@stigmer/runner 3.1.1 → 3.1.2

package/src/activities/execute-cursor/index.ts

@@ -45,9 +45,9 @@ import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_p
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { MessageAccumulator, reconcileDeniedToolCalls, clearProvisionalPostDenialNarration, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { collectSubAgentToolCallIds, withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { startStallWatchdog, StallTimeoutError, formatStallFailure, type StallWatchdog } from "../../shared/stall-watchdog.js";
-import { createArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
+import { resolveUsableArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
@@ -61,11 +61,18 @@ import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
 import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
-import { resolveSkills, removeStigmerSymlink } from "./skill-resolver.js";
+import { resolveSkills } from "./skill-resolver.js";
+import { removeStigmerSymlink } from "./stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
+import {
+  acquireWorkspaceLock,
+  WorkspaceLockCancelledError,
+  WorkspaceLockTimeoutError,
+  type ReleaseWorkspaceLock,
+} from "../../shared/workspace/workspace-lock.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, primaryToken, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
@@ -167,27 +174,31 @@ async function executeCursorInner(
 
   // Artifact storage for offloading oversized tool outputs (screenshots, giant
   // dumps) out of the persisted status, and for publishing the plan artifact.
-  // Created once here so it is available to EVERY persist below. Best-effort:
-  // if it can't be built (e.g. proxy mode without a token), offload is disabled
-  // but persistStatus still enforces the aggregate size cap, so persistence can
-  // never silently blow past the gRPC limit.
-  let artifactStorage: ArtifactStorage | undefined;
-  try {
-    artifactStorage = createArtifactStorage(loadArtifactStorageConfig(config));
-  } catch (storageErr) {
-    console.warn(
-      `ExecuteCursor artifact storage unavailable — tool-output offload disabled ` +
-      `(aggregate size guard still active): execution=${executionId}, error=${storageErr}`,
-    );
-  }
+  // Resolved once here so it is available to EVERY persist below. Best-effort via
+  // the shared resolver (identical to the deep-agent harness): `undefined` — never
+  // a throw — when there is no working substrate (proxy misconfig OR an unwritable
+  // local path). An absent store disables offload (persistStatus still enforces
+  // the aggregate size cap) and flips capture mode off (deny-gate fallback).
+  const artifactStorage: ArtifactStorage | undefined =
+    await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
   const statusOffload = artifactStorage
     ? { artifactStorage, executionId }
     : undefined;
   // ALL status persistence in this activity flows through `persist`, so the
   // single size-bounding guard (offload + aggregate elision) is unforgeable and
   // a future call site cannot accidentally skip it.
-  const persist = (s: AgentExecutionStatus = status) =>
-    persistStatus(client, executionId, s, { offload: statusOffload });
+  const persist = (s: AgentExecutionStatus = status) => {
+    // Never-persist-secret backstop (DD-26 #2): before EVERY persist, withhold
+    // content from any built-in write row targeting a secret-like path (top-level
+    // + sub-agent). This is the single airtight choke point for the Cursor harness
+    // — the deny-gate analog of capture mode's stamping scrub, and the only
+    // guarantee under auto_approve_all (where the hook installs no gate). Safe on
+    // every call: Cursor sets tool args atomically from the SDK tool_call event
+    // (buildToolCallProto), so there is no mid-stream partial-args hazard, and the
+    // pass only ever touches secret-like write rows (idempotent, else a no-op).
+    withholdSecretContentFromMessages(s.messages, s.subAgentExecutions);
+    return persistStatus(client, executionId, s, { offload: statusOffload });
+  };
 
   let sessionId: string | undefined;
   let session: import("@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb").Session | undefined;
@@ -234,6 +245,14 @@ async function executeCursorInner(
   // (issue #173). Runs in the finally, covering every success/error/approval
   // exit path. Undefined until the gate is installed.
   let hitlCleanup: (() => Promise<void>) | undefined;
+  // Exclusive turn lock on the primary workspace working tree. Held across the
+  // ENTIRE tree-mutating window (decision reconcile, HITL gate install, the
+  // agent's own writes, candidate capture) so a concurrent execution sharing
+  // this directory can never write between this turn's baseline and candidate
+  // snapshots — the misattribution that showed another session's file as this
+  // turn's change. Released in the finally AFTER hitlCleanup (which still
+  // mutates the tree). See shared/workspace/workspace-lock.ts.
+  let releaseWorkspaceLock: ReleaseWorkspaceLock | undefined;
   // Carries model/mode/agentId out to the outer catch so a thrown CursorSdkError
   // can be classified with the same context as the run.wait() error path.
   let errorContext = { model: "default", mode: "local", agentId: "" };
@@ -294,6 +313,46 @@ async function executeCursorInner(
     const changeSetId = `${executionId}:${turnSeq}`;
     heartbeat();
 
+    // Serialize this turn against every other execution sharing this working
+    // tree — sessions declaring the same localPath (or the shared runner root)
+    // resolve to ONE directory, and an unserialized concurrent write lands
+    // inside this turn's baseline→candidate window, misattributing another
+    // session's file to this turn's review. Acquired before ANY tree mutation
+    // below (decision reconcile, gate install, agent writes, capture). While
+    // another turn holds the lock this surfaces a visible waiting state and
+    // heartbeats; a cancel aborts the wait immediately.
+    if (primaryWorkspaceDir) {
+      try {
+        releaseWorkspaceLock = await acquireWorkspaceLock(primaryWorkspaceDir, {
+          onWaiting: () => reportSetupProgress(
+            client, executionId, "Waiting for workspace — in use by another session",
+          ),
+          heartbeat,
+          signal: Context.current().cancellationSignal,
+          timeoutMs: config.workspaceLockTimeoutMs,
+        });
+      } catch (lockErr) {
+        if (lockErr instanceof WorkspaceLockCancelledError) {
+          throw new CancelledFailure("Activity cancelled while waiting for the workspace lock");
+        }
+        if (lockErr instanceof WorkspaceLockTimeoutError) {
+          status.phase = ExecutionPhase.EXECUTION_FAILED;
+          status.error = lockErr.message;
+          status.completedAt = utcTimestamp();
+          status.messages.push(create(AgentMessageSchema, {
+            type: MessageType.MESSAGE_SYSTEM,
+            content: `Execution failed: ${lockErr.message}`,
+            timestamp: utcTimestamp(),
+          }));
+          await persist(status);
+          console.warn(`ExecuteCursor workspace lock timeout: execution=${executionId}`);
+          return slimStatus(status);
+        }
+        throw lockErr;
+      }
+    }
+    heartbeat();
+
     // Set OTel baggage so downstream calls carry execution context.
     try {
       const { setBaggage, BAGGAGE_EXECUTION_ID, BAGGAGE_SESSION_ID, BAGGAGE_ORG_ID } = await import("../../otel.js");
@@ -511,13 +570,15 @@ async function executeCursorInner(
     });
     heartbeat();
 
-    // Phase 5b: Resolve attachments
-    const attachmentResults = await resolveAttachments(
-      spec.attachments,
+    // Phase 5b: Resolve attachments (fail-hard — explicit user inputs; see
+    // attachment-resolver.ts). Downloads by storage key through the same
+    // artifactStorage resolved for status offload above.
+    const attachmentResults = await resolveAttachments(spec.attachments, {
       sessionId,
       primaryWorkspaceDir,
-      config.mode,
-    );
+      mode: config.mode,
+      storage: artifactStorage,
+    });
     const attachmentPaths = attachmentResults.map((a) => a.relativePath);
 
     // Phase 5b3: Exact-apply approved whole-file writes (HITL "what you approve
@@ -741,6 +802,7 @@ async function executeCursorInner(
     // Phase 10: Build the prompt
     const interactionMode = spec.executionConfig?.interactionMode
       ?? InteractionMode.UNSPECIFIED;
+    const buildFromPlan = spec.executionConfig?.buildFromPlan ?? false;
 
     const prompt = buildPrompt({
       resolution,
@@ -755,6 +817,7 @@ async function executeCursorInner(
       pendingApprovals: adjudicatedApprovals,
       appliedToolCallIds,
       interactionMode,
+      buildFromPlan,
     });
 
     // Phase 10a: Inject structured output instruction for Cursor harness
@@ -1885,6 +1948,13 @@ async function executeCursorInner(
         );
       }
     }
+
+    // Release the workspace turn lock LAST — hitlCleanup above still mutates
+    // the tree (restores .cursor/hooks.json), and the next queued turn must
+    // not baseline until every mutation of this one has landed. Idempotent
+    // and non-throwing (see workspace-lock.ts), so it can never mask the
+    // turn's real outcome.
+    await releaseWorkspaceLock?.();
   }
 }
 
@@ -1996,6 +2066,11 @@ export interface BuildPromptInput {
    */
   appliedToolCallIds?: ReadonlySet<string>;
   interactionMode?: InteractionMode;
+  /**
+   * The execution is a Build-from-plan turn (spec.execution_config
+   * .build_from_plan): both prompt paths carry the implement-plan directive.
+   */
+  buildFromPlan?: boolean;
 }
 
 /**
@@ -2026,6 +2101,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     workspaceFileRefs,
     attachmentPaths,
     interactionMode,
+    buildFromPlan,
   } = input;
 
   const isHitlReinvocation = approvalDecisions !== undefined && approvalDecisions.size > 0;
@@ -2042,9 +2118,20 @@ export function buildPrompt(input: BuildPromptInput): string {
   }
 
   // A successfully resumed agent carries its own conversation context via the
-  // SDK's native store — send the raw user message with no preamble.
+  // SDK's native store — send the raw user message with no preamble. The
+  // exceptions are the per-EXECUTION directives, which never inherit from the
+  // session's first turn: the interaction-mode prefix (a follow-up can switch
+  // Agent→Plan mid-session, and for Cursor the prompt is the only plan-mode
+  // enforcement) and the implement-plan directive (the build turn is usually
+  // a follow-up on a resumed agent).
   if (resolution.reason === "resumed_successfully") {
-    return userMessage;
+    const prefixes = [
+      formatInteractionModePrefix(interactionMode),
+      formatImplementPlanSection(buildFromPlan, attachmentPaths),
+    ].filter((p): p is string => p !== undefined);
+    return prefixes.length > 0
+      ? [...prefixes, userMessage].join("\n\n")
+      : userMessage;
   }
 
   // First execution, or a fresh agent created after a resume failure: there is
@@ -2058,6 +2145,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     workspaceFileRefs,
     attachmentPaths,
     interactionMode,
+    buildFromPlan,
   });
 }
 

package/src/activities/execute-cursor/message-translator.ts

@@ -50,7 +50,8 @@ import { utcTimestamp } from "../../shared/status.js";
 import { hideToolCallRow, isToolCallRowHidden } from "../../shared/tool-row.js";
 import { classifyTool, toolApprovalCategory, type ToolApprovalCategory } from "../../shared/tool-kind.js";
 import { resolveWorkspacePath } from "../../shared/file-change.js";
-import { contentDigest } from "../../shared/file-tools.js";
+import { contentDigest, extractFilePath } from "../../shared/file-tools.js";
+import { isSecretLikePath } from "../../shared/filereview/secret-paths.js";
 import { buildElidedArgsPreview } from "../../shared/args-preview.js";
 import type { WorkspaceBackend } from "../../shared/workspace/types.js";
 
@@ -1631,6 +1632,13 @@ function applyGateInput(
   input: Record<string, unknown> | undefined,
 ): void {
   if (!input) return;
+  // Defense-in-depth (DD-26 #2): never overlay a secret-like write's content into
+  // the persisted approval preview. Normally unreachable — the hook hard-blocks a
+  // secret write and records no ledger input — but if a hook classify failure fell
+  // one through, its content must still never reach args/args_preview. The
+  // Invariant-A backstop is the final net; this closes the path at the source.
+  const gatePath = extractFilePath(input);
+  if (gatePath !== null && isSecretLikePath(gatePath)) return;
   tc.args = input as JsonObject;
   tc.argsPreview = buildElidedArgsPreview(input, SALIENT_ARG_FIELDS);
   // Stamp the content digest from the AUTHORITATIVE captured input, so the

package/src/activities/execute-cursor/prompt-builder.ts

@@ -6,19 +6,25 @@
  * parameter). On reinvocation, only the approval decisions are sent.
  *
  * Sections (in order, conditionally included):
- * 1. Agent instructions (persona/character)
- * 2. Available skills metadata
- * 3. Sub-agent delegation guidance
- * 4. Workspace context (multi-root only; single-dir is redundant with SDK cwd)
- * 5. Input files / referenced files
- * 6. Response rules (only when agent has no custom instructions)
- * 7. User's actual message
+ * 1. Interaction-mode / implement-plan directives
+ * 2. Agent instructions (persona/character)
+ * 3. Available skills metadata
+ * 4. Sub-agent delegation guidance
+ * 5. Workspace context (multi-root only; single-dir is redundant with SDK cwd)
+ * 6. Input files / referenced files
+ * 7. Response rules (only when agent has no custom instructions)
+ * 8. User's actual message
  */
 
 import { resolve } from "node:path";
 import type { SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
+import {
+  buildImplementPlanDirective,
+  findApprovedPlanPath,
+} from "../../shared/implement-plan-prompt.js";
 
 /**
  * Marker path segments that identify runner-internal directories. A workspace
@@ -47,6 +53,13 @@ export interface EnhancedPromptOptions {
   workspaceFileRefs: string[];
   attachmentPaths: string[];
   interactionMode?: InteractionMode;
+  /**
+   * The execution is a Build-from-plan turn (spec.execution_config
+   * .build_from_plan): inject the implement-plan directive so the model reads
+   * the attached approved plan (or falls back to the conversation's plan).
+   * The user message itself is just a short label ("Build from plan").
+   */
+  buildFromPlan?: boolean;
 }
 
 /**
@@ -63,6 +76,14 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(modePrefix);
   }
 
+  const implementPlan = formatImplementPlanSection(
+    options.buildFromPlan,
+    options.attachmentPaths,
+  );
+  if (implementPlan) {
+    sections.push(implementPlan);
+  }
+
   if (options.instructions) {
     sections.push(formatInstructions(options.instructions));
   }
@@ -348,30 +369,47 @@ export function formatReferencedFiles(refs: string[]): string {
 /**
  * Returns a system-level directive when the execution is in Plan mode.
  * Returns `undefined` for Agent mode (default) since no prefix is needed.
+ *
+ * The directive body is the harness-agnostic {@link PLAN_MODE_DIRECTIVE}
+ * (shared with the native harness) wrapped in this harness's XML-tag section
+ * framing. For Cursor this prompt IS the plan-mode enforcement — the Cursor
+ * SDK exposes no mode parameter — see the shared module's doc comment.
  */
 export function formatInteractionModePrefix(
   mode: InteractionMode | undefined,
 ): string | undefined {
-  if (
-    mode == null ||
-    mode === InteractionMode.UNSPECIFIED ||
-    mode === InteractionMode.AGENT
-  ) {
+  if (mode !== InteractionMode.PLAN) {
     return undefined;
   }
 
-  if (mode === InteractionMode.PLAN) {
-    return [
-      "<interaction_mode>",
-      "IMPORTANT: You are in Plan mode. Analyze the codebase and produce a detailed plan.",
-      "Do NOT create, edit, or delete any files. Do NOT run commands that modify the filesystem.",
-      "Only read, search, and analyze. Your output should be analysis, recommendations, and",
-      "implementation plans — not code changes.",
-      "</interaction_mode>",
-    ].join("\n");
+  return ["<interaction_mode>", PLAN_MODE_DIRECTIVE, "</interaction_mode>"].join(
+    "\n",
+  );
+}
+
+/**
+ * Returns the implement-plan directive section for a Build-from-plan
+ * execution, or `undefined` otherwise. The directive body is the shared
+ * {@link buildImplementPlanDirective} (same words as the native harness)
+ * wrapped in this harness's XML-tag framing; the variant is picked by whether
+ * the approved plan document is among the resolved attachment paths.
+ *
+ * Like the interaction-mode prefix, this rides BOTH prompt paths — the fresh
+ * enhanced prompt and a resumed turn's prefix — because build_from_plan is
+ * per-execution and the build turn is usually a follow-up on a resumed agent.
+ */
+export function formatImplementPlanSection(
+  buildFromPlan: boolean | undefined,
+  attachmentPaths: string[],
+): string | undefined {
+  if (!buildFromPlan) {
+    return undefined;
   }
 
-  return undefined;
+  const directive = buildImplementPlanDirective(
+    findApprovedPlanPath(attachmentPaths),
+  );
+  return ["<implement_plan>", directive, "</implement_plan>"].join("\n");
 }
 
 export function formatResponseRules(): string {

package/src/activities/execute-cursor/skill-resolver.ts

@@ -5,11 +5,11 @@
  * - Writes SKILL.md to .stigmer/skills/{name}/SKILL.md
  * - Downloads and extracts ZIP artifacts (references/, scripts/, etc.)
  * - Uses a platform-managed directory outside the workspace
- * - Creates a symlink from the workspace to the platform dir
+ * - Ensures the workspace `.stigmer` symlink (see stigmer-link.ts)
  * - Returns metadata for prompt injection
  */
 
-import { mkdir, writeFile, symlink, readlink, unlink, rm, lstat } from "node:fs/promises";
+import { mkdir, writeFile, rm } from "node:fs/promises";
 import { join, dirname } from "node:path";
 import type { StigmerClient } from "../../client/stigmer-client.js";
 import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
@@ -17,8 +17,8 @@ import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/ap
 import type { SkillMetadata } from "./prompt-builder.js";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
 import { extractZipFileEntries } from "../../shared/zip-extract.js";
+import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "./stigmer-link.js";
 
-const STIGMER_LOCAL_STATE_DIR = ".stigmer";
 const SKILLS_SUBDIR = "skills";
 
 export interface SkillResolverOptions {
@@ -132,62 +132,6 @@ async function writeSkill(
   };
 }
 
-/**
- * Ensure .stigmer symlink in the workspace points to the platform dir.
- *
- * The Cursor SDK reads files from the workspace CWD, so we need the
- * .stigmer directory to be accessible there. Unlike the Python runner
- * which intercepts file paths, Cursor reads directly from the filesystem.
- */
-async function ensureStigmerSymlink(
-  workspaceDir: string,
-  platformDir: string,
-): Promise<void> {
-  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
-
-  try {
-    const existing = await readlink(linkPath);
-    if (existing === platformDir) return;
-    await unlink(linkPath);
-  } catch (err: any) {
-    if (err.code === "ENOENT") {
-      // No existing symlink
-    } else if (err.code === "EINVAL") {
-      // Exists but is not a symlink — remove the directory
-      await rm(linkPath, { recursive: true, force: true });
-    } else {
-      throw err;
-    }
-  }
-
-  await symlink(platformDir, linkPath, "dir");
-}
-
-/**
- * Remove the workspace `.stigmer` symlink created by {@link resolveSkills}.
- *
- * Called in the activity's finally so attaching a real repo leaves no Stigmer
- * symlink behind once the turn ends (issue #173); a multi-turn session recreates
- * it on the next turn. Only ever removes a SYMLINK — a real `.stigmer` directory
- * (which would be the user's own, not ours) is left untouched. Best-effort.
- */
-export async function removeStigmerSymlink(workspaceDir: string): Promise<void> {
-  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
-  try {
-    const stat = await lstat(linkPath);
-    if (stat.isSymbolicLink()) {
-      await unlink(linkPath);
-    }
-  } catch (err: any) {
-    if (err?.code !== "ENOENT") {
-      console.warn(
-        `removeStigmerSymlink: failed to remove ${linkPath} (non-fatal): ` +
-        `${err instanceof Error ? err.message : err}`,
-      );
-    }
-  }
-}
-
 /**
  * Clean up platform-managed skill directory for a session.
  */

package/src/activities/execute-cursor/stigmer-link.ts

@@ -0,0 +1,78 @@
+/**
+ * The workspace `.stigmer` symlink — the Cursor harness's bridge from the
+ * user's workspace to the session's platform-managed directory
+ * (~/.stigmer/sessions/{id}/platform/, see shared/workspace/platform-dir.ts).
+ *
+ * The Cursor SDK reads files from the workspace CWD, so platform-injected
+ * content (skills, attachment inputs) must be reachable there; the symlink is
+ * how, without ever writing platform files into the user's repo (issue #173).
+ * This mechanism is deliberately harness-local: the native harness routes
+ * `.stigmer/` paths through its WorkspaceBackend instead and never symlinks.
+ *
+ * Both resolvers that populate the platform dir (skills, attachments) call
+ * {@link ensureStigmerSymlink}; it is idempotent, so either may run first and
+ * an agent with only one kind of content still gets the link. The activity's
+ * cleanup calls {@link removeStigmerSymlink} so a real repo is left untouched
+ * once the turn ends; a multi-turn session recreates the link on the next turn.
+ */
+
+import { symlink, readlink, unlink, rm, lstat } from "node:fs/promises";
+import { join } from "node:path";
+
+/** The workspace-visible name of the platform namespace. */
+export const STIGMER_LOCAL_STATE_DIR = ".stigmer";
+
+/**
+ * Ensure the workspace `.stigmer` symlink points to the platform dir.
+ * Idempotent: an existing correct link is kept; a stale link (or a non-link
+ * left behind by an older runner) is replaced.
+ */
+export async function ensureStigmerSymlink(
+  workspaceDir: string,
+  platformDir: string,
+): Promise<void> {
+  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
+
+  try {
+    const existing = await readlink(linkPath);
+    if (existing === platformDir) return;
+    await unlink(linkPath);
+  } catch (err: any) {
+    if (err.code === "ENOENT") {
+      // No existing symlink
+    } else if (err.code === "EINVAL") {
+      // Exists but is not a symlink — remove the directory
+      await rm(linkPath, { recursive: true, force: true });
+    } else {
+      throw err;
+    }
+  }
+
+  await symlink(platformDir, linkPath, "dir");
+}
+
+/**
+ * Remove the workspace `.stigmer` symlink created by
+ * {@link ensureStigmerSymlink}.
+ *
+ * Called in the activity's finally so attaching a real repo leaves no Stigmer
+ * symlink behind once the turn ends (issue #173). Only ever removes a
+ * SYMLINK — a real `.stigmer` directory (which would be the user's own, not
+ * ours) is left untouched. Best-effort.
+ */
+export async function removeStigmerSymlink(workspaceDir: string): Promise<void> {
+  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
+  try {
+    const stat = await lstat(linkPath);
+    if (stat.isSymbolicLink()) {
+      await unlink(linkPath);
+    }
+  } catch (err: any) {
+    if (err?.code !== "ENOENT") {
+      console.warn(
+        `removeStigmerSymlink: failed to remove ${linkPath} (non-fatal): ` +
+        `${err instanceof Error ? err.message : err}`,
+      );
+    }
+  }
+}

package/src/activities/execute-cursor/workspace-provision.ts

@@ -12,14 +12,16 @@ import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import { ensurePlatformDir } from "../../shared/workspace/platform-dir.js";
+import { resolveSessionWorkspaceRoot } from "../../shared/workspace/session-root.js";
 
 /**
  * Provision the session's workspace entries for a LOCAL Cursor agent.
  *
  * Clones git-repo entries (using the user's GITHUB_TOKEN from the resolved
  * execution environment) and mounts local-path entries, then returns the
- * directories the agent should operate in. Falls back to the configured
- * workspace root when the session declares no workspace entries.
+ * directories the agent should operate in. A session with no workspace
+ * entries gets its own empty per-session directory (see session-root.ts) —
+ * never the shared root, which would leak other sessions' files into it.
  *
  * provisionGit is idempotent (it reuses an existing clone), so this is safe
  * to call on every execution, including multi-turn and HITL reinvocations.
@@ -32,7 +34,7 @@ export async function provisionCursorWorkspace(
 ): Promise<string[]> {
   const entries = session.spec?.workspaceEntries ?? [];
   if (entries.length === 0) {
-    return [config.workspaceRootDir];
+    return [await resolveSessionWorkspaceRoot(config.workspaceRootDir, entries, sessionId)];
   }
 
   const platformDir = await ensurePlatformDir(sessionId);

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -49,7 +49,9 @@ import type { SetupResult } from "../setup.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -258,7 +260,9 @@ function fakeDurableResumeSetup(): SetupResult {
     },
     agent: {},
     session: { spec: { workspaceEntries: [] } },
-    workspaceBackend: { rootDir: "/tmp/ws" },
+    // Unique per test file: the workspace turn lock keys on this path, and a
+    // path shared across files would serialize parallel test workers for real.
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-approve-all" },
     mcpConnection: null,
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
@@ -292,6 +296,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
 };
 
 describe("ExecuteDeepAgent — APPROVE_ALL durable resume preserves leading thinking + first tool call", () => {

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -42,7 +42,9 @@ import type { SetupResult } from "../setup.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -213,7 +215,9 @@ function fakeDurableResumeSetup(): SetupResult {
     },
     agent: {},
     session: { spec: { workspaceEntries: [] } },
-    workspaceBackend: { rootDir: "/tmp/ws" },
+    // Unique per test file: the workspace turn lock keys on this path, and a
+    // path shared across files would serialize parallel test workers for real.
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-history" },
     mcpConnection: null,
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
@@ -246,6 +250,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
 };
 
 describe("ExecuteDeepAgent — durable-checkpoint resume preserves history", () => {

package/src/activities/execute-deep-agent/__tests__/index.test.ts

@@ -8,7 +8,9 @@ import type { Config } from "../../../config.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -45,6 +47,7 @@ describe("ExecuteDeepAgent activity", () => {
     checkpointerProxyEndpoint: null,
     primaryModel: "gpt-4.1",
     cursorStreamStallTimeoutMs: 180000,
+    workspaceLockTimeoutMs: 900000,
   };
 
   let activities: ReturnType<typeof createDeepAgentActivities>;