@stigmer/runner 3.1.1 → 3.1.3

package/src/activities/execute-cursor/prompt-builder.ts

@@ -6,19 +6,25 @@
  * parameter). On reinvocation, only the approval decisions are sent.
  *
  * Sections (in order, conditionally included):
- * 1. Agent instructions (persona/character)
- * 2. Available skills metadata
- * 3. Sub-agent delegation guidance
- * 4. Workspace context (multi-root only; single-dir is redundant with SDK cwd)
- * 5. Input files / referenced files
- * 6. Response rules (only when agent has no custom instructions)
- * 7. User's actual message
+ * 1. Interaction-mode / implement-plan directives
+ * 2. Agent instructions (persona/character)
+ * 3. Available skills metadata
+ * 4. Sub-agent delegation guidance
+ * 5. Workspace context (multi-root only; single-dir is redundant with SDK cwd)
+ * 6. Input files / referenced files
+ * 7. Response rules (only when agent has no custom instructions)
+ * 8. User's actual message
  */
 
 import { resolve } from "node:path";
 import type { SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
+import {
+  buildImplementPlanDirective,
+  findApprovedPlanPath,
+} from "../../shared/implement-plan-prompt.js";
 
 /**
  * Marker path segments that identify runner-internal directories. A workspace
@@ -47,6 +53,13 @@ export interface EnhancedPromptOptions {
   workspaceFileRefs: string[];
   attachmentPaths: string[];
   interactionMode?: InteractionMode;
+  /**
+   * The execution is a Build-from-plan turn (spec.execution_config
+   * .build_from_plan): inject the implement-plan directive so the model reads
+   * the attached approved plan (or falls back to the conversation's plan).
+   * The user message itself is just a short label ("Build from plan").
+   */
+  buildFromPlan?: boolean;
 }
 
 /**
@@ -63,6 +76,14 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(modePrefix);
   }
 
+  const implementPlan = formatImplementPlanSection(
+    options.buildFromPlan,
+    options.attachmentPaths,
+  );
+  if (implementPlan) {
+    sections.push(implementPlan);
+  }
+
   if (options.instructions) {
     sections.push(formatInstructions(options.instructions));
   }
@@ -348,30 +369,47 @@ export function formatReferencedFiles(refs: string[]): string {
 /**
  * Returns a system-level directive when the execution is in Plan mode.
  * Returns `undefined` for Agent mode (default) since no prefix is needed.
+ *
+ * The directive body is the harness-agnostic {@link PLAN_MODE_DIRECTIVE}
+ * (shared with the native harness) wrapped in this harness's XML-tag section
+ * framing. For Cursor this prompt IS the plan-mode enforcement — the Cursor
+ * SDK exposes no mode parameter — see the shared module's doc comment.
  */
 export function formatInteractionModePrefix(
   mode: InteractionMode | undefined,
 ): string | undefined {
-  if (
-    mode == null ||
-    mode === InteractionMode.UNSPECIFIED ||
-    mode === InteractionMode.AGENT
-  ) {
+  if (mode !== InteractionMode.PLAN) {
     return undefined;
   }
 
-  if (mode === InteractionMode.PLAN) {
-    return [
-      "<interaction_mode>",
-      "IMPORTANT: You are in Plan mode. Analyze the codebase and produce a detailed plan.",
-      "Do NOT create, edit, or delete any files. Do NOT run commands that modify the filesystem.",
-      "Only read, search, and analyze. Your output should be analysis, recommendations, and",
-      "implementation plans — not code changes.",
-      "</interaction_mode>",
-    ].join("\n");
+  return ["<interaction_mode>", PLAN_MODE_DIRECTIVE, "</interaction_mode>"].join(
+    "\n",
+  );
+}
+
+/**
+ * Returns the implement-plan directive section for a Build-from-plan
+ * execution, or `undefined` otherwise. The directive body is the shared
+ * {@link buildImplementPlanDirective} (same words as the native harness)
+ * wrapped in this harness's XML-tag framing; the variant is picked by whether
+ * the approved plan document is among the resolved attachment paths.
+ *
+ * Like the interaction-mode prefix, this rides BOTH prompt paths — the fresh
+ * enhanced prompt and a resumed turn's prefix — because build_from_plan is
+ * per-execution and the build turn is usually a follow-up on a resumed agent.
+ */
+export function formatImplementPlanSection(
+  buildFromPlan: boolean | undefined,
+  attachmentPaths: string[],
+): string | undefined {
+  if (!buildFromPlan) {
+    return undefined;
   }
 
-  return undefined;
+  const directive = buildImplementPlanDirective(
+    findApprovedPlanPath(attachmentPaths),
+  );
+  return ["<implement_plan>", directive, "</implement_plan>"].join("\n");
 }
 
 export function formatResponseRules(): string {

package/src/activities/execute-cursor/skill-resolver.ts

@@ -5,11 +5,11 @@
  * - Writes SKILL.md to .stigmer/skills/{name}/SKILL.md
  * - Downloads and extracts ZIP artifacts (references/, scripts/, etc.)
  * - Uses a platform-managed directory outside the workspace
- * - Creates a symlink from the workspace to the platform dir
+ * - Ensures the workspace `.stigmer` symlink (see stigmer-link.ts)
  * - Returns metadata for prompt injection
  */
 
-import { mkdir, writeFile, symlink, readlink, unlink, rm, lstat } from "node:fs/promises";
+import { mkdir, writeFile, rm } from "node:fs/promises";
 import { join, dirname } from "node:path";
 import type { StigmerClient } from "../../client/stigmer-client.js";
 import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
@@ -17,8 +17,8 @@ import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/ap
 import type { SkillMetadata } from "./prompt-builder.js";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
 import { extractZipFileEntries } from "../../shared/zip-extract.js";
+import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "./stigmer-link.js";
 
-const STIGMER_LOCAL_STATE_DIR = ".stigmer";
 const SKILLS_SUBDIR = "skills";
 
 export interface SkillResolverOptions {
@@ -132,62 +132,6 @@ async function writeSkill(
   };
 }
 
-/**
- * Ensure .stigmer symlink in the workspace points to the platform dir.
- *
- * The Cursor SDK reads files from the workspace CWD, so we need the
- * .stigmer directory to be accessible there. Unlike the Python runner
- * which intercepts file paths, Cursor reads directly from the filesystem.
- */
-async function ensureStigmerSymlink(
-  workspaceDir: string,
-  platformDir: string,
-): Promise<void> {
-  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
-
-  try {
-    const existing = await readlink(linkPath);
-    if (existing === platformDir) return;
-    await unlink(linkPath);
-  } catch (err: any) {
-    if (err.code === "ENOENT") {
-      // No existing symlink
-    } else if (err.code === "EINVAL") {
-      // Exists but is not a symlink — remove the directory
-      await rm(linkPath, { recursive: true, force: true });
-    } else {
-      throw err;
-    }
-  }
-
-  await symlink(platformDir, linkPath, "dir");
-}
-
-/**
- * Remove the workspace `.stigmer` symlink created by {@link resolveSkills}.
- *
- * Called in the activity's finally so attaching a real repo leaves no Stigmer
- * symlink behind once the turn ends (issue #173); a multi-turn session recreates
- * it on the next turn. Only ever removes a SYMLINK — a real `.stigmer` directory
- * (which would be the user's own, not ours) is left untouched. Best-effort.
- */
-export async function removeStigmerSymlink(workspaceDir: string): Promise<void> {
-  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
-  try {
-    const stat = await lstat(linkPath);
-    if (stat.isSymbolicLink()) {
-      await unlink(linkPath);
-    }
-  } catch (err: any) {
-    if (err?.code !== "ENOENT") {
-      console.warn(
-        `removeStigmerSymlink: failed to remove ${linkPath} (non-fatal): ` +
-        `${err instanceof Error ? err.message : err}`,
-      );
-    }
-  }
-}
-
 /**
  * Clean up platform-managed skill directory for a session.
  */

package/src/activities/execute-cursor/stigmer-link.ts

@@ -0,0 +1,78 @@
+/**
+ * The workspace `.stigmer` symlink — the Cursor harness's bridge from the
+ * user's workspace to the session's platform-managed directory
+ * (~/.stigmer/sessions/{id}/platform/, see shared/workspace/platform-dir.ts).
+ *
+ * The Cursor SDK reads files from the workspace CWD, so platform-injected
+ * content (skills, attachment inputs) must be reachable there; the symlink is
+ * how, without ever writing platform files into the user's repo (issue #173).
+ * This mechanism is deliberately harness-local: the native harness routes
+ * `.stigmer/` paths through its WorkspaceBackend instead and never symlinks.
+ *
+ * Both resolvers that populate the platform dir (skills, attachments) call
+ * {@link ensureStigmerSymlink}; it is idempotent, so either may run first and
+ * an agent with only one kind of content still gets the link. The activity's
+ * cleanup calls {@link removeStigmerSymlink} so a real repo is left untouched
+ * once the turn ends; a multi-turn session recreates the link on the next turn.
+ */
+
+import { symlink, readlink, unlink, rm, lstat } from "node:fs/promises";
+import { join } from "node:path";
+
+/** The workspace-visible name of the platform namespace. */
+export const STIGMER_LOCAL_STATE_DIR = ".stigmer";
+
+/**
+ * Ensure the workspace `.stigmer` symlink points to the platform dir.
+ * Idempotent: an existing correct link is kept; a stale link (or a non-link
+ * left behind by an older runner) is replaced.
+ */
+export async function ensureStigmerSymlink(
+  workspaceDir: string,
+  platformDir: string,
+): Promise<void> {
+  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
+
+  try {
+    const existing = await readlink(linkPath);
+    if (existing === platformDir) return;
+    await unlink(linkPath);
+  } catch (err: any) {
+    if (err.code === "ENOENT") {
+      // No existing symlink
+    } else if (err.code === "EINVAL") {
+      // Exists but is not a symlink — remove the directory
+      await rm(linkPath, { recursive: true, force: true });
+    } else {
+      throw err;
+    }
+  }
+
+  await symlink(platformDir, linkPath, "dir");
+}
+
+/**
+ * Remove the workspace `.stigmer` symlink created by
+ * {@link ensureStigmerSymlink}.
+ *
+ * Called in the activity's finally so attaching a real repo leaves no Stigmer
+ * symlink behind once the turn ends (issue #173). Only ever removes a
+ * SYMLINK — a real `.stigmer` directory (which would be the user's own, not
+ * ours) is left untouched. Best-effort.
+ */
+export async function removeStigmerSymlink(workspaceDir: string): Promise<void> {
+  const linkPath = join(workspaceDir, STIGMER_LOCAL_STATE_DIR);
+  try {
+    const stat = await lstat(linkPath);
+    if (stat.isSymbolicLink()) {
+      await unlink(linkPath);
+    }
+  } catch (err: any) {
+    if (err?.code !== "ENOENT") {
+      console.warn(
+        `removeStigmerSymlink: failed to remove ${linkPath} (non-fatal): ` +
+        `${err instanceof Error ? err.message : err}`,
+      );
+    }
+  }
+}

package/src/activities/execute-cursor/turn-boundary.ts

@@ -0,0 +1,274 @@
+/**
+ * The Cursor harness's turn boundary — the single post-run pipeline that turns
+ * a finished agent run into the durable review surfaces:
+ *
+ *  1. read the denial ledger the preToolUse hook appended this turn;
+ *  2. derive the approved-command provenance (DD-28 auto-keep facts);
+ *  3. capture the turn's net file change set to the file_review ledger
+ *     (CANDIDATE_CAPTURED) and stamp the flowed edit rows;
+ *  4. reconcile denied tool calls to WAITING_APPROVAL gate rows and redact the
+ *     model's provisional post-denial narration.
+ *
+ * Extracted from the activity entry point (index.ts Phase 12) so it is directly
+ * unit-testable AND re-enterable: the poisoned-handle / transport-timeout
+ * recoveries re-run the agent with a fresh handle AFTER the primary boundary
+ * already ran, so their edits must flow through this exact pipeline again or
+ * they silently escape review (production case aex_01kws27q1e2esvkqjpvectttxf,
+ * where a Build-from-plan retry created a file with no review gate).
+ *
+ * Re-entry is safe by construction: a retry is only reachable when the primary
+ * boundary captured nothing (a captured change pauses the turn before
+ * run.wait() is ever consulted), `stampFlowedFileEditRows` skips already-stamped
+ * rows, and the denial ledger is per-turn append-only.
+ *
+ * The caller owns everything around the boundary: the stream epilogue
+ * (accumulator/enricher finalize), the WAITING_FOR_APPROVAL phase flip +
+ * persist, and the terminal result mapping.
+ */
+
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
+import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
+import type { ArtifactStorage } from "../../shared/artifact-storage.js";
+import type { MergedToolPolicy } from "../../shared/approval-policy.js";
+import { primaryToken, readDenialLedger, type ApprovalGrant } from "./approval-state.js";
+import { deriveTurnCommandProvenance } from "./command-provenance.js";
+import { captureTurnToLedger } from "./capture-flow.js";
+import {
+  clearProvisionalPostDenialNarration,
+  reconcileDeniedToolCalls,
+} from "./message-translator.js";
+
+// How long the boundary waits for the first-denial-stop's run.cancel() to
+// settle before reading the final denial ledger and capturing the turn's tree.
+// Long enough for the SDK's normal teardown, short enough that a wedged cancel
+// cannot noticeably delay the approval pause the user is already waiting on.
+const FIRST_DENIAL_CANCEL_TIMEOUT_MS = 5_000;
+
+export interface TurnBoundaryOptions {
+  /** Mutated in place: gate rows overlaid, edit rows stamped, narration redacted. */
+  readonly status: AgentExecutionStatus;
+  readonly executionId: string;
+  /** This turn's change set id (`{executionId}:{turnSeq}`). */
+  readonly changeSetId: string;
+  /** Session HITL dir holding the denial ledger + CAS sidecar; undefined → no gate installed. */
+  readonly hitlDir: string | undefined;
+  /** Whether this turn runs apply-then-review capture (vs. the deny-gate fallback). */
+  readonly captureMode: boolean;
+  /**
+   * The baseline authored at turn start — the git tree sha for a git workspace,
+   * or "" (empty, but authored) for a non-git one. `undefined` means no baseline
+   * was authored this turn, which skips capture entirely; a plain truthiness
+   * check would wrongly skip the non-git capture.
+   */
+  readonly baselineTree: string | undefined;
+  readonly primaryWorkspaceDir: string;
+  /** True for a git work tree; false for a CAS-only non-git workspace. */
+  readonly gitWorkspace: boolean;
+  /**
+   * Index of the first message produced by THIS turn's stream — the positional
+   * turn boundary the approved-command provenance (DD-28) scopes to.
+   */
+  readonly turnStartMessageIndex: number;
+  /** Reinvocation grants; their tokens map back to the consent rows for DD-28. */
+  readonly approvalGrants: ApprovalGrant[] | undefined;
+  /** spec.auto_approve_all — qualifies every command as consented for DD-28. */
+  readonly globalBypass: boolean;
+  /**
+   * Sub-agent executions that existed BEFORE this turn's stream (cloned in on
+   * resume); their rows are skipped when stamping so a resume never re-stamps a
+   * prior turn's sub-agent rows.
+   */
+  readonly seededSubAgents: readonly SubAgentExecution[];
+  /** CAS blob store for gitignored/non-git captures; undefined → git-only capture. */
+  readonly artifactStorage: ArtifactStorage | undefined;
+  /** Merged approval policies, threaded to the denied-call reconcile for gate provenance. */
+  readonly mergedPolicies: Map<string, MergedToolPolicy>;
+  /**
+   * The first-denial-stop's run.cancel() promise, when a denial stopped this
+   * run. Awaited (timeboxed) before the ledger read: run.cancel() races the
+   * SDK's auto-execution — until it lands, the agent process may still attempt
+   * a post-denial workaround whose hook denial would land AFTER a premature
+   * ledger read (the row then never collapses and renders as RUNNING forever —
+   * production case aex_01kwj07f7g23c3wp9sn8496z5g), or a late tool could
+   * mutate the tree mid-capture. Omit when no denial stopped the run (the
+   * normal completion path and the recovery retries, which have no early stop).
+   */
+  readonly denialCancelSettled?: Promise<void>;
+}
+
+export interface TurnBoundaryResult {
+  /**
+   * True when the turn must pause for human review — at least one gated tool
+   * call or one captured file change. The caller flips the phase to
+   * WAITING_FOR_APPROVAL, persists, and returns without consulting run.wait().
+   */
+  readonly waiting: boolean;
+  /** File changes authored to the file_review ledger this call (0 = no candidate). */
+  readonly capturedChangeCount: number;
+  /** Denied tool calls reconciled to WAITING_APPROVAL gate rows this call. */
+  readonly deniedToolCallCount: number;
+}
+
+/**
+ * Run the turn boundary: author this turn's change set to the file_review
+ * ledger and overlay the hook's denials as approval gates. Mutates
+ * `opts.status` in place and reports whether the turn must pause.
+ *
+ * The hook records each denial to the ledger; we mark the corresponding tool
+ * calls WAITING_APPROVAL. The backend projects pending_approvals from that
+ * tool-call status (PendingApprovalComputer), so — exactly like the native
+ * harness — the approval surface is driven entirely by tool-call status. We
+ * deliberately do NOT set status.pendingApprovals here: any value would be
+ * discarded by the backend's recompute on the next updateStatus.
+ */
+export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBoundaryResult> {
+  const {
+    status,
+    executionId,
+    changeSetId,
+    hitlDir,
+    captureMode,
+    baselineTree,
+    primaryWorkspaceDir,
+    gitWorkspace,
+    turnStartMessageIndex,
+    approvalGrants,
+    globalBypass,
+    seededSubAgents,
+    artifactStorage,
+    mergedPolicies,
+    denialCancelSettled,
+  } = opts;
+
+  // The timebox keeps a wedged cancel from hanging the pause; the reconcile
+  // trims below remain the backstop for that degraded case.
+  if (denialCancelSettled) {
+    await Promise.race([
+      denialCancelSettled,
+      new Promise<void>((resolve) => {
+        const timer = setTimeout(resolve, FIRST_DENIAL_CANCEL_TIMEOUT_MS);
+        timer.unref();
+      }),
+    ]);
+  }
+  const deniedLedger = await readDenialLedger(hitlDir ?? "");
+
+  // Capture mode: author the net change set to the file_review ledger as the
+  // CANDIDATE_CAPTURED event (projected server-side to a file_change_set
+  // AWAITING_REVIEW — the single review surface). The runner-owned gate files
+  // are excluded from the capture. The agent's edits are LEFT applied on the
+  // working tree (Cursor parity — the user reviews the real change; nothing is
+  // committed and the next turn is blocked until approval, and a reject snaps
+  // each file back on resume). Runs BEFORE the denial reconcile so a denied
+  // (gitignored) write stays on the deny-gate path while every flowed edit is
+  // captured to the ledger.
+  let capturedChangeCount = 0;
+  if (captureMode && baselineTree !== undefined && primaryWorkspaceDir) {
+    const deniedTokens = new Set(deniedLedger.map((e) => e.token));
+    // Approved-command turn facts (DD-28): when every mutation-capable call
+    // this turn was a consented shell command, attach the provenance so the
+    // backend can verify the cited consent rows and auto-keep the set instead
+    // of arming a second gate. Fail-closed: any non-qualifying turn attaches
+    // nothing and reviews manually exactly as before.
+    const commandProvenance = deriveTurnCommandProvenance({
+      messages: status.messages,
+      turnStartIndex: turnStartMessageIndex,
+      deniedTokens,
+      grantTokenToConsentId: new Map(
+        (approvalGrants ?? []).map((g) => [
+          primaryToken(g.key, g.salient, g.contentDigest),
+          g.sourceToolCallId,
+        ]),
+      ),
+      globalBypass,
+    });
+    if (commandProvenance) {
+      console.log(
+        `ExecuteCursor capture: turn qualifies for approved-command auto-keep ` +
+        `(consent rows: ${commandProvenance.consentToolCallIds.join(",") || "(auto_approve_all)"}); ` +
+        `attaching provenance to candidate (execution=${executionId})`,
+      );
+    }
+    const captured = await captureTurnToLedger({
+      status,
+      gitRoot: primaryWorkspaceDir,
+      executionId,
+      changeSetId,
+      baselineTree,
+      messages: status.messages,
+      deniedTokens,
+      commandProvenance,
+      // Scope sub-agent row stamping to this turn: the seeded prior sub-agents
+      // (cloned in on resume) are the "before this turn" rows to skip.
+      priorSubAgentToolCallIds: collectSubAgentToolCallIds(seededSubAgents),
+      // The CAS half: read the sidecar the hook staged this turn and compose it
+      // into the change set. hitlDir + storage are present when captureIgnored
+      // was on (a git tree's gitignored writes, or ALL writes in a non-git
+      // workspace). In a git tree this composes with the git diff (HYBRID); in a
+      // non-git workspace it IS the whole change set (CAS-only).
+      hitlDir,
+      storage: artifactStorage,
+      gitWorkspace,
+    });
+    capturedChangeCount = captured.length;
+    if (capturedChangeCount > 0) {
+      console.log(
+        `ExecuteCursor capture: ${capturedChangeCount} file change(s) authored to the ` +
+        `file_review ledger (change_set=${changeSetId}), working tree left applied ` +
+        `for review (execution=${executionId})`,
+      );
+    }
+  }
+
+  // The gate reads each denied file's pre-edit `before` from the workspace the
+  // runner is co-located with (local FS for OSS; the sandbox in cloud), so a
+  // whole-file rewrite gate renders a true before/after diff. The tool was
+  // DENIED, so disk still holds the old content. User files are never platform
+  // paths, so no platformDir routing is needed here.
+  const gateWorkspaceBackend = new LocalWorkspaceBackend(primaryWorkspaceDir);
+  const deniedToolCalls = await reconcileDeniedToolCalls(
+    status.messages,
+    deniedLedger,
+    mergedPolicies,
+    gateWorkspaceBackend,
+  );
+  // Observability: a synthesized placeholder (id `approval:*`) means a denial
+  // correlated to NO streamed tool call in either the exact or the normalized
+  // pass. After the normalized-path fallback this should be ~0; a non-zero rate
+  // is the early-warning signal of a NEW identity drift (the gate would then
+  // show "No preview available" with no diff). Logged, not thrown — the
+  // synthesized gate still safely surfaces the approval.
+  const synthesizedGateCount = deniedToolCalls.filter((tc) =>
+    tc.id.startsWith("approval:"),
+  ).length;
+  if (synthesizedGateCount > 0) {
+    console.warn(
+      `ExecuteCursor reconcile synthesized ${synthesizedGateCount} placeholder gate(s) ` +
+        `with no correlated stream call (execution=${executionId}); ` +
+        `possible hook/stream identity drift — gate(s) will lack a diff`,
+    );
+  }
+  if (deniedToolCalls.length > 0) {
+    // Deterministic clean-pause: a turn that pauses for approval must read as
+    // the same shape the native harness produces — pre-tool text + the gated
+    // tool calls — never the model's provisional reaction to Cursor's deny
+    // (e.g. "blocked by a hook; enable it in your Cursor settings"). We blank
+    // that reaction in place (keeping the message count, so the finalize stays
+    // append-only) rather than removing it. See
+    // clearProvisionalPostDenialNarration for the full rationale.
+    const redactedNarration = clearProvisionalPostDenialNarration(status.messages, deniedToolCalls);
+    if (redactedNarration.length > 0) {
+      console.log(
+        `ExecuteCursor redacted ${redactedNarration.length} provisional post-denial narration message(s) before pausing for approval`,
+      );
+    }
+  }
+
+  return {
+    waiting: deniedToolCalls.length > 0 || capturedChangeCount > 0,
+    capturedChangeCount,
+    deniedToolCallCount: deniedToolCalls.length,
+  };
+}

package/src/activities/execute-cursor/workspace-provision.ts

@@ -12,14 +12,16 @@ import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_
 import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
 import { ensurePlatformDir } from "../../shared/workspace/platform-dir.js";
+import { resolveSessionWorkspaceRoot } from "../../shared/workspace/session-root.js";
 
 /**
  * Provision the session's workspace entries for a LOCAL Cursor agent.
  *
  * Clones git-repo entries (using the user's GITHUB_TOKEN from the resolved
  * execution environment) and mounts local-path entries, then returns the
- * directories the agent should operate in. Falls back to the configured
- * workspace root when the session declares no workspace entries.
+ * directories the agent should operate in. A session with no workspace
+ * entries gets its own empty per-session directory (see session-root.ts) —
+ * never the shared root, which would leak other sessions' files into it.
  *
  * provisionGit is idempotent (it reuses an existing clone), so this is safe
  * to call on every execution, including multi-turn and HITL reinvocations.
@@ -32,7 +34,7 @@ export async function provisionCursorWorkspace(
 ): Promise<string[]> {
   const entries = session.spec?.workspaceEntries ?? [];
   if (entries.length === 0) {
-    return [config.workspaceRootDir];
+    return [await resolveSessionWorkspaceRoot(config.workspaceRootDir, entries, sessionId)];
   }
 
   const platformDir = await ensurePlatformDir(sessionId);

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -49,7 +49,9 @@ import type { SetupResult } from "../setup.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -258,7 +260,9 @@ function fakeDurableResumeSetup(): SetupResult {
     },
     agent: {},
     session: { spec: { workspaceEntries: [] } },
-    workspaceBackend: { rootDir: "/tmp/ws" },
+    // Unique per test file: the workspace turn lock keys on this path, and a
+    // path shared across files would serialize parallel test workers for real.
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-approve-all" },
     mcpConnection: null,
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
@@ -292,6 +296,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
 };
 
 describe("ExecuteDeepAgent — APPROVE_ALL durable resume preserves leading thinking + first tool call", () => {

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -42,7 +42,9 @@ import type { SetupResult } from "../setup.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -213,7 +215,9 @@ function fakeDurableResumeSetup(): SetupResult {
     },
     agent: {},
     session: { spec: { workspaceEntries: [] } },
-    workspaceBackend: { rootDir: "/tmp/ws" },
+    // Unique per test file: the workspace turn lock keys on this path, and a
+    // path shared across files would serialize parallel test workers for real.
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-history" },
     mcpConnection: null,
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
@@ -246,6 +250,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
 };
 
 describe("ExecuteDeepAgent — durable-checkpoint resume preserves history", () => {

package/src/activities/execute-deep-agent/__tests__/index.test.ts

@@ -8,7 +8,9 @@ import type { Config } from "../../../config.js";
 vi.mock("@temporalio/activity", () => ({
   Context: {
     current: () => ({
-      cancellationSignal: { aborted: false },
+      // A real AbortSignal: the workspace-lock wait registers abort listeners
+      // on it, which a bare `{ aborted: false }` stub cannot satisfy.
+      cancellationSignal: new AbortController().signal,
       heartbeat: vi.fn(),
     }),
   },
@@ -45,6 +47,7 @@ describe("ExecuteDeepAgent activity", () => {
     checkpointerProxyEndpoint: null,
     primaryModel: "gpt-4.1",
     cursorStreamStallTimeoutMs: 180000,
+    workspaceLockTimeoutMs: 900000,
   };
 
   let activities: ReturnType<typeof createDeepAgentActivities>;