@stigmer/runner 3.1.0 → 3.1.2

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -1,5 +1,7 @@
 import { describe, it, expect } from "vitest";
+import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { buildEnhancedSystemPrompt } from "../prompt-builder.js";
+import { PLAN_MODE_DIRECTIVE } from "../../../shared/plan-mode-prompt.js";
 import { SourceType } from "../../../shared/workspace/types.js";
 import type { ProvisionResult } from "../../../shared/workspace/types.js";
 
@@ -205,4 +207,90 @@ describe("buildEnhancedSystemPrompt", () => {
 
     expect(prompt).not.toContain("## Workspace");
   });
+
+  describe("plan mode", () => {
+    const base = {
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [],
+    };
+
+    it("appends the shared plan-mode directive as the final section", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        interactionMode: InteractionMode.PLAN,
+      });
+
+      expect(prompt).toContain("## Plan mode");
+      expect(prompt.endsWith(PLAN_MODE_DIRECTIVE)).toBe(true);
+    });
+
+    it("omits the directive for Agent mode", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        interactionMode: InteractionMode.AGENT,
+      });
+
+      expect(prompt).not.toContain("## Plan mode");
+    });
+
+    it("omits the directive when the mode is unset", () => {
+      const prompt = buildEnhancedSystemPrompt(base);
+
+      expect(prompt).not.toContain("## Plan mode");
+    });
+  });
+
+  describe("build from plan", () => {
+    const base = {
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [],
+    };
+    const planFile = {
+      filename: "plan.md",
+      path: ".stigmer/inputs/plan.md",
+      size: 1024,
+    };
+
+    it("appends the implement-plan directive pointing at the injected plan", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        buildFromPlan: true,
+        injectedFiles: [planFile],
+      });
+
+      expect(prompt).toContain("## Implement the approved plan");
+      expect(prompt).toContain("`.stigmer/inputs/plan.md`");
+      expect(prompt).toContain("APPROVED");
+    });
+
+    it("falls back to the conversation-plan variant when the plan did not inject", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        buildFromPlan: true,
+      });
+
+      expect(prompt).toContain("## Implement the approved plan");
+      expect(prompt).toContain("conversation above");
+      expect(prompt).not.toContain("plan.md");
+    });
+
+    it("omits the directive for an ordinary execution", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        injectedFiles: [planFile],
+      });
+
+      expect(prompt).not.toContain("## Implement the approved plan");
+    });
+  });
 });

package/src/activities/execute-deep-agent/__tests__/sequential-gate-resume.test.ts

@@ -51,7 +51,9 @@ import type { SetupResult } from "../setup.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -187,7 +189,9 @@ function fakeMemoryGateSetup(opts: {
     agent: {},
     session: { spec: { workspaceEntries: [] } },
     workspaceBackend: {
-      rootDir: "/tmp/ws",
+      // Unique per test file: the workspace turn lock keys on this path, and a
+      // path shared across files would serialize parallel test workers for real.
+      rootDir: "/tmp/stigmer-test-ws-seq-gate",
       exists: vi.fn(async () => false),
       readFile: vi.fn(async () => ""),
     },
@@ -252,6 +256,7 @@ const memoryConfig: Config = {
   checkpointerProxyEndpoint: null,
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
 };
 
 function toolCallIds(status: AgentExecutionStatus): string[] {

package/src/activities/execute-deep-agent/index.ts

@@ -19,7 +19,13 @@ import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/a
 import { ExecutionPhase, FileCaptureClass, FileChangeSetStatus, InteractionMode, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { activityStarted, activityFinished } from "../../idle-watchdog.js";
 import { normalizeActivityInput, type ExecuteActivityInput } from "../../shared/activity-input.js";
-import { persistStatus, slimStatus, utcTimestamp } from "../../shared/status.js";
+import { persistStatus, reportSetupProgress, slimStatus, utcTimestamp } from "../../shared/status.js";
+import {
+  acquireWorkspaceLock,
+  WorkspaceLockCancelledError,
+  WorkspaceLockTimeoutError,
+  type ReleaseWorkspaceLock,
+} from "../../shared/workspace/workspace-lock.js";
 import type { ToolOutputOffloadContext } from "../../shared/status-offload.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { classifyTool } from "../../shared/tool-kind.js";
@@ -48,7 +54,7 @@ import { hasCandidateCaptured } from "../../shared/filereview/events.js";
 import { casBlobReader, type CasPathCapture } from "../../shared/filereview/cas-substrate.js";
 import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
 import type { CasCaptureObserver } from "./cas-capture-observer.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { collectSubAgentToolCallIds, withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { stampFlowedFileEditRows, stampFlowedSubAgentFileEditRows } from "./stamp-flowed-rows.js";
 
 /** The harness id stamped on the deep-agent's file-review ledger events. */
@@ -75,6 +81,11 @@ export function createDeepAgentActivities(config: Config) {
       const { executionId, threadId, turnSeq } = normalizeActivityInput(arg0, arg1);
       activityStarted();
       let setup: SetupResult | null = null;
+      // Exclusive turn lock on the workspace working tree — held across the
+      // entire tree-mutating window (decision reconcile, agent writes,
+      // candidate capture, write-back) and released in the finally. Mirrors
+      // the Cursor harness; see shared/workspace/workspace-lock.ts.
+      let releaseWorkspaceLock: ReleaseWorkspaceLock | undefined;
 
       try {
         console.log(`[ExecuteDeepAgent] Started for execution ${executionId}`);
@@ -163,6 +174,45 @@ export function createDeepAgentActivities(config: Config) {
         const gitRoot = setup.workspaceBackend.rootDir;
         const changeSetId = `${executionId}:${turnSeq}`;
 
+        // Serialize this turn against every other execution sharing this
+        // working tree — an unserialized concurrent write lands inside this
+        // turn's baseline→candidate window and gets misattributed to this
+        // turn's review. Acquired before ANY tree mutation below (decision
+        // reconcile, agent writes, candidate capture, write-back); waiting
+        // surfaces a visible state and heartbeats, and a cancel aborts the
+        // wait immediately. Mirrors the Cursor harness wiring exactly.
+        try {
+          releaseWorkspaceLock = await acquireWorkspaceLock(gitRoot, {
+            onWaiting: () => reportSetupProgress(
+              client, executionId, "Waiting for workspace — in use by another session",
+            ),
+            heartbeat: () => Context.current().heartbeat(),
+            signal: Context.current().cancellationSignal,
+            timeoutMs: config.workspaceLockTimeoutMs,
+          });
+        } catch (lockErr) {
+          if (lockErr instanceof WorkspaceLockCancelledError) {
+            throw new CancelledFailure("Activity cancelled while waiting for the workspace lock");
+          }
+          if (lockErr instanceof WorkspaceLockTimeoutError) {
+            const failedStatus = create(AgentExecutionStatusSchema, {
+              phase: ExecutionPhase.EXECUTION_FAILED,
+              error: lockErr.message,
+              completedAt: utcTimestamp(),
+              messages: [
+                create(AgentMessageSchema, {
+                  type: MessageType.MESSAGE_SYSTEM,
+                  content: `Execution failed: ${lockErr.message}`,
+                  timestamp: utcTimestamp(),
+                }),
+              ],
+            });
+            await persistStatus(client, executionId, failedStatus, { offload: statusOffload });
+            return slimStatus(failedStatus);
+          }
+          throw lockErr;
+        }
+
         // (1) Capture-mode resume — reconcile any DECIDED change set FIRST (this
         // drops the per-execution refs), before the next baseline re-pins them
         // (refs are executionId-keyed). Then (2) short-circuit a pure file-review
@@ -308,6 +358,20 @@ export function createDeepAgentActivities(config: Config) {
           executionId,
         });
 
+        // Never-persist-secret backstop (DD-26 #2): withhold content from any
+        // built-in write row targeting a secret-like path, across the top-level
+        // and sub-agent transcripts, before ANY persist below. On the deny-gate a
+        // secret write is hard-blocked (a COMPLETED row) or — under
+        // auto_approve_all, where no gate is installed — flowed; either way the
+        // streamed row still carries `args` from handleToolStarted, and the
+        // capture-mode stamping pass (which performs the same scrub) does not run
+        // here. Idempotent / a no-op in capture mode. This single post-stream
+        // sweep is the one choke point that precedes every downstream persist.
+        withholdSecretContentFromMessages(
+          initialStatus.messages,
+          initialStatus.subAgentExecutions,
+        );
+
         // Turn boundary (capture mode): capture the candidate change set from the
         // git diff and author CANDIDATE_CAPTURED, then stamp the flowed file-edit
         // rows with the change set id — they stay visible in place as
@@ -590,6 +654,10 @@ export function createDeepAgentActivities(config: Config) {
 
       } finally {
         await cleanup(setup);
+        // Release the workspace turn lock LAST — the next queued turn must
+        // not baseline until every mutation of this one has landed.
+        // Idempotent and non-throwing (see workspace-lock.ts).
+        await releaseWorkspaceLock?.();
         activityFinished();
       }
     },

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -7,8 +7,14 @@
  */
 
 import { relative } from "node:path";
+import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { ProvisionResult, GitMetadata } from "../../shared/workspace/types.js";
 import { SourceType } from "../../shared/workspace/types.js";
+import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
+import {
+  buildImplementPlanDirective,
+  findApprovedPlanPath,
+} from "../../shared/implement-plan-prompt.js";
 
 const RESPONSE_RULES = `
 
@@ -84,6 +90,22 @@ export interface PromptBuilderInput {
   workspaceFileRefs: string[];
   workspaceRoot: string;
   injectedFiles: InjectedFile[];
+  /**
+   * The execution's interaction mode. PLAN appends the shared plan-mode
+   * directive so the model knows the turn's deliverable is a plan document.
+   * Tool-level write enforcement is separate (see setup.ts permissions) —
+   * without this directive the model is silently read-only but never told
+   * to produce a plan.
+   */
+  interactionMode?: InteractionMode;
+  /**
+   * The execution is a Build-from-plan turn (spec.execution_config
+   * .build_from_plan): appends the shared implement-plan directive, pointing
+   * the model at the injected approved plan document (or, when the plan
+   * attachment did not materialize, at the conversation's plan). The user
+   * message itself is just a short label ("Build from plan").
+   */
+  buildFromPlan?: boolean;
 }
 
 export interface InjectedFile {
@@ -128,6 +150,23 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
   prompt += RESPONSE_RULES;
   prompt += SUB_AGENT_RULES;
 
+  // Last sections on purpose: these per-execution directives redefine the
+  // turn's deliverable, so they must be the freshest instruction the model
+  // reads. (PLAN and build_from_plan are mutually exclusive in practice —
+  // the build turn is always an Agent-mode execution.)
+  if (input.interactionMode === InteractionMode.PLAN) {
+    prompt += "\n\n## Plan mode\n\n" + PLAN_MODE_DIRECTIVE;
+  }
+
+  if (input.buildFromPlan) {
+    const planPath = findApprovedPlanPath(
+      input.injectedFiles.map((f) => f.path),
+    );
+    prompt +=
+      "\n\n## Implement the approved plan\n\n" +
+      buildImplementPlanDirective(planPath);
+  }
+
   return prompt;
 }
 

package/src/activities/execute-deep-agent/setup.ts

@@ -35,6 +35,7 @@ import { isGitWorkTree, isPathCapturable } from "../../shared/filereview/git-sub
 import { deriveCaptureMode } from "../../shared/filereview/capture.js";
 import { resolveWorkspacePath } from "../../shared/file-change.js";
 import { ensurePlatformDir } from "../../shared/workspace/platform-dir.js";
+import { resolveSessionWorkspaceRoot } from "../../shared/workspace/session-root.js";
 import { buildWorkspaceFileTree } from "../../shared/workspace/file-tree.js";
 import { reportSetupProgress } from "../../shared/status.js";
 import { resolveEnvironment, type EnvironmentResult } from "./environment.js";
@@ -49,7 +50,7 @@ import { getDefaultModel } from "../../shared/model-registry.js";
 import { buildChatModel } from "../../shared/model-client.js";
 import {
   loadArtifactStorageConfig,
-  createArtifactStorage,
+  resolveUsableArtifactStorage,
   type ArtifactStorage,
 } from "../../shared/artifact-storage.js";
 import {
@@ -201,20 +202,14 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     await reportSetupProgress(client, executionId, "Resolving environment…");
     const envResult: EnvironmentResult = await resolveEnvironment(client, executionId);
 
-    // Step 6: Create artifact storage. Best-effort, mirroring the Cursor harness:
-    // `createArtifactStorage` throws only for proxy transport with a missing
-    // token/endpoint (a misconfiguration; local storage never throws). We degrade
-    // rather than crash — an absent store flips capture mode off (deny-gate
-    // fallback below) and disables offload, instead of failing the whole execution.
-    let artifactStorage: ArtifactStorage | undefined;
-    try {
-      artifactStorage = createArtifactStorage(loadArtifactStorageConfig(config));
-    } catch (storageErr) {
-      console.warn(
-        `[setup] artifact storage unavailable — capture degrades to the deny-gate ` +
-        `and tool-output offload is disabled: execution=${executionId}, error=${storageErr}`,
-      );
-    }
+    // Step 6: Resolve a usable artifact store (shared with the Cursor harness so
+    // both degrade identically). Returns `undefined` — never throws — when there
+    // is no working substrate: a proxy misconfig OR an unwritable local path
+    // (which `createArtifactStorage` cannot detect, since it just holds a path).
+    // An absent store flips capture mode off (deny-gate fallback below) and
+    // disables offload, instead of flowing writes then crashing at the boundary.
+    const artifactStorage: ArtifactStorage | undefined =
+      await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
 
     // Step 7: Provision workspace
     await reportSetupProgress(client, executionId, "Initializing workspace…");
@@ -372,6 +367,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       workspaceFileRefs: execution.spec!.workspaceFileRefs || [],
       workspaceRoot: workspaceBackend.rootDir,
       injectedFiles,
+      interactionMode: execution.spec!.executionConfig?.interactionMode,
+      buildFromPlan: execution.spec!.executionConfig?.buildFromPlan,
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -631,6 +628,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
 
 /**
  * Provision workspace from session workspace entries.
+ *
+ * A session with no entries gets its own empty per-session directory (see
+ * shared/workspace/session-root.ts) — never the shared root, which would
+ * leak other sessions' files into it. Mirrors the Cursor harness's
+ * provisionCursorWorkspace exactly.
  */
 async function provisionWorkspace(
   config: Config,
@@ -639,13 +641,19 @@ async function provisionWorkspace(
   sessionId: string,
 ): Promise<{ workspaceBackend: WorkspaceBackend; provisionResults: ProvisionResult[] }> {
   const platformDir = await ensurePlatformDir(sessionId);
-  const workspaceBackend = new LocalWorkspaceBackend(config.workspaceRootDir, platformDir);
 
   const workspaceEntries = session.spec!.workspaceEntries || [];
   if (workspaceEntries.length === 0) {
-    return { workspaceBackend, provisionResults: [] };
+    const sessionRoot = await resolveSessionWorkspaceRoot(
+      config.workspaceRootDir, workspaceEntries, sessionId,
+    );
+    return {
+      workspaceBackend: new LocalWorkspaceBackend(sessionRoot, platformDir),
+      provisionResults: [],
+    };
   }
 
+  const workspaceBackend = new LocalWorkspaceBackend(config.workspaceRootDir, platformDir);
   const provisioner = new WorkspaceProvisioner();
   const provisionResults = await provisioner.provisionAll(
     workspaceEntries.map(entry => ({

package/src/config.ts

@@ -37,6 +37,12 @@ import { homedir, tmpdir } from "node:os";
  */
 export const DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS = 180_000;
 
+// Re-exported so the runner/manager options mappers default the lock-wait
+// bound from the same constant the lock module owns (no drift across the
+// three construction sites — mirrors DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS).
+export { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
+import { DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./shared/workspace/workspace-lock.js";
+
 export interface Config {
   readonly taskQueue: string;
   readonly temporalAddress: string;
@@ -83,6 +89,12 @@ export interface Config {
    * heartbeatTimeout (process liveness) and the 30s keep-alive heartbeat.
    */
   readonly cursorStreamStallTimeoutMs: number;
+  /**
+   * Max wait (milliseconds) for the per-workspace turn lock before failing
+   * the execution with a "workspace is in use by another session" error.
+   * See shared/workspace/workspace-lock.ts for the serialization model.
+   */
+  readonly workspaceLockTimeoutMs: number;
   /** Shared mutable token reference for dynamic token updates (manager mode). */
   readonly stigmerTokenRef?: { current: string | null };
 }
@@ -145,6 +157,10 @@ export function loadConfig(): Config {
     ? parseInt(process.env.CURSOR_STREAM_STALL_TIMEOUT_MS, 10)
     : DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS;
 
+  const workspaceLockTimeoutMs = process.env.WORKSPACE_LOCK_TIMEOUT_MS
+    ? parseInt(process.env.WORKSPACE_LOCK_TIMEOUT_MS, 10)
+    : DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS;
+
   return {
     taskQueue,
     temporalAddress,
@@ -162,6 +178,7 @@ export function loadConfig(): Config {
     checkpointerProxyEndpoint,
     primaryModel,
     cursorStreamStallTimeoutMs,
+    workspaceLockTimeoutMs,
   };
 }
 

package/src/middleware/__tests__/approval-gate.test.ts

@@ -398,7 +398,10 @@ describe("ApprovalGateMiddleware", () => {
       expect(mockedInterrupt).not.toHaveBeenCalled();
     });
 
-    it("KEEPS GATING a gitignored write (it cannot be captured or reverted)", async () => {
+    it("KEEPS GATING a non-secret gitignored write (it cannot be captured or reverted)", async () => {
+      // A NON-secret gitignored path: no CAS routing (captureIgnored unset) and not
+      // secret-like, so it stays on the interrupt gate. (A secret-like gitignored
+      // write is hard-blocked instead — see the DD-26 #2 deny-gate cases below.)
       const mw = createApprovalGateMiddleware(makeConfig({
         fileCaptureMode: true,
         isCapturablePath: async () => false, // gitignored
@@ -406,7 +409,7 @@ describe("ApprovalGateMiddleware", () => {
       mockedInterrupt.mockReturnValue({ action: "approve" });
 
       await mw.wrapToolCall!(
-        makeRequest({ name: "write", args: { path: ".env" } }),
+        makeRequest({ name: "write", args: { path: "dist/bundle.js" } }),
         passthrough,
       );
 
@@ -650,12 +653,12 @@ describe("ApprovalGateMiddleware", () => {
       expect(mockedInterrupt).toHaveBeenCalledTimes(1);
     });
 
-    it("GATES a secret-like write when capture mode is off — Cursor parity: gated, NOT hard-blocked", async () => {
-      // The secret hard-block lives only inside the fileCaptureMode+captureIgnored
-      // arm; with no substrate that arm is off, so a secret-like write is GATED
-      // (shown for approval) rather than hard-blocked — exactly what Cursor's
-      // no-storage hook does. It exposes no more than Cursor (secret parity, see
-      // the parity investigation in the project docs).
+    it("HARD-BLOCKS a secret-like write when capture mode is off (DD-26 #2): never gated, never applied", async () => {
+      // DD-26 follow-up #2 supersedes the earlier "gated, not hard-blocked" parity:
+      // a secret-like write must NEVER surface its content for approval, in ANY
+      // mode. On the deny-gate it is hard-blocked exactly like the capture-mode
+      // secret block — never interrupted, never applied. The content never reaches
+      // a pending approval or the persisted transcript.
       const handler = vi.fn(passthrough);
       const recordBlockedSecret = vi.fn();
       const mw = createApprovalGateMiddleware(makeConfig({
@@ -665,14 +668,76 @@ describe("ApprovalGateMiddleware", () => {
       }));
       mockedInterrupt.mockReturnValue({ action: "approve" });
 
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "write", args: { path: ".env", content: "API_KEY=xyz" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled(); // hard-block, not a pause
+      expect(handler).not.toHaveBeenCalled(); // never applied
+      expect(recordBlockedSecret).toHaveBeenCalledWith(".env");
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("hard-blocks a secret-like edit too (id_rsa via path fragment)", async () => {
+      const handler = vi.fn(passthrough);
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: false,
+        captureIgnored: false,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "edit", args: { path: ".ssh/id_rsa", old_string: "a", new_string: "b" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect(handler).not.toHaveBeenCalled();
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("hard-blocks a secret write in a git workspace with no storage (captureMode on, captureIgnored off)", async () => {
+      // captureMode true + captureIgnored false = a git workspace with no artifact
+      // storage. A gitignored secret write skips the captureIgnored arm and would
+      // otherwise have reached the deny-gate (a leak); it is now hard-blocked too,
+      // and the recorded path lets the turn boundary author a content-less entry.
+      const handler = vi.fn(passthrough);
+      const recordBlockedSecret = vi.fn();
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: true,
+        isCapturablePath: async () => false, // gitignored
+        captureIgnored: false, // no artifact storage
+        recordBlockedSecret,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "write", args: { path: "secrets.yaml", content: "token: t" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect(handler).not.toHaveBeenCalled();
+      expect(recordBlockedSecret).toHaveBeenCalledWith("secrets.yaml");
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("still GATES a NON-secret write when capture mode is off (deny-gate unchanged)", async () => {
+      const handler = vi.fn(passthrough);
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: false,
+        captureIgnored: false,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
       await mw.wrapToolCall!(
-        makeRequest({ name: "write", args: { path: ".env" } }),
+        makeRequest({ name: "write", args: { path: "notes.md", content: "hi" } }),
         handler,
       );
 
-      expect(mockedInterrupt).toHaveBeenCalledTimes(1); // gated, not hard-blocked
-      expect(recordBlockedSecret).not.toHaveBeenCalled(); // no capture arm to record it
-      expect(handler).toHaveBeenCalledTimes(1); // flows only after the user approves
+      expect(mockedInterrupt).toHaveBeenCalledTimes(1); // a non-secret write still gates
+      expect(handler).toHaveBeenCalledTimes(1); // flows after approve
     });
 
     it("still auto-approves read-only built-ins when capture mode is off", async () => {

package/src/middleware/approval-gate.ts

@@ -138,6 +138,24 @@ const CATEGORY_APPROVAL_MESSAGE: Record<ToolApprovalCategory, string> = {
   shell: "Execute command: {{args.command}}",
 };
 
+/**
+ * The ToolMessage returned when a secret-like write is hard-blocked (DD-E /
+ * DD-26 #2): the write is NEVER applied and the graph continues (this replaces
+ * the tool call's side effect, so the model moves on rather than waiting). The
+ * path is named (a filename is not itself the secret); the CONTENT is not echoed.
+ * Shared by the capture-mode secret block and the deny-gate secret block so both
+ * speak with one voice.
+ */
+function secretBlockToolMessage(toolName: string, path: string, toolCallId: string): ToolMessage {
+  return new ToolMessage({
+    content:
+      `Tool '${toolName}' was blocked for security: '${path}' matches a ` +
+      `secret-like path Stigmer will not capture for review. Nothing was written.`,
+    tool_call_id: toolCallId,
+    name: toolName,
+  });
+}
+
 export function createApprovalGateMiddleware(
   config: ApprovalGateConfig,
 ): StigmerMiddleware {
@@ -183,13 +201,7 @@ export function createApprovalGateMiddleware(
               // and NEVER captured. Record it so the turn boundary authors a
               // DIFF_UNREVIEWABLE entry (blocking approval); nothing is written.
               config.recordBlockedSecret?.(path);
-              return new ToolMessage({
-                content:
-                  `Tool '${toolName}' was blocked for security: '${path}' matches a ` +
-                  `secret-like path Stigmer will not capture for review. Nothing was written.`,
-                tool_call_id: toolCall.id,
-                name: toolName,
-              });
+              return secretBlockToolMessage(toolName, path, toolCall.id);
             }
             if (category === "write") {
               // Non-secret gitignored write/edit: flows (apply-then-review). The
@@ -203,6 +215,26 @@ export function createApprovalGateMiddleware(
         }
       }
 
+      // Deny-gate secret hard-block (DD-26 #2): a built-in file WRITE to a
+      // secret-like path that reaches here has no capture substrate for it — the
+      // classic no-storage deny-gate, or a git workspace with no artifact storage
+      // whose gitignored write skipped the captureIgnored arm above. It must NOT
+      // surface its content for approval, so hard-block it (never applied, graph
+      // continues) exactly like the capture-mode secret block — a secret write is
+      // never applied or persisted in ANY mode. Placed AFTER the capture block so
+      // capture-mode paths stay byte-identical (a capturable write already flowed;
+      // a captureIgnored gitignored secret is already blocked). Deletes carry no
+      // content and stay on the deny-gate. recordBlockedSecret is a no-op unless a
+      // turn boundary reads it (the git-no-storage case, where it authors a
+      // content-less DIFF_UNREVIEWABLE).
+      if (!serverSlug && category === "write") {
+        const path = extractFilePath(toolCall.args);
+        if (path !== null && isSecretLikePath(path)) {
+          config.recordBlockedSecret?.(path);
+          return secretBlockToolMessage(toolName, path, toolCall.id);
+        }
+      }
+
       const requirement = resolveToolApproval(
         toolName,
         serverSlug,

package/src/runner-manager.ts

@@ -24,7 +24,7 @@ import {
 } from "@temporalio/worker";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
@@ -91,6 +91,9 @@ export interface RunnerManagerOptions {
   /** No-progress bound for the Cursor harness stream (ms). @default 180000 */
   readonly cursorStreamStallTimeoutMs?: number;
 
+  /** Max wait for the per-workspace turn lock (ms). @default 900000 */
+  readonly workspaceLockTimeoutMs?: number;
+
   /** Checkpointer type for LangGraph agent state. @default "memory" (or "http" if proxyEndpoint is set) */
   readonly checkpointerType?: "memory" | "http";
 
@@ -576,6 +579,8 @@ export function mapManagerOptionsToConfig(
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,
+    workspaceLockTimeoutMs:
+      options.workspaceLockTimeoutMs ?? DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS,
   };
 }