@stigmer/runner 3.1.0 → 3.1.2

package/src/activities/execute-cursor/__tests__/hitl-ledger.test.ts

@@ -1025,6 +1025,34 @@ describe("reconcileDeniedToolCalls — authoritative hook input overlay", () =>
     expect(tc.approvalContentDigest).not.toBe("");
   });
 
+  it("does NOT overlay a secret-like write's content (DD-26 #2 defensive guard)", async () => {
+    // Normally unreachable — the hook hard-blocks a secret write and records no
+    // ledger entry — but if a hook classify failure fell one through with content,
+    // that content must still never reach args / args_preview / the digest.
+    const tc = toolCall({
+      id: "c1",
+      name: "write",
+      status: ToolCallStatus.TOOL_CALL_COMPLETED,
+      argsPreview: JSON.stringify({ path: ".env" }),
+    });
+    const messages = [aiMessageWith([tc])];
+
+    await reconcileDeniedToolCalls(
+      messages,
+      [{
+        toolName: "Write",
+        token: grantToken("write", ".env"),
+        input: { file_path: ".env", content: "API_KEY=super-secret" },
+      }],
+      undefined,
+      rootBackend(),
+    );
+
+    expect(args(tc).content).toBeUndefined(); // content never overlaid
+    expect(tc.argsPreview).not.toContain("super-secret");
+    expect(tc.approvalContentDigest).toBe(""); // digest not stamped from secret content
+  });
+
   it("stamps the captured edit old/new strings and a digest", async () => {
     const tc = toolCall({
       id: "c1",

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -403,10 +403,11 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     });
 
     it("keeps gating a write to a GITIGNORED path (the snapshot cannot revert it)", () => {
-      // .env-style ignored paths are invisible to the git snapshot, so capture
-      // mode must still gate them for explicit approval.
-      const h = setup({ captureMode: true, gitignored: ["secret.txt"] });
-      expect(h.decide(hookWrite("secret.txt")).permission).toBe("deny");
+      // A NON-secret gitignored path is invisible to the git snapshot, so capture
+      // mode must still gate it for explicit approval. (A secret-like gitignored
+      // write is hard-blocked instead — see the deny-gate secret cases below.)
+      const h = setup({ captureMode: true, gitignored: ["ignored.txt"] });
+      expect(h.decide(hookWrite("ignored.txt")).permission).toBe("deny");
       expect(h.ledger().map((e) => e.toolName)).toContain("Write");
       // A non-ignored sibling still flows.
       expect(h.decide(hookWrite("normal.txt")).permission).toBe("allow");
@@ -418,6 +419,64 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     });
   });
 
+  // Deny-gate secret hard-block (DD-26 #2): with no capture substrate for a write
+  // (capture off — the classic deny-gate — or captureIgnored off in a git-no-
+  // storage workspace) a secret-like WRITE must NOT surface its content for
+  // approval. The hook hard-blocks it with the security message and records NO
+  // ledger entry, so it never becomes an approvable WAITING row; a non-secret
+  // write still deny-gates, and a delete (content-less) stays gated.
+  describe("deny-gate secret hard-block (DD-26 #2)", () => {
+    it("hard-blocks a secret-like write and records NO ledger entry", () => {
+      const h = setup({}); // captureMode off — the classic deny-gate
+      const dec = h.decide(hookWrite(".env", "API_KEY=abc"));
+      expect(dec.permission).toBe("deny");
+      expect(dec.raw).toContain("blocked for security");
+      // SECRET_BLOCKED, not APPROVAL_REQUIRED: the model is told to move on.
+      expect(dec.raw.toLowerCase()).toContain("nothing was written");
+      expect(dec.raw).not.toContain("submitted to the user for approval");
+      expect(h.ledger()).toEqual([]); // never recorded → never approvable
+    });
+
+    it("hard-blocks a secret-like edit (path-fragment match)", () => {
+      const h = setup({});
+      const dec = h.decide(hookEdit(".ssh/id_rsa"));
+      expect(dec.permission).toBe("deny");
+      expect(dec.raw).toContain("blocked for security");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("still deny-gates a NON-secret write and records its content for approval", () => {
+      const h = setup({});
+      const dec = h.decide(hookWrite("notes.md", "hello"));
+      expect(dec.permission).toBe("deny");
+      expect(dec.raw).toContain("submitted to the user for approval"); // APPROVAL_REQUIRED
+      expect(h.ledger().map((e) => e.toolName)).toContain("Write");
+    });
+
+    it("a write-category lease does NOT bypass the secret block", () => {
+      const h = setup({ leasedCategories: ["write"] });
+      expect(h.decide(hookWrite("notes.md", "x")).permission).toBe("allow"); // non-secret rides the lease
+      const dec = h.decide(hookWrite(".env", "SECRET")); // secret is still hard-blocked
+      expect(dec.permission).toBe("deny");
+      expect(dec.raw).toContain("blocked for security");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("hard-blocks a secret write in a git workspace with captureIgnored off (no storage)", () => {
+      const h = setup({ captureMode: true, captureIgnored: false, gitignored: [".env"] });
+      const dec = h.decide(hookWrite(".env", "API_KEY=abc"));
+      expect(dec.permission).toBe("deny");
+      expect(dec.raw).toContain("blocked for security");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("does NOT hard-block a secret DELETE (no content; stays deny-gated)", () => {
+      const h = setup({});
+      expect(h.decide(hookDelete(".env")).permission).toBe("deny");
+      expect(h.ledger().map((e) => e.toolName)).toContain("Delete");
+    });
+  });
+
   // CAS parity (DD-18): with captureIgnored on, a non-secret gitignored write no
   // longer stays on the deny-gate — the hook stages its pre-turn bytes into the
   // cas-observations sidecar and ALLOWS it (apply-then-review), while a secret-

package/src/activities/execute-cursor/__tests__/workspace-provision.test.ts

@@ -249,9 +249,15 @@ describe("provisionCursorWorkspace", () => {
     expect(existsSync(join(workspaceRoot, ".git"))).toBe(false);
   }, GIT_TEST_TIMEOUT_MS);
 
-  it("falls back to the workspace root when there are no workspace entries", async () => {
+  it("gives a session with no workspace entries its own empty per-session directory", async () => {
+    // SessionSpec.workspace_entries: "When empty, the session uses an empty
+    // workspace directory." The shared root would leak other sessions' files
+    // into a "new" session (and falsely serialize unrelated sessions under
+    // the workspace turn lock), so no-entry sessions get sessions/{sessionId}.
     const workspaceRoot = join(tmpRoot, "empty-workspace");
     mkdirSync(workspaceRoot, { recursive: true });
+    // Leftovers from other sessions at the shared root must not be visible.
+    writeFileSync(join(workspaceRoot, "other-session-leftover.md"), "not yours");
 
     const dirs = await provisionCursorWorkspace(
       makeConfig(workspaceRoot),
@@ -260,7 +266,35 @@ describe("provisionCursorWorkspace", () => {
       "test-session-empty",
     );
 
-    expect(dirs).toEqual([workspaceRoot]);
+    expect(dirs).toEqual([join(workspaceRoot, "sessions", "test-session-empty")]);
+    expect(existsSync(dirs[0])).toBe(true);
+    expect(existsSync(join(dirs[0], "other-session-leftover.md"))).toBe(false);
+  }, GIT_TEST_TIMEOUT_MS);
+
+  it("resolves the same per-session directory on every turn of a no-entry session", async () => {
+    const workspaceRoot = join(tmpRoot, "empty-workspace-stable");
+    mkdirSync(workspaceRoot, { recursive: true });
+    const config = makeConfig(workspaceRoot);
+
+    const turn1 = await provisionCursorWorkspace(config, emptySession(), {}, "stable-session");
+    writeFileSync(join(turn1[0], "notes.md"), "turn 1 output");
+    const turn2 = await provisionCursorWorkspace(config, emptySession(), {}, "stable-session");
+
+    expect(turn2).toEqual(turn1);
+    expect(readFileSync(join(turn2[0], "notes.md"), "utf-8")).toBe("turn 1 output");
+  }, GIT_TEST_TIMEOUT_MS);
+
+  it("isolates distinct no-entry sessions from each other", async () => {
+    const workspaceRoot = join(tmpRoot, "empty-workspace-isolated");
+    mkdirSync(workspaceRoot, { recursive: true });
+    const config = makeConfig(workspaceRoot);
+
+    const [dirA] = await provisionCursorWorkspace(config, emptySession(), {}, "session-a");
+    const [dirB] = await provisionCursorWorkspace(config, emptySession(), {}, "session-b");
+
+    expect(dirA).not.toBe(dirB);
+    writeFileSync(join(dirA, "a.md"), "session a");
+    expect(existsSync(join(dirB, "a.md"))).toBe(false);
   }, GIT_TEST_TIMEOUT_MS);
 
   it("mounts a local-path workspace entry without cloning", async () => {

package/src/activities/execute-cursor/attachment-resolver.ts

@@ -1,78 +1,160 @@
 /**
  * Resolves execution attachments into the platform-managed directory.
  *
- * Attachments are files provided as inputs to the agent execution.
- * In local mode, they are read directly from localPath. The files are
- * placed under .stigmer/inputs/ using the platform mount pattern.
+ * Attachments are files provided as inputs to the agent execution. Each is
+ * materialized under the session platform dir's `inputs/` subdirectory and
+ * surfaced to the agent as `.stigmer/inputs/{filename}` through the workspace
+ * `.stigmer` symlink (see stigmer-link.ts), which this resolver guarantees —
+ * an agent with attachments but no skills still gets the link.
+ *
+ * Content sources, in order:
+ * - `localPath` (local mode only): read straight off the caller's disk — the
+ *   CLI fast path, no storage round-trip.
+ * - `storageKey`: downloaded via {@link ArtifactStorage} — the universal path;
+ *   the backend's create pipeline requires a storage key on every attachment
+ *   it accepts, and in local mode the storage reads directly off disk.
+ *
+ * Placement is always `inputs/{filename}` — the platform namespace this
+ * harness can surface in the workspace. An attachment's `mountPath` is
+ * honored by convention, not mechanism: the standard mounts (e.g. the
+ * approved plan at `.stigmer/inputs/plan.md`) resolve to exactly this
+ * placement, and the prompt's `<input_files>` section plus any path-derived
+ * directives are built from the RESOLVED paths, so prompt and filesystem can
+ * never disagree.
+ *
+ * Error model: fail-hard, matching the native harness's attachment injector.
+ * Attachments are explicit user inputs — an execution that silently runs
+ * without one produces silently incorrect results (the "plan file wasn't
+ * found" class of failure). Any attachment that cannot be materialized aborts
+ * the execution with an actionable error.
  */
 
-import { mkdir, copyFile } from "node:fs/promises";
+import { mkdir, copyFile, writeFile } from "node:fs/promises";
 import { join, basename } from "node:path";
 import type { Attachment } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import type { ArtifactStorage } from "../../shared/artifact-storage.js";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
+import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "./stigmer-link.js";
 
-const STIGMER_LOCAL_STATE_DIR = ".stigmer";
 const INPUTS_SUBDIR = "inputs";
 
 export interface ResolvedAttachment {
   filename: string;
+  /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
   relativePath: string;
 }
 
+export interface AttachmentResolverOptions {
+  sessionId: string;
+  primaryWorkspaceDir: string;
+  mode: "local" | "cloud";
+  /**
+   * Artifact storage for `storageKey` downloads. `undefined` when the runner
+   * could not build a store (proxy misconfig) — a storage-backed attachment
+   * then fails with an actionable error rather than a silent skip.
+   */
+  storage: ArtifactStorage | undefined;
+}
+
+export class AttachmentResolutionError extends Error {
+  readonly attachmentFilename: string;
+  readonly reason: string;
+
+  constructor(attachmentFilename: string, reason: string) {
+    super(`Attachment '${attachmentFilename}': ${reason}`);
+    this.name = "AttachmentResolutionError";
+    this.attachmentFilename = attachmentFilename;
+    this.reason = reason;
+  }
+}
+
 /**
- * Resolve attachments by copying them to the platform-managed directory.
- *
- * In local mode: copies from localPath to .stigmer/inputs/{filename}
- * Returns relative paths for prompt injection.
+ * Materialize all attachments under `.stigmer/inputs/` and return their
+ * workspace-relative paths for prompt injection. Throws
+ * {@link AttachmentResolutionError} on the first attachment that cannot be
+ * materialized (fail-hard — see module doc).
  */
 export async function resolveAttachments(
   attachments: Attachment[],
-  sessionId: string,
-  primaryWorkspaceDir: string,
-  mode: "local" | "cloud",
+  options: AttachmentResolverOptions,
 ): Promise<ResolvedAttachment[]> {
   if (attachments.length === 0) return [];
 
-  const platformDir = getPlatformDir(sessionId);
+  const platformDir = getPlatformDir(options.sessionId);
   const inputsDir = join(platformDir, INPUTS_SUBDIR);
   await mkdir(inputsDir, { recursive: true });
 
-  const results: ResolvedAttachment[] = [];
+  // The symlink is what makes `inputs/` visible in the workspace; without it
+  // every resolved path below would dangle (the skill resolver also ensures
+  // it, but only when the agent has skills).
+  await ensureStigmerSymlink(options.primaryWorkspaceDir, platformDir);
 
+  const results: ResolvedAttachment[] = [];
   for (const attachment of attachments) {
-    try {
-      const resolved = await resolveAttachment(attachment, inputsDir, mode);
-      if (resolved) results.push(resolved);
-    } catch (err) {
-      console.warn(
-        `Failed to resolve attachment ${attachment.filename}: ${err instanceof Error ? err.message : err}`,
-      );
-    }
+    results.push(await resolveAttachment(attachment, inputsDir, options));
   }
 
+  console.log(
+    `[attachment-resolver] resolved ${results.length} attachment(s): ` +
+    results.map((r) => r.relativePath).join(", "),
+  );
+
   return results;
 }
 
 async function resolveAttachment(
   attachment: Attachment,
   inputsDir: string,
-  mode: "local" | "cloud",
-): Promise<ResolvedAttachment | null> {
-  if (mode === "local" && attachment.localPath) {
+  options: AttachmentResolverOptions,
+): Promise<ResolvedAttachment> {
+  // Local-mode fast path: the file is already on this machine's disk.
+  if (options.mode === "local" && attachment.localPath) {
     const filename = attachment.filename || basename(attachment.localPath);
-    const destPath = join(inputsDir, filename);
-    await copyFile(attachment.localPath, destPath);
-
+    try {
+      await copyFile(attachment.localPath, join(inputsDir, filename));
+    } catch (err) {
+      throw new AttachmentResolutionError(
+        attachment.filename,
+        `failed to copy local file '${attachment.localPath}': ` +
+        `${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
     return {
       filename,
       relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
     };
   }
 
-  // Cloud mode: download from storage_key (not yet implemented for cursor-runner)
-  console.warn(
-    `Attachment ${attachment.filename}: cloud storage download not yet implemented for cursor-runner`,
-  );
-  return null;
-}
+  // Universal path: download the uploaded content by storage key.
+  if (!attachment.storageKey) {
+    throw new AttachmentResolutionError(
+      attachment.filename,
+      "missing storageKey — cannot download attachment from storage",
+    );
+  }
+  if (!options.storage) {
+    throw new AttachmentResolutionError(
+      attachment.filename,
+      `artifact storage is unavailable, so this attachment ` +
+      `(key: ${attachment.storageKey}) cannot be downloaded`,
+    );
+  }
 
+  const filename = attachment.filename || basename(attachment.storageKey);
+  let content: Buffer;
+  try {
+    content = await options.storage.download(attachment.storageKey);
+  } catch (err) {
+    throw new AttachmentResolutionError(
+      attachment.filename,
+      `failed to download from storage (key: ${attachment.storageKey}): ` +
+      `${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+  await writeFile(join(inputsDir, filename), content);
+
+  return {
+    filename,
+    relativePath: join(STIGMER_LOCAL_STATE_DIR, INPUTS_SUBDIR, filename),
+  };
+}

package/src/activities/execute-cursor/cas-observations.ts

@@ -143,6 +143,46 @@ function regexLiteral(re: RegExp): string {
   return `new RegExp(${JSON.stringify(re.source)},${JSON.stringify(re.flags)})`;
 }
 
+/**
+ * The JS lines that define `isSecret(p)` inside a hook-embedded script — a
+ * byte-identical mirror of {@link isSecretLikePath} generated from the SAME
+ * {@link SECRET_BASENAME_PATTERNS}/{@link SECRET_PATH_PATTERNS} arrays.
+ *
+ * ONE definition, so every hook-side classifier (the capture-mode staging script
+ * and the deny-gate classify-only script) agrees with the runner-side classifier
+ * by construction — the "no bash-regex, no divergence" invariant this module owns.
+ * Authored as single-quoted-bash strings, so the JS must contain no single quotes.
+ */
+function secretClassifierFragment(): string[] {
+  const base = SECRET_BASENAME_PATTERNS.map(regexLiteral).join(",");
+  const pathPatterns = SECRET_PATH_PATTERNS.map(regexLiteral).join(",");
+  return [
+    `const baseName=(p)=>{const n=p.replace(/\\\\/g,"/");const i=n.lastIndexOf("/");return i>=0?n.slice(i+1):n;};`,
+    `const BASE=[${base}];const PATHP=[${pathPatterns}];`,
+    `const isSecret=(p)=>{if(!p)return true;const nm=p.replace(/\\\\/g,"/");const b=baseName(nm).toLowerCase();for(const r of BASE){if(r.test(b))return true;}const lp=nm.toLowerCase();for(const r of PATHP){if(r.test(lp))return true;}return false;};`,
+  ];
+}
+
+/**
+ * Build a standalone Node.js script that CLASSIFIES a single path as secret-like
+ * without staging anything — the deny-gate (no-capture-substrate) counterpart of
+ * {@link buildObservationStagingScript}.
+ *
+ * Invoked as `printf %s "$SALIENT" | node -e '<this>'` — the path rides stdin (no
+ * argv escaping). Prints `secret` for a secret-like path, `ok` otherwise. Empty
+ * input classifies as `secret` (fail-closed, matching {@link isSecretLikePath}).
+ * The Cursor hook uses this to hard-block a secret write on the deny-gate so its
+ * content never reaches an approval (DD-26 follow-up #2); it shares the classifier
+ * fragment above, so its verdict equals the runner's {@link isSecretLikePath}.
+ */
+export function buildSecretClassifyScript(): string {
+  return [
+    `let salient="";try{salient=require("fs").readFileSync(0,"utf8");}catch(e){salient="";}`,
+    ...secretClassifierFragment(),
+    `process.stdout.write(isSecret(salient)?"secret":"ok");`,
+  ].join("");
+}
+
 /**
  * Build the standalone Node.js script the hook runs to observe a single
  * gitignored write — the disk-backed mirror of `CasCaptureFilesystemBackend`'s
@@ -165,8 +205,6 @@ function regexLiteral(re: RegExp): string {
  * single-quoted-bash string, so the JS must contain no single quotes.
  */
 export function buildObservationStagingScript(): string {
-  const base = SECRET_BASENAME_PATTERNS.map(regexLiteral).join(",");
-  const pathPatterns = SECRET_PATH_PATTERNS.map(regexLiteral).join(",");
   const metaSuffix = JSON.stringify(META_SUFFIX);
   const blobSuffix = JSON.stringify(BLOB_SUFFIX);
   return [
@@ -182,9 +220,7 @@ export function buildObservationStagingScript(): string {
     `let rel=path.relative(wsRoot,abs).split(path.sep).join("/");`,
     `if(!rel||rel===".."||rel.startsWith("../")){process.stdout.write("error");process.exit(0);}`,
     // --- secret classifier: byte-identical mirror of isSecretLikePath ---
-    `const baseName=(p)=>{const n=p.replace(/\\\\/g,"/");const i=n.lastIndexOf("/");return i>=0?n.slice(i+1):n;};`,
-    `const BASE=[${base}];const PATHP=[${pathPatterns}];`,
-    `const isSecret=(p)=>{if(!p)return true;const nm=p.replace(/\\\\/g,"/");const b=baseName(nm).toLowerCase();for(const r of BASE){if(r.test(b))return true;}const lp=nm.toLowerCase();for(const r of PATHP){if(r.test(lp))return true;}return false;};`,
+    ...secretClassifierFragment(),
     `const key=crypto.createHash("sha256").update(rel,"utf8").digest("hex");`,
     `const metaPath=path.join(obsDir,key+${metaSuffix});const blobPath=path.join(obsDir,key+${blobSuffix});`,
     `try{fs.mkdirSync(obsDir,{recursive:true});}catch(e){}`,

package/src/activities/execute-cursor/hook-script.ts

@@ -92,7 +92,7 @@ import {
   EDIT_NEW_FIELDS,
   WRITE_CONTENT_FIELDS,
 } from "../../shared/file-tools.js";
-import { buildObservationStagingScript, CAS_OBSERVATIONS_DIRNAME } from "./cas-observations.js";
+import { buildObservationStagingScript, buildSecretClassifyScript, CAS_OBSERVATIONS_DIRNAME } from "./cas-observations.js";
 
 // Shown to the model when the gate denies a tool call. It must NOT teach the
 // model to ask for permission in prose or to "stop and wait" — that framing
@@ -275,6 +275,7 @@ export function generateHookScript(activePointerPath: string, workspaceRoot = ""
   const categoryCaseArms = buildCategoryCaseArms();
   const nodeIdentityScript = buildNodeIdentityScript();
   const observationStagingScript = buildObservationStagingScript();
+  const secretClassifyScript = buildSecretClassifyScript();
   const nodeBin = process.execPath;
   return `#!/bin/bash
 # Stigmer HITL approval hook for Cursor (preToolUse + beforeMCPExecution).
@@ -569,6 +570,23 @@ if [ -n "$CATEGORY" ]; then
       exit 0
     fi
   fi
+  # Deny-gate secret hard-block (DD-26 #2): a secret-like WRITE that reaches the
+  # deny-gate (no capture substrate for it — capture off, or captureIgnored off in
+  # a git-no-storage workspace) must not surface its content for approval. Classify
+  # byte-identically to isSecretLikePath (no staging) and, on a match, hard-block
+  # with the security message: the agent continues, nothing is written, and NO
+  # content is recorded to the ledger. Placed before the grant/lease checks so a
+  # write-category lease can never bypass it; only writes are content-bearing
+  # (deletes stay gated). Fail-open on a classify error — the write falls to the
+  # normal deny-gate and the runner-side backstop still withholds any secret
+  # content before persist.
+  if [ "$CATEGORY" = "write" ] && [ -n "$SALIENT" ]; then
+    SECRET_RESULT=$(printf '%s' "$SALIENT" | ELECTRON_RUN_AS_NODE=1 "$NODE_BIN" -e '${secretClassifyScript}' 2>/dev/null || echo ok)
+    if [ "$SECRET_RESULT" = "secret" ]; then
+      echo '{"permission":"deny","agent_message":"${SECRET_BLOCKED_AGENT_MESSAGE}","user_message":"Blocked for security: this file matches a secret-like path and was not written."}'
+      exit 0
+    fi
+  fi
   # Reinvocation grant: allow when the CONTENT-exact token (a file edit approved
   # earlier with this exact content) OR the COARSE token (a shell/delete, or the
   # content-less degrade) is in approvedGrantTokens. A sibling edit to the same