@stigmer/runner 3.1.1 → 3.1.3

package/src/activities/execute-cursor/index.ts

@@ -43,11 +43,11 @@ import { resolveAgent } from "./session-lifecycle.js";
 import type { AgentResolution, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
-import { MessageAccumulator, reconcileDeniedToolCalls, clearProvisionalPostDenialNarration, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
+import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { startStallWatchdog, StallTimeoutError, formatStallFailure, type StallWatchdog } from "../../shared/stall-watchdog.js";
-import { createArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
+import { resolveUsableArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
@@ -61,22 +61,33 @@ import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
 import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
-import { resolveSkills, removeStigmerSymlink } from "./skill-resolver.js";
+import { resolveSkills } from "./skill-resolver.js";
+import { removeStigmerSymlink } from "./stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
+import {
+  acquireWorkspaceLock,
+  WorkspaceLockCancelledError,
+  WorkspaceLockTimeoutError,
+  type ReleaseWorkspaceLock,
+} from "../../shared/workspace/workspace-lock.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
-import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, primaryToken, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
-import { deriveTurnCommandProvenance } from "./command-provenance.js";
+import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
 import { applyApprovedWholeFileWrites, excludeAppliedFromGrants } from "./exact-apply.js";
 import { isGitWorkTree } from "../../shared/filereview/git-substrate.js";
 import {
   captureBaselineToLedger,
-  captureTurnToLedger,
+  captureProgressToStatus,
   applyCaptureDecisions,
   deriveCaptureMode,
 } from "./capture-flow.js";
+import { runTurnBoundary, type TurnBoundaryResult } from "./turn-boundary.js";
+import {
+  newProgressCaptureState,
+  type ProgressCaptureState,
+} from "../../shared/filereview/progress.js";
 import { deriveExecutionFingerprintKey } from "../../shared/approval-fingerprint.js";
 import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
 import { provisionCursorWorkspace } from "./workspace-provision.js";
@@ -95,12 +106,6 @@ import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
 import { getShutdownSignalForQueue } from "../../runner-manager.js";
 
-// How long Phase 12 waits for the first-denial-stop's run.cancel() to settle
-// before reading the final denial ledger and capturing the turn's tree. Long
-// enough for the SDK's normal teardown, short enough that a wedged cancel
-// cannot noticeably delay the approval pause the user is already waiting on.
-const FIRST_DENIAL_CANCEL_TIMEOUT_MS = 5_000;
-
 /**
  * Creates the activity functions bound to the runner config.
  * Returned object is passed to Temporal Worker.create({ activities }).
@@ -167,27 +172,31 @@ async function executeCursorInner(
 
   // Artifact storage for offloading oversized tool outputs (screenshots, giant
   // dumps) out of the persisted status, and for publishing the plan artifact.
-  // Created once here so it is available to EVERY persist below. Best-effort:
-  // if it can't be built (e.g. proxy mode without a token), offload is disabled
-  // but persistStatus still enforces the aggregate size cap, so persistence can
-  // never silently blow past the gRPC limit.
-  let artifactStorage: ArtifactStorage | undefined;
-  try {
-    artifactStorage = createArtifactStorage(loadArtifactStorageConfig(config));
-  } catch (storageErr) {
-    console.warn(
-      `ExecuteCursor artifact storage unavailable — tool-output offload disabled ` +
-      `(aggregate size guard still active): execution=${executionId}, error=${storageErr}`,
-    );
-  }
+  // Resolved once here so it is available to EVERY persist below. Best-effort via
+  // the shared resolver (identical to the deep-agent harness): `undefined` — never
+  // a throw — when there is no working substrate (proxy misconfig OR an unwritable
+  // local path). An absent store disables offload (persistStatus still enforces
+  // the aggregate size cap) and flips capture mode off (deny-gate fallback).
+  const artifactStorage: ArtifactStorage | undefined =
+    await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
   const statusOffload = artifactStorage
     ? { artifactStorage, executionId }
     : undefined;
   // ALL status persistence in this activity flows through `persist`, so the
   // single size-bounding guard (offload + aggregate elision) is unforgeable and
   // a future call site cannot accidentally skip it.
-  const persist = (s: AgentExecutionStatus = status) =>
-    persistStatus(client, executionId, s, { offload: statusOffload });
+  const persist = (s: AgentExecutionStatus = status) => {
+    // Never-persist-secret backstop (DD-26 #2): before EVERY persist, withhold
+    // content from any built-in write row targeting a secret-like path (top-level
+    // + sub-agent). This is the single airtight choke point for the Cursor harness
+    // — the deny-gate analog of capture mode's stamping scrub, and the only
+    // guarantee under auto_approve_all (where the hook installs no gate). Safe on
+    // every call: Cursor sets tool args atomically from the SDK tool_call event
+    // (buildToolCallProto), so there is no mid-stream partial-args hazard, and the
+    // pass only ever touches secret-like write rows (idempotent, else a no-op).
+    withholdSecretContentFromMessages(s.messages, s.subAgentExecutions);
+    return persistStatus(client, executionId, s, { offload: statusOffload });
+  };
 
   let sessionId: string | undefined;
   let session: import("@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb").Session | undefined;
@@ -234,6 +243,14 @@ async function executeCursorInner(
   // (issue #173). Runs in the finally, covering every success/error/approval
   // exit path. Undefined until the gate is installed.
   let hitlCleanup: (() => Promise<void>) | undefined;
+  // Exclusive turn lock on the primary workspace working tree. Held across the
+  // ENTIRE tree-mutating window (decision reconcile, HITL gate install, the
+  // agent's own writes, candidate capture) so a concurrent execution sharing
+  // this directory can never write between this turn's baseline and candidate
+  // snapshots — the misattribution that showed another session's file as this
+  // turn's change. Released in the finally AFTER hitlCleanup (which still
+  // mutates the tree). See shared/workspace/workspace-lock.ts.
+  let releaseWorkspaceLock: ReleaseWorkspaceLock | undefined;
   // Carries model/mode/agentId out to the outer catch so a thrown CursorSdkError
   // can be classified with the same context as the run.wait() error path.
   let errorContext = { model: "default", mode: "local", agentId: "" };
@@ -285,6 +302,9 @@ async function executeCursorInner(
     // Pre-turn baseline tree, pinned before the agent runs (capture mode only)
     // so the turn-end capture diffs against it and the tree restores exactly.
     let baselineTree: string | undefined;
+    // Per-turn state for mid-run live capture (DD-32): the last progress tree sha
+    // (short-circuit) + last capture time (floor), threaded across persists.
+    const progressState: ProgressCaptureState = newProgressCaptureState();
     // Deterministic id of the change set this turn may produce:
     // `${executionId}:${turnSeq}`. Minted from the workflow-threaded turn index
     // so it is stable across a Temporal retry (idempotent ledger authoring) and
@@ -294,6 +314,46 @@ async function executeCursorInner(
     const changeSetId = `${executionId}:${turnSeq}`;
     heartbeat();
 
+    // Serialize this turn against every other execution sharing this working
+    // tree — sessions declaring the same localPath (or the shared runner root)
+    // resolve to ONE directory, and an unserialized concurrent write lands
+    // inside this turn's baseline→candidate window, misattributing another
+    // session's file to this turn's review. Acquired before ANY tree mutation
+    // below (decision reconcile, gate install, agent writes, capture). While
+    // another turn holds the lock this surfaces a visible waiting state and
+    // heartbeats; a cancel aborts the wait immediately.
+    if (primaryWorkspaceDir) {
+      try {
+        releaseWorkspaceLock = await acquireWorkspaceLock(primaryWorkspaceDir, {
+          onWaiting: () => reportSetupProgress(
+            client, executionId, "Waiting for workspace — in use by another session",
+          ),
+          heartbeat,
+          signal: Context.current().cancellationSignal,
+          timeoutMs: config.workspaceLockTimeoutMs,
+        });
+      } catch (lockErr) {
+        if (lockErr instanceof WorkspaceLockCancelledError) {
+          throw new CancelledFailure("Activity cancelled while waiting for the workspace lock");
+        }
+        if (lockErr instanceof WorkspaceLockTimeoutError) {
+          status.phase = ExecutionPhase.EXECUTION_FAILED;
+          status.error = lockErr.message;
+          status.completedAt = utcTimestamp();
+          status.messages.push(create(AgentMessageSchema, {
+            type: MessageType.MESSAGE_SYSTEM,
+            content: `Execution failed: ${lockErr.message}`,
+            timestamp: utcTimestamp(),
+          }));
+          await persist(status);
+          console.warn(`ExecuteCursor workspace lock timeout: execution=${executionId}`);
+          return slimStatus(status);
+        }
+        throw lockErr;
+      }
+    }
+    heartbeat();
+
     // Set OTel baggage so downstream calls carry execution context.
     try {
       const { setBaggage, BAGGAGE_EXECUTION_ID, BAGGAGE_SESSION_ID, BAGGAGE_ORG_ID } = await import("../../otel.js");
@@ -511,13 +571,15 @@ async function executeCursorInner(
     });
     heartbeat();
 
-    // Phase 5b: Resolve attachments
-    const attachmentResults = await resolveAttachments(
-      spec.attachments,
+    // Phase 5b: Resolve attachments (fail-hard — explicit user inputs; see
+    // attachment-resolver.ts). Downloads by storage key through the same
+    // artifactStorage resolved for status offload above.
+    const attachmentResults = await resolveAttachments(spec.attachments, {
       sessionId,
       primaryWorkspaceDir,
-      config.mode,
-    );
+      mode: config.mode,
+      storage: artifactStorage,
+    });
     const attachmentPaths = attachmentResults.map((a) => a.relativePath);
 
     // Phase 5b3: Exact-apply approved whole-file writes (HITL "what you approve
@@ -741,6 +803,7 @@ async function executeCursorInner(
     // Phase 10: Build the prompt
     const interactionMode = spec.executionConfig?.interactionMode
       ?? InteractionMode.UNSPECIFIED;
+    const buildFromPlan = spec.executionConfig?.buildFromPlan ?? false;
 
     const prompt = buildPrompt({
       resolution,
@@ -755,6 +818,7 @@ async function executeCursorInner(
       pendingApprovals: adjudicatedApprovals,
       appliedToolCallIds,
       interactionMode,
+      buildFromPlan,
     });
 
     // Phase 10a: Inject structured output instruction for Cursor harness
@@ -1005,6 +1069,22 @@ async function executeCursorInner(
         // accumulator tracked sub-agents in memory but they only reached the
         // status (and the subscriber stream) after the loop ended.
         status.subAgentExecutions = accumulator.subAgentExecutions;
+        // Mid-run live capture (DD-32): attach the "N files changed so far"
+        // snapshot onto status.file_change_progress, throttled internally by the
+        // floor + tree-sha short-circuit. Git capture mode only (a pinned baseline
+        // exists); shell + sub-agent + tool edits are all captured for free by the
+        // workspace-wide diff. Never authoritative — the turn-boundary candidate
+        // remains the reviewed diff.
+        if (captureMode && gitWorkspace && baselineTree && primaryWorkspaceDir) {
+          await captureProgressToStatus({
+            status,
+            gitRoot: primaryWorkspaceDir,
+            executionId,
+            changeSetId,
+            baselineTree,
+            state: progressState,
+          });
+        }
         const signal = await persist(status);
         deltaEnricher.markPersisted();
         todoTracker.markPersisted();
@@ -1182,155 +1262,88 @@ async function executeCursorInner(
       return slimStatus(status);
     }
 
-    // Phase 12: Surface tools the preToolUse hook gated (HITL).
-    //
-    // The hook records each denial to the ledger; we mark the corresponding tool
-    // calls WAITING_APPROVAL. The backend projects pending_approvals from that
-    // tool-call status (PendingApprovalComputer), so — exactly like the native
-    // harness — the approval surface is driven entirely by tool-call status. We
-    // deliberately do NOT set status.pendingApprovals here: any value would be
-    // discarded by the backend's recompute on the next updateStatus.
-    //
-    // Before reading the ledger, wait (timeboxed) for the first-denial-stop's
-    // run.cancel() to settle. run.cancel() races the SDK's auto-execution: until
-    // it lands, the agent process may still attempt a post-denial workaround
-    // whose hook denial would land AFTER a premature ledger read — the row then
-    // never collapses and renders as RUNNING forever (production case
-    // aex_01kwj07f7g23c3wp9sn8496z5g) — or a late tool could mutate the tree
-    // mid-capture. The timebox keeps a wedged cancel from hanging the pause;
-    // the Phase 12 trims below remain the backstop for that degraded case.
-    if (firstDenialDetected && denialCancelSettled) {
-      await Promise.race([
-        denialCancelSettled,
-        new Promise<void>((resolve) => {
-          const timer = setTimeout(resolve, FIRST_DENIAL_CANCEL_TIMEOUT_MS);
-          timer.unref();
-        }),
-      ]);
-    }
-    const deniedLedger = await readDenialLedger(hitlDir ?? "");
-
-    // Capture mode: author the net change set to the file_review ledger as the
-    // CANDIDATE_CAPTURED event (projected server-side to a file_change_set
-    // AWAITING_REVIEW — the single review surface). The runner-owned gate files
-    // are excluded from the capture. The agent's edits are LEFT applied on the
-    // working tree (Cursor parity — the user reviews the real change; nothing is
-    // committed and the next turn is blocked until approval, and a reject snaps
-    // each file back on resume). Runs BEFORE the denial reconcile so a denied
-    // (gitignored) write stays on the deny-gate path while every flowed edit is
-    // captured to the ledger.
-    let capturedChangeCount = 0;
-    // `baselineTree !== undefined` means a baseline was authored this turn — the
-    // git tree sha for a git workspace, or "" (empty, but authored) for a non-git
-    // one. A plain truthiness check would wrongly skip the non-git capture.
-    if (captureMode && baselineTree !== undefined && primaryWorkspaceDir) {
-      const deniedTokens = new Set(deniedLedger.map((e) => e.token));
-      // Approved-command turn facts (DD-28): when every mutation-capable call
-      // this turn was a consented shell command, attach the provenance so the
-      // backend can verify the cited consent rows and auto-keep the set instead
-      // of arming a second gate. Fail-closed: any non-qualifying turn attaches
-      // nothing and reviews manually exactly as before.
-      const commandProvenance = deriveTurnCommandProvenance({
-        messages: status.messages,
-        turnStartIndex: turnStartMessageIndex,
-        deniedTokens,
-        grantTokenToConsentId: new Map(
-          (approvalGrants ?? []).map((g) => [
-            primaryToken(g.key, g.salient, g.contentDigest),
-            g.sourceToolCallId,
-          ]),
-        ),
-        globalBypass,
-      });
-      if (commandProvenance) {
-        console.log(
-          `ExecuteCursor capture: turn qualifies for approved-command auto-keep ` +
-          `(consent rows: ${commandProvenance.consentToolCallIds.join(",") || "(auto_approve_all)"}); ` +
-          `attaching provenance to candidate (execution=${executionId})`,
-        );
-      }
-      const captured = await captureTurnToLedger({
+    // Phase 12: The turn boundary — author this turn's change set to the
+    // file_review ledger (CANDIDATE_CAPTURED) and overlay the hook's denials as
+    // WAITING_APPROVAL gate rows. The full pipeline and its ordering rationale
+    // live in turn-boundary.ts; this closure binds the turn's state so the
+    // recovery retries below (which re-run the agent AFTER this primary call)
+    // can re-enter the IDENTICAL pipeline — a retry's edits must reach the
+    // ledger or they silently escape review. `baselineTree` is read at call
+    // time, so both entries see the baseline authored at turn start.
+    const runBoundary = (denialSettled?: Promise<void>) =>
+      runTurnBoundary({
         status,
-        gitRoot: primaryWorkspaceDir,
         executionId,
         changeSetId,
-        baselineTree,
-        messages: status.messages,
-        deniedTokens,
-        commandProvenance,
-        // Scope sub-agent row stamping to this turn: the seeded prior sub-agents
-        // (cloned in on resume) are the "before this turn" rows to skip.
-        priorSubAgentToolCallIds: collectSubAgentToolCallIds(seededSubAgents),
-        // The CAS half: read the sidecar the hook staged this turn and compose it
-        // into the change set. hitlDir + storage are present when captureIgnored
-        // was on (a git tree's gitignored writes, or ALL writes in a non-git
-        // workspace). In a git tree this composes with the git diff (HYBRID); in a
-        // non-git workspace it IS the whole change set (CAS-only).
         hitlDir,
-        storage: artifactStorage,
+        captureMode,
+        baselineTree,
+        primaryWorkspaceDir,
         gitWorkspace,
+        turnStartMessageIndex,
+        approvalGrants,
+        globalBypass,
+        seededSubAgents,
+        artifactStorage,
+        mergedPolicies,
+        denialCancelSettled: denialSettled,
       });
-      capturedChangeCount = captured.length;
-      if (capturedChangeCount > 0) {
-        console.log(
-          `ExecuteCursor capture: ${capturedChangeCount} file change(s) authored to the ` +
-          `file_review ledger (change_set=${changeSetId}), working tree left applied ` +
-          `for review (execution=${executionId})`,
-        );
-      }
-    }
-
-    // The gate reads each denied file's pre-edit `before` from the workspace the
-    // runner is co-located with (local FS for OSS; the sandbox in cloud), so a
-    // whole-file rewrite gate renders a true before/after diff. The tool was
-    // DENIED, so disk still holds the old content. User files are never platform
-    // paths, so no platformDir routing is needed here.
-    const gateWorkspaceBackend = new LocalWorkspaceBackend(primaryWorkspaceDir);
-    const deniedToolCalls = await reconcileDeniedToolCalls(
-      status.messages,
-      deniedLedger,
-      mergedPolicies,
-      gateWorkspaceBackend,
-    );
-    // Observability: a synthesized placeholder (id `approval:*`) means a denial
-    // correlated to NO streamed tool call in either the exact or the normalized
-    // pass. After the normalized-path fallback this should be ~0; a non-zero rate
-    // is the early-warning signal of a NEW identity drift (the gate would then
-    // show "No preview available" with no diff). Logged, not thrown — the
-    // synthesized gate still safely surfaces the approval.
-    const synthesizedGateCount = deniedToolCalls.filter((tc) =>
-      tc.id.startsWith("approval:"),
-    ).length;
-    if (synthesizedGateCount > 0) {
-      console.warn(
-        `ExecuteCursor reconcile synthesized ${synthesizedGateCount} placeholder gate(s) ` +
-          `with no correlated stream call (execution=${executionId}); ` +
-          `possible hook/stream identity drift — gate(s) will lack a diff`,
-      );
-    }
-    if (deniedToolCalls.length > 0 || capturedChangeCount > 0) {
-      if (deniedToolCalls.length > 0) {
-        // Deterministic clean-pause: a turn that pauses for approval must read as
-        // the same shape the native harness produces — pre-tool text + the gated
-        // tool calls — never the model's provisional reaction to Cursor's deny
-        // (e.g. "blocked by a hook; enable it in your Cursor settings"). We blank
-        // that reaction in place (keeping the message count, so the finalize stays
-        // append-only) rather than removing it. See
-        // clearProvisionalPostDenialNarration for the full rationale.
-        const redactedNarration = clearProvisionalPostDenialNarration(status.messages, deniedToolCalls);
-        if (redactedNarration.length > 0) {
-          console.log(
-            `ExecuteCursor redacted ${redactedNarration.length} provisional post-denial narration message(s) before pausing for approval`,
-          );
-        }
-      }
+    // Pauses for review exactly like the native harness: the boundary mutated
+    // the transcript in place; we flip the phase, persist, and RETURN to the
+    // workflow, which waits for the approval/file-review signal and reinvokes.
+    const enterApprovalPause = async (boundary: TurnBoundaryResult) => {
       status.phase = ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL;
       await persist(status);
       console.log(
-        `ExecuteCursor returning WAITING_FOR_APPROVAL: ${deniedToolCalls.length} gated tool(s), ` +
-        `${capturedChangeCount} file card(s) pending`,
+        `ExecuteCursor returning WAITING_FOR_APPROVAL: ${boundary.deniedToolCallCount} gated tool(s), ` +
+        `${boundary.capturedChangeCount} file card(s) pending`,
       );
       return slimStatus(status);
+    };
+
+    // Stream epilogue + boundary re-entry for a recovery retry (poisoned-handle /
+    // transport-timeout). The retry re-runs the agent AFTER the primary epilogue
+    // and boundary already ran, so its stream state must be settled the same way:
+    //  - flush the enricher's buffered deltas onto the rows (the primary loop
+    //    applies them every iteration; the bare retry loop does not — without the
+    //    flush, a completed tool call never receives its completedAt evidence and
+    //    finalize's reconciliation sweep leaves it RUNNING forever);
+    //  - finalize streaming state and sync sub-agents;
+    //  - refresh streaming usage (the retry's turns accumulated in memory only)
+    //    and re-stamp completedAt (stamped below BEFORE the retry ran);
+    //  - re-enter the turn boundary so edits made by the retry reach the
+    //    file_review ledger / approval gates — without this, a retry's file
+    //    edits silently escape review (production case
+    //    aex_01kws27q1e2esvkqjpvectttxf).
+    // Returns undefined for a cancelled retry: parity with the primary path,
+    // where cancellation exits before the boundary — there is no review to open.
+    const settleRetryTurn = async (
+      retryResultStatus: string,
+    ): Promise<TurnBoundaryResult | undefined> => {
+      accumulator.finalize();
+      deltaEnricher.applyEnrichments(status.messages);
+      deltaEnricher.finalize(status.messages);
+      status.subAgentExecutions = accumulator.subAgentExecutions;
+      if (usageAccumulator.hasTurns) {
+        status.streamingUsage = create(StreamingUsageSummarySchema, usageAccumulator.snapshot());
+      }
+      // Re-flush the (dev-only) event recorder: flush rewrites the full JSONL,
+      // so the recorded trace now includes the retry's events too.
+      await eventRecorder?.flush();
+      const retryBoundary =
+        retryResultStatus === "cancelled" ? undefined : await runBoundary();
+      // Phase 13 stamped completedAt BEFORE the retry ran. A terminal outcome
+      // re-stamps it to the true end; a review pause CLEARS it — the primary
+      // pause path never stamps it (a waiting turn is not complete).
+      status.completedAt = retryBoundary?.waiting ? "" : utcTimestamp();
+      return retryBoundary;
+    };
+
+    // The denial-settle wait applies only when a first denial stopped THIS run;
+    // the recovery retries have no early stop and pass no promise.
+    const boundary = await runBoundary(firstDenialDetected ? denialCancelSettled : undefined);
+    if (boundary.waiting) {
+      return enterApprovalPause(boundary);
     }
 
     // Phase 13: Map final result
@@ -1460,7 +1473,9 @@ async function executeCursorInner(
             for await (const retryEvent of retryRun.stream()) {
               if (Context.current().cancellationSignal.aborted) break;
               retryWatchdog.recordActivity();
+              eventRecorder?.record(retryEvent, eventCount);
               accumulator.processEvent(retryEvent);
+              eventCount++;
               if (retryEvent.type === "status") {
                 const retryStatusEvent = retryEvent as { status?: string; message?: string };
                 if (retryStatusEvent.status === "ERROR" && retryStatusEvent.message) {
@@ -1479,6 +1494,18 @@ async function executeCursorInner(
             `retryResult=${JSON.stringify(retryResult)}`,
           );
 
+          const retryBoundary = await settleRetryTurn(retryResult.status);
+          if (retryBoundary?.waiting) {
+            // The retry's edits/denials armed the gate — pause for review. On a
+            // retry error this supersedes the failure, exactly as on the primary
+            // path (a captured change pauses the turn before run.wait() is
+            // consulted).
+            console.log(
+              `ExecuteCursor poisoned-handle recovery paused for review: execution=${executionId}`,
+            );
+            return enterApprovalPause(retryBoundary);
+          }
+
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;
             console.log(
@@ -1569,7 +1596,9 @@ async function executeCursorInner(
             for await (const retryEvent of retryRun.stream()) {
               if (Context.current().cancellationSignal.aborted) break;
               retryWatchdog.recordActivity();
+              eventRecorder?.record(retryEvent, eventCount);
               accumulator.processEvent(retryEvent);
+              eventCount++;
               if (retryEvent.type === "status") {
                 const retryStatusEvent = retryEvent as { status?: string; message?: string };
                 if (retryStatusEvent.status === "ERROR" && retryStatusEvent.message) {
@@ -1583,6 +1612,17 @@ async function executeCursorInner(
           }
 
           const retryResult = await retryRun.wait();
+          const retryBoundary = await settleRetryTurn(retryResult.status);
+          if (retryBoundary?.waiting) {
+            // The retry's edits/denials armed the gate — pause for review (see
+            // the poisoned-handle branch above for the precedence rationale).
+            console.log(
+              `ExecuteCursor transport-timeout recovery paused for review: execution=${executionId}`,
+            );
+            resolution = { ...resolution, agent: freshAgent, agentId: freshAgent.agentId, isNew: true };
+            return enterApprovalPause(retryBoundary);
+          }
+
           if (retryResult.status === "finished") {
             status.phase = ExecutionPhase.EXECUTION_COMPLETED;
             resolution = { ...resolution, agent: freshAgent, agentId: freshAgent.agentId, isNew: true };
@@ -1660,10 +1700,10 @@ async function executeCursorInner(
         status.structuredOutput = structuredOutput as JsonObject;
       }
 
-      // Plan mode: publish the final plan message as a plan.md artifact. The
-      // Cursor harness has no auto-publish pipeline, so this is the only
-      // artifact path; build storage from the same config-driven factory the
-      // native harness uses.
+      // Plan mode: publish the final plan message as a plan artifact (named
+      // from the plan's title). The Cursor harness has no auto-publish
+      // pipeline, so this is the only artifact path; build storage from the
+      // same config-driven factory the native harness uses.
       if (interactionMode === InteractionMode.PLAN && finalText && artifactStorage) {
         try {
           await publishPlanArtifact({ status, executionId, planText: finalText, artifactStorage });
@@ -1885,6 +1925,13 @@ async function executeCursorInner(
         );
       }
     }
+
+    // Release the workspace turn lock LAST — hitlCleanup above still mutates
+    // the tree (restores .cursor/hooks.json), and the next queued turn must
+    // not baseline until every mutation of this one has landed. Idempotent
+    // and non-throwing (see workspace-lock.ts), so it can never mask the
+    // turn's real outcome.
+    await releaseWorkspaceLock?.();
   }
 }
 
@@ -1996,6 +2043,11 @@ export interface BuildPromptInput {
    */
   appliedToolCallIds?: ReadonlySet<string>;
   interactionMode?: InteractionMode;
+  /**
+   * The execution is a Build-from-plan turn (spec.execution_config
+   * .build_from_plan): both prompt paths carry the implement-plan directive.
+   */
+  buildFromPlan?: boolean;
 }
 
 /**
@@ -2026,6 +2078,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     workspaceFileRefs,
     attachmentPaths,
     interactionMode,
+    buildFromPlan,
   } = input;
 
   const isHitlReinvocation = approvalDecisions !== undefined && approvalDecisions.size > 0;
@@ -2042,9 +2095,20 @@ export function buildPrompt(input: BuildPromptInput): string {
   }
 
   // A successfully resumed agent carries its own conversation context via the
-  // SDK's native store — send the raw user message with no preamble.
+  // SDK's native store — send the raw user message with no preamble. The
+  // exceptions are the per-EXECUTION directives, which never inherit from the
+  // session's first turn: the interaction-mode prefix (a follow-up can switch
+  // Agent→Plan mid-session, and for Cursor the prompt is the only plan-mode
+  // enforcement) and the implement-plan directive (the build turn is usually
+  // a follow-up on a resumed agent).
   if (resolution.reason === "resumed_successfully") {
-    return userMessage;
+    const prefixes = [
+      formatInteractionModePrefix(interactionMode),
+      formatImplementPlanSection(buildFromPlan, attachmentPaths),
+    ].filter((p): p is string => p !== undefined);
+    return prefixes.length > 0
+      ? [...prefixes, userMessage].join("\n\n")
+      : userMessage;
   }
 
   // First execution, or a fresh agent created after a resume failure: there is
@@ -2058,6 +2122,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     workspaceFileRefs,
     attachmentPaths,
     interactionMode,
+    buildFromPlan,
   });
 }
 

package/src/activities/execute-cursor/message-translator.ts

@@ -50,7 +50,8 @@ import { utcTimestamp } from "../../shared/status.js";
 import { hideToolCallRow, isToolCallRowHidden } from "../../shared/tool-row.js";
 import { classifyTool, toolApprovalCategory, type ToolApprovalCategory } from "../../shared/tool-kind.js";
 import { resolveWorkspacePath } from "../../shared/file-change.js";
-import { contentDigest } from "../../shared/file-tools.js";
+import { contentDigest, extractFilePath } from "../../shared/file-tools.js";
+import { isSecretLikePath } from "../../shared/filereview/secret-paths.js";
 import { buildElidedArgsPreview } from "../../shared/args-preview.js";
 import type { WorkspaceBackend } from "../../shared/workspace/types.js";
 
@@ -1631,6 +1632,13 @@ function applyGateInput(
   input: Record<string, unknown> | undefined,
 ): void {
   if (!input) return;
+  // Defense-in-depth (DD-26 #2): never overlay a secret-like write's content into
+  // the persisted approval preview. Normally unreachable — the hook hard-blocks a
+  // secret write and records no ledger input — but if a hook classify failure fell
+  // one through, its content must still never reach args/args_preview. The
+  // Invariant-A backstop is the final net; this closes the path at the source.
+  const gatePath = extractFilePath(input);
+  if (gatePath !== null && isSecretLikePath(gatePath)) return;
   tc.args = input as JsonObject;
   tc.argsPreview = buildElidedArgsPreview(input, SALIENT_ARG_FIELDS);
   // Stamp the content digest from the AUTHORITATIVE captured input, so the