AI_TEXT },
+      run_id: "r3",
+    }),
+    v3Event(7, "messages", { event: "message-finish", run_id: "r3" }),
+  ];
+}
+
+function mockV3Run(events: V3ProtocolEvent[]) {
+  return {
+    [Symbol.asyncIterator]: async function* () {
+      for (const e of events) yield e;
+    },
+    output: Promise.resolve({ messages: [] }),
+    abort: vi.fn(),
+    signal: new AbortController().signal,
+  };
+}
+
+/**
+ * The run-1 transcript already persisted on the execution: a leading thinking
+ * block, then the gated getAppState call the user approved with APPROVE_ALL.
+ */
+function persistedRunOneStatus(): AgentExecutionStatus {
+  return create(AgentExecutionStatusSchema, {
+    phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    startedAt: "2026-06-15T00:00:00.000Z",
+    messages: [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_THINKING,
+        content: THINKING_TEXT,
+        timestamp: "2026-06-15T00:00:01.000Z",
+      }),
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        content: PRE_RESUME_AI_TEXT,
+        timestamp: "2026-06-15T00:00:02.000Z",
+        toolCalls: [
+          create(ToolCallSchema, {
+            id: GATED_TOOL_CALL_ID,
+            name: "getAppState",
+            status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+            requiresApproval: true,
+            approvalMessage: "Execute getAppState tool",
+            approvalAction: ApprovalAction.APPROVE_ALL,
+            mcpServerSlug: MCP_SLUG,
+          }),
+        ],
+      }),
+    ],
+  });
+}
+
+function fakeDurableResumeSetup(): SetupResult {
+  let streamed = false;
+
+  const pendingInterruptState = {
+    values: { messages: [{ role: "assistant", content: PRE_RESUME_AI_TEXT }] },
+    tasks: [{
+      id: "task-1",
+      interrupts: [{
+        value: {
+          tool_call_id: GATED_TOOL_CALL_ID,
+          tool_name: "getAppState",
+          mcp_server_slug: MCP_SLUG,
+          message: "Execute getAppState tool",
+        },
+        resumeValue: undefined,
+      }],
+    }],
+  };
+  const resolvedState = {
+    values: { messages: [{ role: "assistant", content: PRE_RESUME_AI_TEXT }] },
+    tasks: [],
+  };
+
+  const agentGraph = {
+    // Before the resumed stream: a pending interrupt awaits the decision.
+    // After the stream: the interrupt is resolved (no pending approvals).
+    getState: vi.fn(async () => (streamed ? resolvedState : pendingInterruptState)),
+    streamEvents: vi.fn(async () => {
+      streamed = true;
+      return mockV3Run(resumeEvents());
+    }),
+  };
+
+  // Approve-all leased open-computer-use: the resume's policy map no longer
+  // contains the leased server's tools, so the follow-up `click` is NOT gated.
+  // Only the originally-gated getAppState policy remains for resume resolution.
+  const approvalPolicies = new Map([
+    [`${MCP_SLUG}/getAppState`, {
+      toolName: "getAppState",
+      mcpServerSlug: MCP_SLUG,
+      requiresApproval: true,
+      approvalMessage: "Execute getAppState tool",
+    }],
+  ]);
+
+  return {
+    agentGraph,
+    langgraphConfig: { configurable: { thread_id: "thread-1" } },
+    langgraphInput: { messages: [{ role: "user", content: "Self-DM me" }] },
+    execution: {
+      spec: { message: "Self-DM me to confirm you can." },
+      status: persistedRunOneStatus(),
+    },
+    agent: {},
+    session: { spec: { workspaceEntries: [] } },
+    workspaceBackend: { rootDir: "/tmp/ws" },
+    mcpConnection: null,
+    mergedEnvVars: {},
+    secretKeys: new Set<string>(),
+    modelName: "claude-sonnet",
+    gracefulStop: undefined,
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
+    provisionResults: [],
+    approvalPolicies,
+    // Both computer-use tools belong to the leased server.
+    toolServerMap: new Map([["getAppState", MCP_SLUG], ["click", MCP_SLUG]]),
+    autoApproveAll: false,
+    hasStructuredOutput: false,
+    streamVersion: "v3",
+  } as unknown as SetupResult;
+}
+
+const baseConfig: Config = {
+  taskQueue: "test-queue",
+  temporalAddress: "localhost:7233",
+  temporalNamespace: "default",
+  stigmerBackendEndpoint: "http://localhost:7234",
+  stigmerToken: null,
+  cursorApiKey: "",
+  workspaceRootDir: "/tmp/test",
+  mode: "cloud",
+  proxyEndpoint: "http://localhost:7234",
+  maxConcurrentActivities: 5,
+  idleTimeoutSeconds: null,
+  cloudModeEnabled: true,
+  checkpointerType: "http",
+  checkpointerProxyEndpoint: "http://localhost:7234",
+  primaryModel: "claude-sonnet",
+  cursorStreamStallTimeoutMs: 180000,
+};
+
+describe("ExecuteDeepAgent — APPROVE_ALL durable resume preserves leading thinking + first tool call", () => {
+  beforeEach(() => {
+    persistedStatuses.length = 0;
+    vi.mocked(performSetup).mockResolvedValue(fakeDurableResumeSetup());
+  });
+
+  it("keeps the leading thinking block and the gated getAppState call, and appends the leased tool", async () => {
+    const activities = createDeepAgentActivities(baseConfig);
+    await activities.ExecuteDeepAgent("exec-1", "thread-1");
+
+    expect(persistedStatuses.length).toBeGreaterThan(0);
+    const finalStatus = persistedStatuses.at(-1)!;
+
+    // 1. The LEADING thinking block survives the resume (the reported symptom).
+    const thinkingMessages = finalStatus.messages.filter(
+      m => m.type === MessageType.MESSAGE_THINKING,
+    );
+    expect(thinkingMessages).toHaveLength(1);
+    expect(thinkingMessages[0].content).toBe(THINKING_TEXT);
+
+    // 2. The thinking block stays at the FRONT — it is still messages[0], proving
+    //    the transcript was not front-truncated and rebuilt from a later turn.
+    expect(finalStatus.messages[0].type).toBe(MessageType.MESSAGE_THINKING);
+
+    // 3. The FIRST tool call (getAppState) is reconciled in place: exactly one
+    //    copy, now COMPLETED with its result — not dropped, not duplicated.
+    const getAppStateCalls = finalStatus.messages
+      .flatMap(m => m.toolCalls)
+      .filter(tc => tc.id === GATED_TOOL_CALL_ID);
+    expect(getAppStateCalls).toHaveLength(1);
+    expect(getAppStateCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(getAppStateCalls[0].result).toContain("app-state-captured");
+
+    // 4. The leased follow-up tool is appended.
+    const clickCalls = finalStatus.messages
+      .flatMap(m => m.toolCalls)
+      .filter(tc => tc.id === LEASED_TOOL_CALL_ID);
+    expect(clickCalls).toHaveLength(1);
+    expect(clickCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+
+    // 5. The post-resume assistant turn is appended and the run completes.
+    const allText = finalStatus.messages.map(m => m.content).join("\n");
+    expect(allText).toContain(POST_RESUME_AI_TEXT);
+    expect(finalStatus.phase).toBe(ExecutionPhase.EXECUTION_COMPLETED);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -18,6 +18,7 @@
  */
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
 import { create, clone } from "@bufbuild/protobuf";
 import {
   AgentExecutionStatusSchema,
@@ -218,11 +219,7 @@ function fakeDurableResumeSetup(): SetupResult {
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",
     gracefulStop: undefined,
-    artifactStorage: {
-      upload: vi.fn(async (key: string) => key),
-      getDownloadUrl: vi.fn(async (key: string) => `https://artifacts.local/${key}`),
-      exists: vi.fn(async () => false),
-    },
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
     provisionResults: [],
     approvalPolicies,
     toolServerMap: new Map([["echo", "test-mcp"]]),

package/src/activities/execute-deep-agent/__tests__/inline-publisher.test.ts

@@ -10,6 +10,7 @@ import { InlinePublisher } from "../inline-publisher.js";
 import { StatusBuilder } from "../status-builder.js";
 import { LocalWorkspaceBackend } from "../../../shared/workspace/local-backend.js";
 import type { ArtifactStorage } from "../../../shared/artifact-storage.js";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
 import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
 
 function makeStatusBuilder(): StatusBuilder {
@@ -35,19 +36,16 @@ function mockArtifactStorage(): ArtifactStorage & {
   uploadedKeys: string[];
   uploadedContent: Map<string, Buffer>;
 } {
+  // Canonical double; `uploadedKeys`/`uploadedContent` mirror the backing store
+  // so the existing assertions keep working and `download` reads back uploads.
+  const { storage, blobs } = makeInMemoryArtifactStorage({ urlBase: "http://localhost:7235/" });
   const uploadedKeys: string[] = [];
-  const uploadedContent = new Map<string, Buffer>();
-  return {
-    uploadedKeys,
-    uploadedContent,
-    upload: vi.fn(async (key: string, content: Buffer) => {
-      uploadedKeys.push(key);
-      uploadedContent.set(key, content);
-      return key;
-    }),
-    getDownloadUrl: vi.fn(async (key: string) => `http://localhost:7235/${key}`),
-    exists: vi.fn(async () => false),
-  };
+  storage.upload.mockImplementation(async (key: string, content: Buffer) => {
+    uploadedKeys.push(key);
+    blobs.set(key, Buffer.from(content));
+    return key;
+  });
+  return Object.assign(storage, { uploadedKeys, uploadedContent: blobs });
 }
 
 function sha256(content: string): string {
@@ -83,7 +81,6 @@ describe("InlinePublisher", () => {
     expect(artifact.sandboxPath).toBe("src/main.ts");
     expect(artifact.kind).toBe(ExecutionArtifactKind.FILE);
     expect(artifact.storageKey).toBe("artifacts/exec-123/main.ts");
-    expect(artifact.downloadUrl).toBe("http://localhost:7235/artifacts/exec-123/main.ts");
     expect(artifact.contentHash).toBe(sha256("console.log('hello');"));
     expect(Number(artifact.sizeBytes)).toBeGreaterThan(0);
   });
@@ -164,6 +161,27 @@ describe("InlinePublisher", () => {
     expect(sb.currentStatus.artifacts[0].contentHash).toBe(expected);
   });
 
+  it("never publishes a secret-like file to artifact storage (design doc 12, D4)", async () => {
+    // Under the global bypass a secret write is not blocked up front, so it would
+    // otherwise be uploaded here. The publisher must withhold it: no read, no
+    // upload, no registered artifact — the secret's bytes never reach storage.
+    const secretBackend = mockWorkspaceBackend({ ".env": "API_KEY=super-secret-value" });
+    const readSpy = secretBackend.readFile as ReturnType<typeof vi.fn>;
+    const pub = new InlinePublisher({
+      workspaceBackend: secretBackend,
+      artifactStorage: storage,
+      statusWriter: sb,
+      executionId: "exec-secret",
+    });
+
+    await pub.publish(".env");
+
+    expect(storage.uploadedKeys).toHaveLength(0);
+    expect(sb.currentStatus.artifacts).toHaveLength(0);
+    expect(readSpy).not.toHaveBeenCalled(); // withheld before the file is even read
+    expect(pub.publishedPaths.size).toBe(0);
+  });
+
   it("guesses content type for common extensions", async () => {
     const jsonBackend = mockWorkspaceBackend({ "data.json": '{"key":"val"}' });
     const pub = new InlinePublisher({