@stigmer/runner 3.1.0 → 3.1.2

package/dist/.build-fingerprint

@@ -1 +1 @@
-{"hash":"cdec4dda6bfadae6","builtAt":"2026-07-02T20:57:56.801Z","fileCount":229}
+{"hash":"63dd2c451162293e","builtAt":"2026-07-04T19:34:42.064Z","fileCount":234}

package/dist/activities/execute-cursor/attachment-resolver.d.ts

@@ -1,19 +1,60 @@
 /**
  * Resolves execution attachments into the platform-managed directory.
  *
- * Attachments are files provided as inputs to the agent execution.
- * In local mode, they are read directly from localPath. The files are
- * placed under .stigmer/inputs/ using the platform mount pattern.
+ * Attachments are files provided as inputs to the agent execution. Each is
+ * materialized under the session platform dir's `inputs/` subdirectory and
+ * surfaced to the agent as `.stigmer/inputs/{filename}` through the workspace
+ * `.stigmer` symlink (see stigmer-link.ts), which this resolver guarantees —
+ * an agent with attachments but no skills still gets the link.
+ *
+ * Content sources, in order:
+ * - `localPath` (local mode only): read straight off the caller's disk — the
+ *   CLI fast path, no storage round-trip.
+ * - `storageKey`: downloaded via {@link ArtifactStorage} — the universal path;
+ *   the backend's create pipeline requires a storage key on every attachment
+ *   it accepts, and in local mode the storage reads directly off disk.
+ *
+ * Placement is always `inputs/{filename}` — the platform namespace this
+ * harness can surface in the workspace. An attachment's `mountPath` is
+ * honored by convention, not mechanism: the standard mounts (e.g. the
+ * approved plan at `.stigmer/inputs/plan.md`) resolve to exactly this
+ * placement, and the prompt's `<input_files>` section plus any path-derived
+ * directives are built from the RESOLVED paths, so prompt and filesystem can
+ * never disagree.
+ *
+ * Error model: fail-hard, matching the native harness's attachment injector.
+ * Attachments are explicit user inputs — an execution that silently runs
+ * without one produces silently incorrect results (the "plan file wasn't
+ * found" class of failure). Any attachment that cannot be materialized aborts
+ * the execution with an actionable error.
  */
 import type { Attachment } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import type { ArtifactStorage } from "../../shared/artifact-storage.js";
 export interface ResolvedAttachment {
     filename: string;
+    /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
     relativePath: string;
 }
+export interface AttachmentResolverOptions {
+    sessionId: string;
+    primaryWorkspaceDir: string;
+    mode: "local" | "cloud";
+    /**
+     * Artifact storage for `storageKey` downloads. `undefined` when the runner
+     * could not build a store (proxy misconfig) — a storage-backed attachment
+     * then fails with an actionable error rather than a silent skip.
+     */
+    storage: ArtifactStorage | undefined;
+}
+export declare class AttachmentResolutionError extends Error {
+    readonly attachmentFilename: string;
+    readonly reason: string;
+    constructor(attachmentFilename: string, reason: string);
+}
 /**
- * Resolve attachments by copying them to the platform-managed directory.
- *
- * In local mode: copies from localPath to .stigmer/inputs/{filename}
- * Returns relative paths for prompt injection.
+ * Materialize all attachments under `.stigmer/inputs/` and return their
+ * workspace-relative paths for prompt injection. Throws
+ * {@link AttachmentResolutionError} on the first attachment that cannot be
+ * materialized (fail-hard — see module doc).
  */
-export declare function resolveAttachments(attachments: Attachment[], sessionId: string, primaryWorkspaceDir: string, mode: "local" | "cloud"): Promise<ResolvedAttachment[]>;
+export declare function resolveAttachments(attachments: Attachment[], options: AttachmentResolverOptions): Promise<ResolvedAttachment[]>;

package/dist/activities/execute-cursor/attachment-resolver.js

@@ -1,52 +1,109 @@
 /**
  * Resolves execution attachments into the platform-managed directory.
  *
- * Attachments are files provided as inputs to the agent execution.
- * In local mode, they are read directly from localPath. The files are
- * placed under .stigmer/inputs/ using the platform mount pattern.
+ * Attachments are files provided as inputs to the agent execution. Each is
+ * materialized under the session platform dir's `inputs/` subdirectory and
+ * surfaced to the agent as `.stigmer/inputs/{filename}` through the workspace
+ * `.stigmer` symlink (see stigmer-link.ts), which this resolver guarantees —
+ * an agent with attachments but no skills still gets the link.
+ *
+ * Content sources, in order:
+ * - `localPath` (local mode only): read straight off the caller's disk — the
+ *   CLI fast path, no storage round-trip.
+ * - `storageKey`: downloaded via {@link ArtifactStorage} — the universal path;
+ *   the backend's create pipeline requires a storage key on every attachment
+ *   it accepts, and in local mode the storage reads directly off disk.
+ *
+ * Placement is always `inputs/{filename}` — the platform namespace this
+ * harness can surface in the workspace. An attachment's `mountPath` is
+ * honored by convention, not mechanism: the standard mounts (e.g. the
+ * approved plan at `.stigmer/inputs/plan.md`) resolve to exactly this
+ * placement, and the prompt's `<input_files>` section plus any path-derived
+ * directives are built from the RESOLVED paths, so prompt and filesystem can
+ * never disagree.
+ *
+ * Error model: fail-hard, matching the native harness's attachment injector.
+ * Attachments are explicit user inputs — an execution that silently runs
+ * without one produces silently incorrect results (the "plan file wasn't
+ * found" class of failure). Any attachment that cannot be materialized aborts
+ * the execution with an actionable error.
  */
-import { mkdir, copyFile } from "node:fs/promises";
+import { mkdir, copyFile, writeFile } from "node:fs/promises";
 import { join, basename } from "node:path";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
-const STIGMER_LOCAL_STATE_DIR = ".stigmer";
+import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "./stigmer-link.js";
 const INPUTS_SUBDIR = "inputs";
+export class AttachmentResolutionError extends Error {
+    attachmentFilename;
+    reason;
+    constructor(attachmentFilename, reason) {
+        super(`Attachment '${attachmentFilename}': ${reason}`);
+        this.name = "AttachmentResolutionError";
+        this.attachmentFilename = attachmentFilename;
+        this.reason = reason;
+    }
+}
 /**
- * Resolve attachments by copying them to the platform-managed directory.
- *
- * In local mode: copies from localPath to .stigmer/inputs/{filename}
- * Returns relative paths for prompt injection.
+ * Materialize all attachments under `.stigmer/inputs/` and return their
+ * workspace-relative paths for prompt injection. Throws
+ * {@link AttachmentResolutionError} on the first attachment that cannot be
+ * materialized (fail-hard — see module doc).
  */
-export async function resolveAttachments(attachments, sessionId, primaryWorkspaceDir, mode) {
+export async function resolveAttachments(attachments, options) {
     if (attachments.length === 0)
         return [];
-    const platformDir = getPlatformDir(sessionId);
+    const platformDir = getPlatformDir(options.sessionId);
     const inputsDir = join(platformDir, INPUTS_SUBDIR);
     await mkdir(inputsDir, { recursive: true });
+    // The symlink is what makes `inputs/` visible in the workspace; without it
+    // every resolved path below would dangle (the skill resolver also ensures
+    // it, but only when the agent has skills).
+    await ensureStigmerSymlink(options.primaryWorkspaceDir, platformDir);
     const results = [];
     for (const attachment of attachments) {
-        try {
-            const resolved = await resolveAttachment(attachment, inputsDir, mode);
-            if (resolved)
-                results.push(resolved);
-        }
-        catch (err) {
-            console.warn(`Failed to resolve attachment ${attachment.filename}: ${err instanceof Error ? err.message : err}`);
-        }
+        results.push(await resolveAttachment(attachment, inputsDir, options));
     }
+    console.log(`[attachment-resolver] resolved ${results.length} attachment(s): ` +
+        results.map((r) => r.relativePath).join(", "));
     return results;
 }
-async function resolveAttachment(attachment, inputsDir, mode) {
-    if (mode === "local" && attachment.localPath) {
+async function resolveAttachment(attachment, inputsDir, options) {
+    // Local-mode fast path: the file is already on this machine's disk.
+    if (options.mode === "local" && attachment.localPath) {
         const filename = attachment.filename || basename(attachment.localPath);
-        const destPath = join(inputsDir, filename);
-        await copyFile(attachment.localPath, destPath);
+        try {
+            await copyFile(attachment.localPath, join(inputsDir, filename));
+        }
+        catch (err) {
+            throw new AttachmentResolutionError(attachment.filename, `failed to copy local file '${attachment.localPath}': ` +
+                `${err instanceof Error ? err.message : String(err)}`);
+        }
         return {
             filename,
             relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
         };
     }
-    // Cloud mode: download from storage_key (not yet implemented for cursor-runner)
-    console.warn(`Attachment ${attachment.filename}: cloud storage download not yet implemented for cursor-runner`);
-    return null;
+    // Universal path: download the uploaded content by storage key.
+    if (!attachment.storageKey) {
+        throw new AttachmentResolutionError(attachment.filename, "missing storageKey — cannot download attachment from storage");
+    }
+    if (!options.storage) {
+        throw new AttachmentResolutionError(attachment.filename, `artifact storage is unavailable, so this attachment ` +
+            `(key: ${attachment.storageKey}) cannot be downloaded`);
+    }
+    const filename = attachment.filename || basename(attachment.storageKey);
+    let content;
+    try {
+        content = await options.storage.download(attachment.storageKey);
+    }
+    catch (err) {
+        throw new AttachmentResolutionError(attachment.filename, `failed to download from storage (key: ${attachment.storageKey}): ` +
+            `${err instanceof Error ? err.message : String(err)}`);
+    }
+    await writeFile(join(inputsDir, filename), content);
+    return {
+        filename,
+        relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
+    };
 }
 //# sourceMappingURL=attachment-resolver.js.map

package/dist/activities/execute-cursor/attachment-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,SAAiB,EACjB,mBAA2B,EAC3B,IAAuB;IAEvB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACtE,IAAI,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,gCAAgC,UAAU,CAAC,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,SAAiB,EACjB,IAAuB;IAEvB,IAAI,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE/C,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,IAAI,CACV,cAAc,UAAU,CAAC,QAAQ,gEAAgE,CAClG,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"attachment-resolver.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/attachment-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAElF,MAAM,aAAa,GAAG,QAAQ,CAAC;AAoB/B,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,MAAM,CAAS;IAExB,YAAY,kBAA0B,EAAE,MAAc;QACpD,KAAK,CAAC,eAAe,kBAAkB,MAAM,MAAM,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAyB,EACzB,OAAkC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,0EAA0E;IAC1E,2CAA2C;IAC3C,MAAM,oBAAoB,CAAC,OAAO,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAErE,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kCAAkC,OAAO,CAAC,MAAM,kBAAkB;QAClE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9C,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAsB,EACtB,SAAiB,EACjB,OAAkC;IAElC,oEAAoE;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8BAA8B,UAAU,CAAC,SAAS,KAAK;gBACvD,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;SACrE,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,sDAAsD;YACtD,SAAS,UAAU,CAAC,UAAU,wBAAwB,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,yBAAyB,CACjC,UAAU,CAAC,QAAQ,EACnB,yCAAyC,UAAU,CAAC,UAAU,KAAK;YACnE,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAEpD,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,EAAE,QAAQ,CAAC;KACrE,CAAC;AACJ,CAAC"}

package/dist/activities/execute-cursor/cas-observations.d.ts

@@ -72,6 +72,19 @@ export interface CasObservations {
  * than mis-captured). Entries are returned in a deterministic (sorted) order.
  */
 export declare function readCasObservations(hitlDir: string): Promise<CasObservations>;
+/**
+ * Build a standalone Node.js script that CLASSIFIES a single path as secret-like
+ * without staging anything — the deny-gate (no-capture-substrate) counterpart of
+ * {@link buildObservationStagingScript}.
+ *
+ * Invoked as `printf %s "$SALIENT" | node -e '<this>'` — the path rides stdin (no
+ * argv escaping). Prints `secret` for a secret-like path, `ok` otherwise. Empty
+ * input classifies as `secret` (fail-closed, matching {@link isSecretLikePath}).
+ * The Cursor hook uses this to hard-block a secret write on the deny-gate so its
+ * content never reaches an approval (DD-26 follow-up #2); it shares the classifier
+ * fragment above, so its verdict equals the runner's {@link isSecretLikePath}.
+ */
+export declare function buildSecretClassifyScript(): string;
 /**
  * Build the standalone Node.js script the hook runs to observe a single
  * gitignored write — the disk-backed mirror of `CasCaptureFilesystemBackend`'s

package/dist/activities/execute-cursor/cas-observations.js

@@ -122,6 +122,44 @@ export async function readCasObservations(hitlDir) {
 function regexLiteral(re) {
     return `new RegExp(${JSON.stringify(re.source)},${JSON.stringify(re.flags)})`;
 }
+/**
+ * The JS lines that define `isSecret(p)` inside a hook-embedded script — a
+ * byte-identical mirror of {@link isSecretLikePath} generated from the SAME
+ * {@link SECRET_BASENAME_PATTERNS}/{@link SECRET_PATH_PATTERNS} arrays.
+ *
+ * ONE definition, so every hook-side classifier (the capture-mode staging script
+ * and the deny-gate classify-only script) agrees with the runner-side classifier
+ * by construction — the "no bash-regex, no divergence" invariant this module owns.
+ * Authored as single-quoted-bash strings, so the JS must contain no single quotes.
+ */
+function secretClassifierFragment() {
+    const base = SECRET_BASENAME_PATTERNS.map(regexLiteral).join(",");
+    const pathPatterns = SECRET_PATH_PATTERNS.map(regexLiteral).join(",");
+    return [
+        `const baseName=(p)=>{const n=p.replace(/\\\\/g,"/");const i=n.lastIndexOf("/");return i>=0?n.slice(i+1):n;};`,
+        `const BASE=[${base}];const PATHP=[${pathPatterns}];`,
+        `const isSecret=(p)=>{if(!p)return true;const nm=p.replace(/\\\\/g,"/");const b=baseName(nm).toLowerCase();for(const r of BASE){if(r.test(b))return true;}const lp=nm.toLowerCase();for(const r of PATHP){if(r.test(lp))return true;}return false;};`,
+    ];
+}
+/**
+ * Build a standalone Node.js script that CLASSIFIES a single path as secret-like
+ * without staging anything — the deny-gate (no-capture-substrate) counterpart of
+ * {@link buildObservationStagingScript}.
+ *
+ * Invoked as `printf %s "$SALIENT" | node -e '<this>'` — the path rides stdin (no
+ * argv escaping). Prints `secret` for a secret-like path, `ok` otherwise. Empty
+ * input classifies as `secret` (fail-closed, matching {@link isSecretLikePath}).
+ * The Cursor hook uses this to hard-block a secret write on the deny-gate so its
+ * content never reaches an approval (DD-26 follow-up #2); it shares the classifier
+ * fragment above, so its verdict equals the runner's {@link isSecretLikePath}.
+ */
+export function buildSecretClassifyScript() {
+    return [
+        `let salient="";try{salient=require("fs").readFileSync(0,"utf8");}catch(e){salient="";}`,
+        ...secretClassifierFragment(),
+        `process.stdout.write(isSecret(salient)?"secret":"ok");`,
+    ].join("");
+}
 /**
  * Build the standalone Node.js script the hook runs to observe a single
  * gitignored write — the disk-backed mirror of `CasCaptureFilesystemBackend`'s
@@ -144,8 +182,6 @@ function regexLiteral(re) {
  * single-quoted-bash string, so the JS must contain no single quotes.
  */
 export function buildObservationStagingScript() {
-    const base = SECRET_BASENAME_PATTERNS.map(regexLiteral).join(",");
-    const pathPatterns = SECRET_PATH_PATTERNS.map(regexLiteral).join(",");
     const metaSuffix = JSON.stringify(META_SUFFIX);
     const blobSuffix = JSON.stringify(BLOB_SUFFIX);
     return [
@@ -161,9 +197,7 @@ export function buildObservationStagingScript() {
         `let rel=path.relative(wsRoot,abs).split(path.sep).join("/");`,
         `if(!rel||rel===".."||rel.startsWith("../")){process.stdout.write("error");process.exit(0);}`,
         // --- secret classifier: byte-identical mirror of isSecretLikePath ---
-        `const baseName=(p)=>{const n=p.replace(/\\\\/g,"/");const i=n.lastIndexOf("/");return i>=0?n.slice(i+1):n;};`,
-        `const BASE=[${base}];const PATHP=[${pathPatterns}];`,
-        `const isSecret=(p)=>{if(!p)return true;const nm=p.replace(/\\\\/g,"/");const b=baseName(nm).toLowerCase();for(const r of BASE){if(r.test(b))return true;}const lp=nm.toLowerCase();for(const r of PATHP){if(r.test(lp))return true;}return false;};`,
+        ...secretClassifierFragment(),
         `const key=crypto.createHash("sha256").update(rel,"utf8").digest("hex");`,
         `const metaPath=path.join(obsDir,key+${metaSuffix});const blobPath=path.join(obsDir,key+${blobSuffix});`,
         `try{fs.mkdirSync(obsDir,{recursive:true});}catch(e){}`,

package/dist/activities/execute-cursor/cas-observations.js.map

@@ -1 +1 @@
-{"version":3,"file":"cas-observations.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/cas-observations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAEzG,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,iFAAiF;AACjF,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,8EAA8E;AAC9E,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACxD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAC1C,IAAI,IAA2D,CAAC;QAChE,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,oCAAoC;QAChD,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAsB,IAAI,CAAC;YACrC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,0DAA0D;gBACtE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO;QACL,mFAAmF;QACnF,oEAAoE;QACpE,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,iEAAiE;QACjE,yCAAyC;QACzC,8DAA8D;QAC9D,6FAA6F;QAC7F,uEAAuE;QACvE,8GAA8G;QAC9G,eAAe,IAAI,kBAAkB,YAAY,IAAI;QACrD,qPAAqP;QACrP,yEAAyE;QACzE,uCAAuC,UAAU,yCAAyC,UAAU,IAAI;QACxG,uDAAuD;QACvD,6EAA6E;QAC7E,mKAAmK;QACnK,0EAA0E;QAC1E,mEAAmE;QACnE,gFAAgF;QAChF,8EAA8E;QAC9E,gEAAgE;QAChE,0GAA0G;QAC1G,yEAAyE;QACzE,wEAAwE;QACxE,2RAA2R;QAC3R,mCAAmC;KACpC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC"}
+{"version":3,"file":"cas-observations.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/cas-observations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAEzG,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAE3D,iFAAiF;AACjF,MAAM,WAAW,GAAG,YAAY,CAAC;AACjC,8EAA8E;AAC9E,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACxD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QAC1C,IAAI,IAA2D,CAAC;QAChE,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,oCAAoC;QAChD,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QAEnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAsB,IAAI,CAAC;YACrC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC;gBAC7E,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,0DAA0D;gBACtE,CAAC;YACH,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,cAAc,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,OAAO;QACL,8GAA8G;QAC9G,eAAe,IAAI,kBAAkB,YAAY,IAAI;QACrD,qPAAqP;KACtP,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,wFAAwF;QACxF,GAAG,wBAAwB,EAAE;QAC7B,wDAAwD;KACzD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO;QACL,mFAAmF;QACnF,oEAAoE;QACpE,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,4EAA4E;QAC5E,8EAA8E;QAC9E,iEAAiE;QACjE,yCAAyC;QACzC,8DAA8D;QAC9D,6FAA6F;QAC7F,uEAAuE;QACvE,GAAG,wBAAwB,EAAE;QAC7B,yEAAyE;QACzE,uCAAuC,UAAU,yCAAyC,UAAU,IAAI;QACxG,uDAAuD;QACvD,6EAA6E;QAC7E,mKAAmK;QACnK,0EAA0E;QAC1E,mEAAmE;QACnE,gFAAgF;QAChF,8EAA8E;QAC9E,gEAAgE;QAChE,0GAA0G;QAC1G,yEAAyE;QACzE,wEAAwE;QACxE,2RAA2R;QAC3R,mCAAmC;KACpC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC"}

package/dist/activities/execute-cursor/hook-script.js

@@ -87,7 +87,7 @@
  */
 import { SALIENT_ARG_FIELDS, getBuiltInGatedCategories } from "./approval-policy.js";
 import { EDIT_OLD_FIELDS, EDIT_NEW_FIELDS, WRITE_CONTENT_FIELDS, } from "../../shared/file-tools.js";
-import { buildObservationStagingScript, CAS_OBSERVATIONS_DIRNAME } from "./cas-observations.js";
+import { buildObservationStagingScript, buildSecretClassifyScript, CAS_OBSERVATIONS_DIRNAME } from "./cas-observations.js";
 // Shown to the model when the gate denies a tool call. It must NOT teach the
 // model to ask for permission in prose or to "stop and wait" — that framing
 // makes the model narrate approval requests instead of invoking tools (the
@@ -262,6 +262,7 @@ export function generateHookScript(activePointerPath, workspaceRoot = "") {
     const categoryCaseArms = buildCategoryCaseArms();
     const nodeIdentityScript = buildNodeIdentityScript();
     const observationStagingScript = buildObservationStagingScript();
+    const secretClassifyScript = buildSecretClassifyScript();
     const nodeBin = process.execPath;
     return `#!/bin/bash
 # Stigmer HITL approval hook for Cursor (preToolUse + beforeMCPExecution).
@@ -556,6 +557,23 @@ if [ -n "$CATEGORY" ]; then
       exit 0
     fi
   fi
+  # Deny-gate secret hard-block (DD-26 #2): a secret-like WRITE that reaches the
+  # deny-gate (no capture substrate for it — capture off, or captureIgnored off in
+  # a git-no-storage workspace) must not surface its content for approval. Classify
+  # byte-identically to isSecretLikePath (no staging) and, on a match, hard-block
+  # with the security message: the agent continues, nothing is written, and NO
+  # content is recorded to the ledger. Placed before the grant/lease checks so a
+  # write-category lease can never bypass it; only writes are content-bearing
+  # (deletes stay gated). Fail-open on a classify error — the write falls to the
+  # normal deny-gate and the runner-side backstop still withholds any secret
+  # content before persist.
+  if [ "$CATEGORY" = "write" ] && [ -n "$SALIENT" ]; then
+    SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo ok)
+    if [ "$SECRET_RESULT" = "secret" ]; then
+      echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written."}'
+      exit 0
+    fi
+  fi
   # Reinvocation grant: allow when the CONTENT-exact token (a file edit approved
   # earlier with this exact content) OR the COARSE token (a shell/delete, or the
   # content-less degrade) is in approvedGrantTokens. A sibling edit to the same

package/dist/activities/execute-cursor/hook-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEhG,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;gDAc8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAiDzC,wBAAwB;iFACmB,wBAAwB;;;;;kDAKvD,4BAA4B;;;;;;kDAM5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDA2C7B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAmDnC,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}
+{"version":3,"file":"hook-script.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/hook-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EACL,eAAe,EACf,eAAe,EACf,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAE3H,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,+EAA+E;AAC/E,6EAA6E;AAC7E,oEAAoE;AACpE,+EAA+E;AAC/E,uCAAuC;AACvC,MAAM,+BAA+B,GACnC,6EAA6E;IAC7E,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,qEAAqE;IACrE,6EAA6E,CAAC;AAEhF,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,gFAAgF;AAChF,oEAAoE;AACpE,MAAM,4BAA4B,GAChC,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,SAAS,qBAAqB;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,OAAO,eAAe,QAAQ,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,wBAAwB;IAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO;QACL,mGAAmG;QACnG,uFAAuF;QACvF,aAAa;QACb,kBAAkB,EAAE,IAAI;QACxB,qDAAqD;QACrD,sBAAsB,EAAE,aAAa,EAAE,8FAA8F;KACtI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,uBAAuB;IAC9B,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAC3D,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO;QACL,2DAA2D;QAC3D,0DAA0D;QAC1D,cAAc,UAAU,cAAc;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,gDAAgD;QAChD,WAAW;QACX,mEAAmE;QACnE,yHAAyH;QACzH,WAAW;QACX,kBAAkB,MAAM,wDAAwD;QAChF,wDAAwD;QACxD,4EAA4E;QAC5E,6EAA6E;QAC7E,wBAAwB,EAAE;QAC1B,oEAAoE;QACpE,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,6EAA6E;QAC7E,4BAA4B;QAC5B,uKAAuK;KACxK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,kBAAkB,CAAC,iBAAyB,EAAE,aAAa,GAAG,EAAE;IAC9E,MAAM,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,kBAAkB,GAAG,uBAAuB,EAAE,CAAC;IACrD,MAAM,wBAAwB,GAAG,6BAA6B,EAAE,CAAC;IACjE,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjC,OAAO;;;;;;;;;;;;;;;YAeG,OAAO;eACJ,iBAAiB;;;YAGpB,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAgGkD,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2B5E,aAAa;;;;;;EAM5B,gBAAgB;;;;;;;;;;;;;;gDAc8B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCAiDzC,wBAAwB;iFACmB,wBAAwB;;;;;kDAKvD,4BAA4B;;;;;;kDAM5B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oDA2C7B,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sFAsCG,oBAAoB;;oDAEtD,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDA4BhC,+BAA+B;;;;;;;;;CAS9E,CAAC;AACF,CAAC"}

package/dist/activities/execute-cursor/index.d.ts

@@ -54,6 +54,11 @@ export interface BuildPromptInput {
      */
     appliedToolCallIds?: ReadonlySet<string>;
     interactionMode?: InteractionMode;
+    /**
+     * The execution is a Build-from-plan turn (spec.execution_config
+     * .build_from_plan): both prompt paths carry the implement-plan directive.
+     */
+    buildFromPlan?: boolean;
 }
 /**
  * Select and build the appropriate prompt based on resolution reason and

package/dist/activities/execute-cursor/index.js

@@ -37,9 +37,9 @@ import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_p
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { MessageAccumulator, reconcileDeniedToolCalls, clearProvisionalPostDenialNarration, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { collectSubAgentToolCallIds, withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { startStallWatchdog, StallTimeoutError, formatStallFailure } from "../../shared/stall-watchdog.js";
-import { createArtifactStorage, loadArtifactStorageConfig } from "../../shared/artifact-storage.js";
+import { resolveUsableArtifactStorage, loadArtifactStorageConfig } from "../../shared/artifact-storage.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
@@ -53,11 +53,13 @@ import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
 import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
-import { resolveSkills, removeStigmerSymlink } from "./skill-resolver.js";
+import { resolveSkills } from "./skill-resolver.js";
+import { removeStigmerSymlink } from "./stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
+import { acquireWorkspaceLock, WorkspaceLockCancelledError, WorkspaceLockTimeoutError, } from "../../shared/workspace/workspace-lock.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, primaryToken, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
@@ -131,25 +133,30 @@ turnSeq) {
     });
     // Artifact storage for offloading oversized tool outputs (screenshots, giant
     // dumps) out of the persisted status, and for publishing the plan artifact.
-    // Created once here so it is available to EVERY persist below. Best-effort:
-    // if it can't be built (e.g. proxy mode without a token), offload is disabled
-    // but persistStatus still enforces the aggregate size cap, so persistence can
-    // never silently blow past the gRPC limit.
-    let artifactStorage;
-    try {
-        artifactStorage = createArtifactStorage(loadArtifactStorageConfig(config));
-    }
-    catch (storageErr) {
-        console.warn(`ExecuteCursor artifact storage unavailable — tool-output offload disabled ` +
-            `(aggregate size guard still active): execution=${executionId}, error=${storageErr}`);
-    }
+    // Resolved once here so it is available to EVERY persist below. Best-effort via
+    // the shared resolver (identical to the deep-agent harness): `undefined` — never
+    // a throw — when there is no working substrate (proxy misconfig OR an unwritable
+    // local path). An absent store disables offload (persistStatus still enforces
+    // the aggregate size cap) and flips capture mode off (deny-gate fallback).
+    const artifactStorage = await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
     const statusOffload = artifactStorage
         ? { artifactStorage, executionId }
         : undefined;
     // ALL status persistence in this activity flows through `persist`, so the
     // single size-bounding guard (offload + aggregate elision) is unforgeable and
     // a future call site cannot accidentally skip it.
-    const persist = (s = status) => persistStatus(client, executionId, s, { offload: statusOffload });
+    const persist = (s = status) => {
+        // Never-persist-secret backstop (DD-26 #2): before EVERY persist, withhold
+        // content from any built-in write row targeting a secret-like path (top-level
+        // + sub-agent). This is the single airtight choke point for the Cursor harness
+        // — the deny-gate analog of capture mode's stamping scrub, and the only
+        // guarantee under auto_approve_all (where the hook installs no gate). Safe on
+        // every call: Cursor sets tool args atomically from the SDK tool_call event
+        // (buildToolCallProto), so there is no mid-stream partial-args hazard, and the
+        // pass only ever touches secret-like write rows (idempotent, else a no-op).
+        withholdSecretContentFromMessages(s.messages, s.subAgentExecutions);
+        return persistStatus(client, executionId, s, { offload: statusOffload });
+    };
     let sessionId;
     let session;
     let pauseDetected = false;
@@ -195,6 +202,14 @@ turnSeq) {
     // (issue #173). Runs in the finally, covering every success/error/approval
     // exit path. Undefined until the gate is installed.
     let hitlCleanup;
+    // Exclusive turn lock on the primary workspace working tree. Held across the
+    // ENTIRE tree-mutating window (decision reconcile, HITL gate install, the
+    // agent's own writes, candidate capture) so a concurrent execution sharing
+    // this directory can never write between this turn's baseline and candidate
+    // snapshots — the misattribution that showed another session's file as this
+    // turn's change. Released in the finally AFTER hitlCleanup (which still
+    // mutates the tree). See shared/workspace/workspace-lock.ts.
+    let releaseWorkspaceLock;
     // Carries model/mode/agentId out to the outer catch so a thrown CursorSdkError
     // can be classified with the same context as the run.wait() error path.
     let errorContext = { model: "default", mode: "local", agentId: "" };
@@ -247,6 +262,44 @@ turnSeq) {
         // resume (which never authors a baseline) is harmless.
         const changeSetId = `${executionId}:${turnSeq}`;
         heartbeat();
+        // Serialize this turn against every other execution sharing this working
+        // tree — sessions declaring the same localPath (or the shared runner root)
+        // resolve to ONE directory, and an unserialized concurrent write lands
+        // inside this turn's baseline→candidate window, misattributing another
+        // session's file to this turn's review. Acquired before ANY tree mutation
+        // below (decision reconcile, gate install, agent writes, capture). While
+        // another turn holds the lock this surfaces a visible waiting state and
+        // heartbeats; a cancel aborts the wait immediately.
+        if (primaryWorkspaceDir) {
+            try {
+                releaseWorkspaceLock = await acquireWorkspaceLock(primaryWorkspaceDir, {
+                    onWaiting: () => reportSetupProgress(client, executionId, "Waiting for workspace — in use by another session"),
+                    heartbeat,
+                    signal: Context.current().cancellationSignal,
+                    timeoutMs: config.workspaceLockTimeoutMs,
+                });
+            }
+            catch (lockErr) {
+                if (lockErr instanceof WorkspaceLockCancelledError) {
+                    throw new CancelledFailure("Activity cancelled while waiting for the workspace lock");
+                }
+                if (lockErr instanceof WorkspaceLockTimeoutError) {
+                    status.phase = ExecutionPhase.EXECUTION_FAILED;
+                    status.error = lockErr.message;
+                    status.completedAt = utcTimestamp();
+                    status.messages.push(create(AgentMessageSchema, {
+                        type: MessageType.MESSAGE_SYSTEM,
+                        content: `Execution failed: ${lockErr.message}`,
+                        timestamp: utcTimestamp(),
+                    }));
+                    await persist(status);
+                    console.warn(`ExecuteCursor workspace lock timeout: execution=${executionId}`);
+                    return slimStatus(status);
+                }
+                throw lockErr;
+            }
+        }
+        heartbeat();
         // Set OTel baggage so downstream calls carry execution context.
         try {
             const { setBaggage, BAGGAGE_EXECUTION_ID, BAGGAGE_SESSION_ID, BAGGAGE_ORG_ID } = await import("../../otel.js");
@@ -430,8 +483,15 @@ turnSeq) {
             primaryWorkspaceDir,
         });
         heartbeat();
-        // Phase 5b: Resolve attachments
-        const attachmentResults = await resolveAttachments(spec.attachments, sessionId, primaryWorkspaceDir, config.mode);
+        // Phase 5b: Resolve attachments (fail-hard — explicit user inputs; see
+        // attachment-resolver.ts). Downloads by storage key through the same
+        // artifactStorage resolved for status offload above.
+        const attachmentResults = await resolveAttachments(spec.attachments, {
+            sessionId,
+            primaryWorkspaceDir,
+            mode: config.mode,
+            storage: artifactStorage,
+        });
         const attachmentPaths = attachmentResults.map((a) => a.relativePath);
         // Phase 5b3: Exact-apply approved whole-file writes (HITL "what you approve
         // is what gets applied"). The Cursor deny-only harness reinvokes the model,
@@ -611,6 +671,7 @@ turnSeq) {
         // Phase 10: Build the prompt
         const interactionMode = spec.executionConfig?.interactionMode
             ?? InteractionMode.UNSPECIFIED;
+        const buildFromPlan = spec.executionConfig?.buildFromPlan ?? false;
         const prompt = buildPrompt({
             resolution,
             approvalDecisions,
@@ -624,6 +685,7 @@ turnSeq) {
             pendingApprovals: adjudicatedApprovals,
             appliedToolCallIds,
             interactionMode,
+            buildFromPlan,
         });
         // Phase 10a: Inject structured output instruction for Cursor harness
         let effectivePrompt = prompt;
@@ -1613,6 +1675,12 @@ turnSeq) {
                     `execution=${executionId}, error=${cleanupErr instanceof Error ? cleanupErr.message : cleanupErr}`);
             }
         }
+        // Release the workspace turn lock LAST — hitlCleanup above still mutates
+        // the tree (restores .cursor/hooks.json), and the next queued turn must
+        // not baseline until every mutation of this one has landed. Idempotent
+        // and non-throwing (see workspace-lock.ts), so it can never mask the
+        // turn's real outcome.
+        await releaseWorkspaceLock?.();
     }
 }
 /**
@@ -1702,7 +1770,7 @@ import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
  *    agent after resume failure   skills; no prior conversation to inherit)
  */
 export function buildPrompt(input) {
-    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachmentPaths, interactionMode, } = input;
+    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachmentPaths, interactionMode, buildFromPlan, } = input;
     const isHitlReinvocation = approvalDecisions !== undefined && approvalDecisions.size > 0;
     // HITL reinvocation: the agent is resumed, so its native context carries the
     // prior conversation; the reinvocation prompt conveys the approval decisions
@@ -1711,9 +1779,20 @@ export function buildPrompt(input) {
         return buildReinvocationPrompt(input.pendingApprovals, approvalDecisions, input.appliedToolCallIds);
     }
     // A successfully resumed agent carries its own conversation context via the
-    // SDK's native store — send the raw user message with no preamble.
+    // SDK's native store — send the raw user message with no preamble. The
+    // exceptions are the per-EXECUTION directives, which never inherit from the
+    // session's first turn: the interaction-mode prefix (a follow-up can switch
+    // Agent→Plan mid-session, and for Cursor the prompt is the only plan-mode
+    // enforcement) and the implement-plan directive (the build turn is usually
+    // a follow-up on a resumed agent).
     if (resolution.reason === "resumed_successfully") {
-        return userMessage;
+        const prefixes = [
+            formatInteractionModePrefix(interactionMode),
+            formatImplementPlanSection(buildFromPlan, attachmentPaths),
+        ].filter((p) => p !== undefined);
+        return prefixes.length > 0
+            ? [...prefixes, userMessage].join("\n\n")
+            : userMessage;
     }
     // First execution, or a fresh agent created after a resume failure: there is
     // no prior conversation to inherit, so start a new turn with full context.
@@ -1726,6 +1805,7 @@ export function buildPrompt(input) {
         workspaceFileRefs,
         attachmentPaths,
         interactionMode,
+        buildFromPlan,
     });
 }
 // ---------------------------------------------------------------------------