@stigmer/runner 3.1.1 → 3.1.3

package/src/middleware/__tests__/approval-gate.test.ts

@@ -398,7 +398,10 @@ describe("ApprovalGateMiddleware", () => {
       expect(mockedInterrupt).not.toHaveBeenCalled();
     });
 
-    it("KEEPS GATING a gitignored write (it cannot be captured or reverted)", async () => {
+    it("KEEPS GATING a non-secret gitignored write (it cannot be captured or reverted)", async () => {
+      // A NON-secret gitignored path: no CAS routing (captureIgnored unset) and not
+      // secret-like, so it stays on the interrupt gate. (A secret-like gitignored
+      // write is hard-blocked instead — see the DD-26 #2 deny-gate cases below.)
       const mw = createApprovalGateMiddleware(makeConfig({
         fileCaptureMode: true,
         isCapturablePath: async () => false, // gitignored
@@ -406,7 +409,7 @@ describe("ApprovalGateMiddleware", () => {
       mockedInterrupt.mockReturnValue({ action: "approve" });
 
       await mw.wrapToolCall!(
-        makeRequest({ name: "write", args: { path: ".env" } }),
+        makeRequest({ name: "write", args: { path: "dist/bundle.js" } }),
         passthrough,
       );
 
@@ -650,12 +653,12 @@ describe("ApprovalGateMiddleware", () => {
       expect(mockedInterrupt).toHaveBeenCalledTimes(1);
     });
 
-    it("GATES a secret-like write when capture mode is off — Cursor parity: gated, NOT hard-blocked", async () => {
-      // The secret hard-block lives only inside the fileCaptureMode+captureIgnored
-      // arm; with no substrate that arm is off, so a secret-like write is GATED
-      // (shown for approval) rather than hard-blocked — exactly what Cursor's
-      // no-storage hook does. It exposes no more than Cursor (secret parity, see
-      // the parity investigation in the project docs).
+    it("HARD-BLOCKS a secret-like write when capture mode is off (DD-26 #2): never gated, never applied", async () => {
+      // DD-26 follow-up #2 supersedes the earlier "gated, not hard-blocked" parity:
+      // a secret-like write must NEVER surface its content for approval, in ANY
+      // mode. On the deny-gate it is hard-blocked exactly like the capture-mode
+      // secret block — never interrupted, never applied. The content never reaches
+      // a pending approval or the persisted transcript.
       const handler = vi.fn(passthrough);
       const recordBlockedSecret = vi.fn();
       const mw = createApprovalGateMiddleware(makeConfig({
@@ -665,14 +668,76 @@ describe("ApprovalGateMiddleware", () => {
       }));
       mockedInterrupt.mockReturnValue({ action: "approve" });
 
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "write", args: { path: ".env", content: "API_KEY=xyz" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled(); // hard-block, not a pause
+      expect(handler).not.toHaveBeenCalled(); // never applied
+      expect(recordBlockedSecret).toHaveBeenCalledWith(".env");
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("hard-blocks a secret-like edit too (id_rsa via path fragment)", async () => {
+      const handler = vi.fn(passthrough);
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: false,
+        captureIgnored: false,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "edit", args: { path: ".ssh/id_rsa", old_string: "a", new_string: "b" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect(handler).not.toHaveBeenCalled();
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("hard-blocks a secret write in a git workspace with no storage (captureMode on, captureIgnored off)", async () => {
+      // captureMode true + captureIgnored false = a git workspace with no artifact
+      // storage. A gitignored secret write skips the captureIgnored arm and would
+      // otherwise have reached the deny-gate (a leak); it is now hard-blocked too,
+      // and the recorded path lets the turn boundary author a content-less entry.
+      const handler = vi.fn(passthrough);
+      const recordBlockedSecret = vi.fn();
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: true,
+        isCapturablePath: async () => false, // gitignored
+        captureIgnored: false, // no artifact storage
+        recordBlockedSecret,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "write", args: { path: "secrets.yaml", content: "token: t" } }),
+        handler,
+      );
+
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect(handler).not.toHaveBeenCalled();
+      expect(recordBlockedSecret).toHaveBeenCalledWith("secrets.yaml");
+      expect((result as ToolMessage).content).toContain("blocked for security");
+    });
+
+    it("still GATES a NON-secret write when capture mode is off (deny-gate unchanged)", async () => {
+      const handler = vi.fn(passthrough);
+      const mw = createApprovalGateMiddleware(makeConfig({
+        fileCaptureMode: false,
+        captureIgnored: false,
+      }));
+      mockedInterrupt.mockReturnValue({ action: "approve" });
+
       await mw.wrapToolCall!(
-        makeRequest({ name: "write", args: { path: ".env" } }),
+        makeRequest({ name: "write", args: { path: "notes.md", content: "hi" } }),
         handler,
       );
 
-      expect(mockedInterrupt).toHaveBeenCalledTimes(1); // gated, not hard-blocked
-      expect(recordBlockedSecret).not.toHaveBeenCalled(); // no capture arm to record it
-      expect(handler).toHaveBeenCalledTimes(1); // flows only after the user approves
+      expect(mockedInterrupt).toHaveBeenCalledTimes(1); // a non-secret write still gates
+      expect(handler).toHaveBeenCalledTimes(1); // flows after approve
     });
 
     it("still auto-approves read-only built-ins when capture mode is off", async () => {

package/src/middleware/approval-gate.ts

@@ -138,6 +138,24 @@ const CATEGORY_APPROVAL_MESSAGE: Record<ToolApprovalCategory, string> = {
   shell: "Execute command: {{args.command}}",
 };
 
+/**
+ * The ToolMessage returned when a secret-like write is hard-blocked (DD-E /
+ * DD-26 #2): the write is NEVER applied and the graph continues (this replaces
+ * the tool call's side effect, so the model moves on rather than waiting). The
+ * path is named (a filename is not itself the secret); the CONTENT is not echoed.
+ * Shared by the capture-mode secret block and the deny-gate secret block so both
+ * speak with one voice.
+ */
+function secretBlockToolMessage(toolName: string, path: string, toolCallId: string): ToolMessage {
+  return new ToolMessage({
+    content:
+      `Tool '${toolName}' was blocked for security: '${path}' matches a ` +
+      `secret-like path Stigmer will not capture for review. Nothing was written.`,
+    tool_call_id: toolCallId,
+    name: toolName,
+  });
+}
+
 export function createApprovalGateMiddleware(
   config: ApprovalGateConfig,
 ): StigmerMiddleware {
@@ -183,13 +201,7 @@ export function createApprovalGateMiddleware(
               // and NEVER captured. Record it so the turn boundary authors a
               // DIFF_UNREVIEWABLE entry (blocking approval); nothing is written.
               config.recordBlockedSecret?.(path);
-              return new ToolMessage({
-                content:
-                  `Tool '${toolName}' was blocked for security: '${path}' matches a ` +
-                  `secret-like path Stigmer will not capture for review. Nothing was written.`,
-                tool_call_id: toolCall.id,
-                name: toolName,
-              });
+              return secretBlockToolMessage(toolName, path, toolCall.id);
             }
             if (category === "write") {
               // Non-secret gitignored write/edit: flows (apply-then-review). The
@@ -203,6 +215,26 @@ export function createApprovalGateMiddleware(
         }
       }
 
+      // Deny-gate secret hard-block (DD-26 #2): a built-in file WRITE to a
+      // secret-like path that reaches here has no capture substrate for it — the
+      // classic no-storage deny-gate, or a git workspace with no artifact storage
+      // whose gitignored write skipped the captureIgnored arm above. It must NOT
+      // surface its content for approval, so hard-block it (never applied, graph
+      // continues) exactly like the capture-mode secret block — a secret write is
+      // never applied or persisted in ANY mode. Placed AFTER the capture block so
+      // capture-mode paths stay byte-identical (a capturable write already flowed;
+      // a captureIgnored gitignored secret is already blocked). Deletes carry no
+      // content and stay on the deny-gate. recordBlockedSecret is a no-op unless a
+      // turn boundary reads it (the git-no-storage case, where it authors a
+      // content-less DIFF_UNREVIEWABLE).
+      if (!serverSlug && category === "write") {
+        const path = extractFilePath(toolCall.args);
+        if (path !== null && isSecretLikePath(path)) {
+          config.recordBlockedSecret?.(path);
+          return secretBlockToolMessage(toolName, path, toolCall.id);
+        }
+      }
+
       const requirement = resolveToolApproval(
         toolName,
         serverSlug,

package/src/runner-manager.ts

@@ -24,7 +24,7 @@ import {
 } from "@temporalio/worker";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
@@ -91,6 +91,9 @@ export interface RunnerManagerOptions {
   /** No-progress bound for the Cursor harness stream (ms). @default 180000 */
   readonly cursorStreamStallTimeoutMs?: number;
 
+  /** Max wait for the per-workspace turn lock (ms). @default 900000 */
+  readonly workspaceLockTimeoutMs?: number;
+
   /** Checkpointer type for LangGraph agent state. @default "memory" (or "http" if proxyEndpoint is set) */
   readonly checkpointerType?: "memory" | "http";
 
@@ -576,6 +579,8 @@ export function mapManagerOptionsToConfig(
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,
+    workspaceLockTimeoutMs:
+      options.workspaceLockTimeoutMs ?? DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS,
   };
 }
 

package/src/runner.ts

@@ -17,7 +17,7 @@ import { join } from "node:path";
 import { homedir, tmpdir } from "node:os";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveRunnerBootstrap } from "./bootstrap.js";
 
@@ -69,6 +69,9 @@ export interface StigmerRunnerOptions {
   /** No-progress bound for the Cursor harness stream (ms). @default 180000 */
   readonly cursorStreamStallTimeoutMs?: number;
 
+  /** Max wait for the per-workspace turn lock (ms). @default 900000 */
+  readonly workspaceLockTimeoutMs?: number;
+
   /** Checkpointer type for LangGraph agent state. @default "memory" (or "http" if proxyEndpoint is set) */
   readonly checkpointerType?: "memory" | "http";
 
@@ -274,6 +277,8 @@ export function mapOptionsToConfig(options: StigmerRunnerOptions): Config {
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,
+    workspaceLockTimeoutMs:
+      options.workspaceLockTimeoutMs ?? DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS,
   };
 }
 

package/src/shared/__tests__/artifact-storage.test.ts

@@ -1,14 +1,16 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { mkdtemp, rm, readFile } from "node:fs/promises";
+import { mkdtemp, rm, readFile, readdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import {
   LocalArtifactStorage,
   ProxyArtifactStorage,
   createArtifactStorage,
+  resolveUsableArtifactStorage,
   loadArtifactStorageConfig,
   type ArtifactStorageConfig,
 } from "../artifact-storage.js";
+import { deriveCaptureMode } from "../filereview/capture.js";
 
 // ── LocalArtifactStorage ─────────────────────────────────────────────
 
@@ -428,6 +430,7 @@ describe("loadArtifactStorageConfig", () => {
     checkpointerProxyEndpoint: null,
     primaryModel: "gpt-4.1",
     cursorStreamStallTimeoutMs: 180000,
+    workspaceLockTimeoutMs: 900000,
   };
 
   afterEach(() => {
@@ -476,3 +479,110 @@ describe("loadArtifactStorageConfig", () => {
     expect(cfg.type).toBe("proxy");
   });
 });
+
+// ── resolveUsableArtifactStorage (DD-26 follow-up #1) ─────────────────
+//
+// The shared construct-or-degrade seam: it must return `undefined` (never throw)
+// for every "no working substrate" condition so both harnesses fall to the
+// deny-gate up front, instead of flowing file writes then crashing at the
+// turn-boundary upload.
+
+describe("resolveUsableArtifactStorage", () => {
+  const ctx = { executionId: "exec-test" };
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(join(tmpdir(), "resolve-artifact-test-"));
+  });
+
+  afterEach(async () => {
+    await rm(tempDir, { recursive: true, force: true });
+    vi.restoreAllMocks();
+  });
+
+  const localCfg = (localPath: string): ArtifactStorageConfig => ({
+    type: "local",
+    localPath,
+    localServeUrl: "http://localhost:7235",
+    proxyEndpoint: null,
+    proxyAuthToken: null,
+  });
+
+  it("returns a LocalArtifactStorage for a writable path and leaves no residue", async () => {
+    const base = join(tempDir, "artifacts");
+    const storage = await resolveUsableArtifactStorage(localCfg(base), ctx);
+
+    expect(storage).toBeInstanceOf(LocalArtifactStorage);
+    // The write-probe file must be cleaned up; the base dir may be created.
+    const entries = await readdir(base);
+    expect(entries).toEqual([]);
+  });
+
+  it("returns undefined for an unwritable local path (mkdir ENOTDIR)", async () => {
+    // Deterministic, cross-platform: point localPath at a child of a regular
+    // FILE, so the resolver's recursive mkdir fails with ENOTDIR.
+    const filePath = join(tempDir, "not-a-dir");
+    await writeFile(filePath, "");
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+
+    const storage = await resolveUsableArtifactStorage(
+      localCfg(join(filePath, "sub")),
+      ctx,
+    );
+
+    expect(storage).toBeUndefined();
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining("local path not writable"),
+    );
+  });
+
+  it("returns undefined when proxy config is a misconfig (construct throws)", async () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+    const cfg: ArtifactStorageConfig = {
+      type: "proxy",
+      localPath: "/tmp/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: "https://proxy.example.com",
+      proxyAuthToken: null, // missing token
+    };
+
+    const storage = await resolveUsableArtifactStorage(cfg, ctx);
+
+    expect(storage).toBeUndefined();
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("unavailable"));
+  });
+
+  it("returns a ProxyArtifactStorage for a valid proxy config without any network call", async () => {
+    // Proxy is never probed at the network layer — assert no fetch happens.
+    const fetchSpy = vi.spyOn(globalThis, "fetch");
+    const cfg: ArtifactStorageConfig = {
+      type: "proxy",
+      localPath: "/tmp/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: "https://proxy.example.com",
+      proxyAuthToken: "token-123",
+    };
+
+    const storage = await resolveUsableArtifactStorage(cfg, ctx);
+
+    expect(storage).toBeInstanceOf(ProxyArtifactStorage);
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("wires through to deriveCaptureMode: an unwritable local store degrades a non-git turn to the deny-gate", async () => {
+    const filePath = join(tempDir, "not-a-dir");
+    await writeFile(filePath, "");
+    vi.spyOn(console, "warn").mockImplementation(() => undefined);
+
+    const storage = await resolveUsableArtifactStorage(
+      localCfg(join(filePath, "sub")),
+      ctx,
+    );
+
+    // Non-git workspace + no usable storage => no capture substrate => deny-gate.
+    expect(deriveCaptureMode("/some/workspace", false, !!storage)).toBe(false);
+    // A git workspace still captures (git substrate needs no storage), but its
+    // gitignored->CAS edits and offload are off because the store is absent.
+    expect(deriveCaptureMode("/some/workspace", true, !!storage)).toBe(true);
+  });
+});

package/src/shared/__tests__/implement-plan-prompt.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect } from "vitest";
+import {
+  buildImplementPlanDirective,
+  findApprovedPlanPath,
+} from "../implement-plan-prompt.js";
+
+describe("findApprovedPlanPath", () => {
+  it("finds the plan by the legacy filename among attachment paths", () => {
+    expect(
+      findApprovedPlanPath([
+        ".stigmer/inputs/data.csv",
+        ".stigmer/inputs/plan.md",
+      ]),
+    ).toBe(".stigmer/inputs/plan.md");
+  });
+
+  it("finds a title-named <slug>_<id>.plan.md plan", () => {
+    expect(
+      findApprovedPlanPath([
+        ".stigmer/inputs/data.csv",
+        ".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md",
+      ]),
+    ).toBe(".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md");
+  });
+
+  it("returns undefined when no plan attachment resolved", () => {
+    expect(findApprovedPlanPath([".stigmer/inputs/data.csv"])).toBeUndefined();
+    expect(findApprovedPlanPath([])).toBeUndefined();
+  });
+
+  it("matches the plan convention only — a plan-adjacent filename is not the plan", () => {
+    expect(
+      findApprovedPlanPath([".stigmer/inputs/my-plan.md.bak"]),
+    ).toBeUndefined();
+    // A file merely containing "plan" is not a plan artifact.
+    expect(
+      findApprovedPlanPath([".stigmer/inputs/myplan.md"]),
+    ).toBeUndefined();
+  });
+});
+
+describe("buildImplementPlanDirective", () => {
+  it("points the model at the attached plan and names it authoritative", () => {
+    const directive = buildImplementPlanDirective(".stigmer/inputs/plan.md");
+
+    expect(directive).toContain("APPROVED");
+    expect(directive).toContain("`.stigmer/inputs/plan.md`");
+    expect(directive).toContain("Read it FIRST");
+    // The user may have edited the document after the plan turn — the file,
+    // not the conversation, is the approved text.
+    expect(directive).toContain("authoritative");
+  });
+
+  it("falls back to the conversation's plan when nothing is attached", () => {
+    const directive = buildImplementPlanDirective(undefined);
+
+    expect(directive).toContain("APPROVED");
+    expect(directive).toContain("conversation above");
+    expect(directive).not.toContain("plan.md");
+  });
+
+  // Tier 3 (plan-driven build progress): both variants instruct the agent to
+  // derive its to-do list from the plan and keep it current — the agent's todo
+  // tool is the single writer of status.todos, so this instruction is the
+  // entire plan→progress linkage.
+  it("instructs plan-derived progress tracking in the attached variant", () => {
+    const directive = buildImplementPlanDirective(".stigmer/inputs/plan.md");
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+  });
+
+  it("instructs plan-derived progress tracking in the conversation-only variant", () => {
+    const directive = buildImplementPlanDirective(undefined);
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+    // The progress block must never name the file — this variant exists
+    // because no plan file materialized.
+    expect(directive).not.toContain("plan.md");
+  });
+});