@stigmer/runner 3.1.1 → 3.1.3

package/dist/activities/execute-cursor/index.js

@@ -35,11 +35,11 @@ import { StigmerClient } from "../../client/stigmer-client.js";
 import { resolveAgent } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
-import { MessageAccumulator, reconcileDeniedToolCalls, clearProvisionalPostDenialNarration, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
+import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+import { withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { startStallWatchdog, StallTimeoutError, formatStallFailure } from "../../shared/stall-watchdog.js";
-import { createArtifactStorage, loadArtifactStorageConfig } from "../../shared/artifact-storage.js";
+import { resolveUsableArtifactStorage, loadArtifactStorageConfig } from "../../shared/artifact-storage.js";
 import { publishPlanArtifact } from "../../shared/plan-artifact.js";
 import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
@@ -53,17 +53,20 @@ import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
 import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
-import { resolveSkills, removeStigmerSymlink } from "./skill-resolver.js";
+import { resolveSkills } from "./skill-resolver.js";
+import { removeStigmerSymlink } from "./stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildReinvocationPrompt, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
+import { acquireWorkspaceLock, WorkspaceLockCancelledError, WorkspaceLockTimeoutError, } from "../../shared/workspace/workspace-lock.js";
 import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
-import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, primaryToken, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
-import { deriveTurnCommandProvenance } from "./command-provenance.js";
+import { buildApprovalState, buildApprovalGrants, emitCursorGrantReceipts, readDenialLedger, reconstructAdjudicatedApprovals, watchDenialLedger } from "./approval-state.js";
 import { applyApprovedWholeFileWrites, excludeAppliedFromGrants } from "./exact-apply.js";
 import { isGitWorkTree } from "../../shared/filereview/git-substrate.js";
-import { captureBaselineToLedger, captureTurnToLedger, applyCaptureDecisions, deriveCaptureMode, } from "./capture-flow.js";
+import { captureBaselineToLedger, captureProgressToStatus, applyCaptureDecisions, deriveCaptureMode, } from "./capture-flow.js";
+import { runTurnBoundary } from "./turn-boundary.js";
+import { newProgressCaptureState, } from "../../shared/filereview/progress.js";
 import { deriveExecutionFingerprintKey } from "../../shared/approval-fingerprint.js";
 import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
 import { provisionCursorWorkspace } from "./workspace-provision.js";
@@ -80,11 +83,6 @@ import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
 import { getShutdownSignalForQueue } from "../../runner-manager.js";
-// How long Phase 12 waits for the first-denial-stop's run.cancel() to settle
-// before reading the final denial ledger and capturing the turn's tree. Long
-// enough for the SDK's normal teardown, short enough that a wedged cancel
-// cannot noticeably delay the approval pause the user is already waiting on.
-const FIRST_DENIAL_CANCEL_TIMEOUT_MS = 5_000;
 /**
  * Creates the activity functions bound to the runner config.
  * Returned object is passed to Temporal Worker.create({ activities }).
@@ -131,25 +129,30 @@ turnSeq) {
     });
     // Artifact storage for offloading oversized tool outputs (screenshots, giant
     // dumps) out of the persisted status, and for publishing the plan artifact.
-    // Created once here so it is available to EVERY persist below. Best-effort:
-    // if it can't be built (e.g. proxy mode without a token), offload is disabled
-    // but persistStatus still enforces the aggregate size cap, so persistence can
-    // never silently blow past the gRPC limit.
-    let artifactStorage;
-    try {
-        artifactStorage = createArtifactStorage(loadArtifactStorageConfig(config));
-    }
-    catch (storageErr) {
-        console.warn(`ExecuteCursor artifact storage unavailable — tool-output offload disabled ` +
-            `(aggregate size guard still active): execution=${executionId}, error=${storageErr}`);
-    }
+    // Resolved once here so it is available to EVERY persist below. Best-effort via
+    // the shared resolver (identical to the deep-agent harness): `undefined` — never
+    // a throw — when there is no working substrate (proxy misconfig OR an unwritable
+    // local path). An absent store disables offload (persistStatus still enforces
+    // the aggregate size cap) and flips capture mode off (deny-gate fallback).
+    const artifactStorage = await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
     const statusOffload = artifactStorage
         ? { artifactStorage, executionId }
         : undefined;
     // ALL status persistence in this activity flows through `persist`, so the
     // single size-bounding guard (offload + aggregate elision) is unforgeable and
     // a future call site cannot accidentally skip it.
-    const persist = (s = status) => persistStatus(client, executionId, s, { offload: statusOffload });
+    const persist = (s = status) => {
+        // Never-persist-secret backstop (DD-26 #2): before EVERY persist, withhold
+        // content from any built-in write row targeting a secret-like path (top-level
+        // + sub-agent). This is the single airtight choke point for the Cursor harness
+        // — the deny-gate analog of capture mode's stamping scrub, and the only
+        // guarantee under auto_approve_all (where the hook installs no gate). Safe on
+        // every call: Cursor sets tool args atomically from the SDK tool_call event
+        // (buildToolCallProto), so there is no mid-stream partial-args hazard, and the
+        // pass only ever touches secret-like write rows (idempotent, else a no-op).
+        withholdSecretContentFromMessages(s.messages, s.subAgentExecutions);
+        return persistStatus(client, executionId, s, { offload: statusOffload });
+    };
     let sessionId;
     let session;
     let pauseDetected = false;
@@ -195,6 +198,14 @@ turnSeq) {
     // (issue #173). Runs in the finally, covering every success/error/approval
     // exit path. Undefined until the gate is installed.
     let hitlCleanup;
+    // Exclusive turn lock on the primary workspace working tree. Held across the
+    // ENTIRE tree-mutating window (decision reconcile, HITL gate install, the
+    // agent's own writes, candidate capture) so a concurrent execution sharing
+    // this directory can never write between this turn's baseline and candidate
+    // snapshots — the misattribution that showed another session's file as this
+    // turn's change. Released in the finally AFTER hitlCleanup (which still
+    // mutates the tree). See shared/workspace/workspace-lock.ts.
+    let releaseWorkspaceLock;
     // Carries model/mode/agentId out to the outer catch so a thrown CursorSdkError
     // can be classified with the same context as the run.wait() error path.
     let errorContext = { model: "default", mode: "local", agentId: "" };
@@ -239,6 +250,9 @@ turnSeq) {
         // Pre-turn baseline tree, pinned before the agent runs (capture mode only)
         // so the turn-end capture diffs against it and the tree restores exactly.
         let baselineTree;
+        // Per-turn state for mid-run live capture (DD-32): the last progress tree sha
+        // (short-circuit) + last capture time (floor), threaded across persists.
+        const progressState = newProgressCaptureState();
         // Deterministic id of the change set this turn may produce:
         // `${executionId}:${turnSeq}`. Minted from the workflow-threaded turn index
         // so it is stable across a Temporal retry (idempotent ledger authoring) and
@@ -247,6 +261,44 @@ turnSeq) {
         // resume (which never authors a baseline) is harmless.
         const changeSetId = `${executionId}:${turnSeq}`;
         heartbeat();
+        // Serialize this turn against every other execution sharing this working
+        // tree — sessions declaring the same localPath (or the shared runner root)
+        // resolve to ONE directory, and an unserialized concurrent write lands
+        // inside this turn's baseline→candidate window, misattributing another
+        // session's file to this turn's review. Acquired before ANY tree mutation
+        // below (decision reconcile, gate install, agent writes, capture). While
+        // another turn holds the lock this surfaces a visible waiting state and
+        // heartbeats; a cancel aborts the wait immediately.
+        if (primaryWorkspaceDir) {
+            try {
+                releaseWorkspaceLock = await acquireWorkspaceLock(primaryWorkspaceDir, {
+                    onWaiting: () => reportSetupProgress(client, executionId, "Waiting for workspace — in use by another session"),
+                    heartbeat,
+                    signal: Context.current().cancellationSignal,
+                    timeoutMs: config.workspaceLockTimeoutMs,
+                });
+            }
+            catch (lockErr) {
+                if (lockErr instanceof WorkspaceLockCancelledError) {
+                    throw new CancelledFailure("Activity cancelled while waiting for the workspace lock");
+                }
+                if (lockErr instanceof WorkspaceLockTimeoutError) {
+                    status.phase = ExecutionPhase.EXECUTION_FAILED;
+                    status.error = lockErr.message;
+                    status.completedAt = utcTimestamp();
+                    status.messages.push(create(AgentMessageSchema, {
+                        type: MessageType.MESSAGE_SYSTEM,
+                        content: `Execution failed: ${lockErr.message}`,
+                        timestamp: utcTimestamp(),
+                    }));
+                    await persist(status);
+                    console.warn(`ExecuteCursor workspace lock timeout: execution=${executionId}`);
+                    return slimStatus(status);
+                }
+                throw lockErr;
+            }
+        }
+        heartbeat();
         // Set OTel baggage so downstream calls carry execution context.
         try {
             const { setBaggage, BAGGAGE_EXECUTION_ID, BAGGAGE_SESSION_ID, BAGGAGE_ORG_ID } = await import("../../otel.js");
@@ -430,8 +482,15 @@ turnSeq) {
             primaryWorkspaceDir,
         });
         heartbeat();
-        // Phase 5b: Resolve attachments
-        const attachmentResults = await resolveAttachments(spec.attachments, sessionId, primaryWorkspaceDir, config.mode);
+        // Phase 5b: Resolve attachments (fail-hard — explicit user inputs; see
+        // attachment-resolver.ts). Downloads by storage key through the same
+        // artifactStorage resolved for status offload above.
+        const attachmentResults = await resolveAttachments(spec.attachments, {
+            sessionId,
+            primaryWorkspaceDir,
+            mode: config.mode,
+            storage: artifactStorage,
+        });
         const attachmentPaths = attachmentResults.map((a) => a.relativePath);
         // Phase 5b3: Exact-apply approved whole-file writes (HITL "what you approve
         // is what gets applied"). The Cursor deny-only harness reinvokes the model,
@@ -611,6 +670,7 @@ turnSeq) {
         // Phase 10: Build the prompt
         const interactionMode = spec.executionConfig?.interactionMode
             ?? InteractionMode.UNSPECIFIED;
+        const buildFromPlan = spec.executionConfig?.buildFromPlan ?? false;
         const prompt = buildPrompt({
             resolution,
             approvalDecisions,
@@ -624,6 +684,7 @@ turnSeq) {
             pendingApprovals: adjudicatedApprovals,
             appliedToolCallIds,
             interactionMode,
+            buildFromPlan,
         });
         // Phase 10a: Inject structured output instruction for Cursor harness
         let effectivePrompt = prompt;
@@ -831,6 +892,22 @@ turnSeq) {
                     // accumulator tracked sub-agents in memory but they only reached the
                     // status (and the subscriber stream) after the loop ended.
                     status.subAgentExecutions = accumulator.subAgentExecutions;
+                    // Mid-run live capture (DD-32): attach the "N files changed so far"
+                    // snapshot onto status.file_change_progress, throttled internally by the
+                    // floor + tree-sha short-circuit. Git capture mode only (a pinned baseline
+                    // exists); shell + sub-agent + tool edits are all captured for free by the
+                    // workspace-wide diff. Never authoritative — the turn-boundary candidate
+                    // remains the reviewed diff.
+                    if (captureMode && gitWorkspace && baselineTree && primaryWorkspaceDir) {
+                        await captureProgressToStatus({
+                            status,
+                            gitRoot: primaryWorkspaceDir,
+                            executionId,
+                            changeSetId,
+                            baselineTree,
+                            state: progressState,
+                        });
+                    }
                     const signal = await persist(status);
                     deltaEnricher.markPersisted();
                     todoTracker.markPersisted();
@@ -998,134 +1075,80 @@ turnSeq) {
             console.log(`ExecuteCursor completed (platform stop): execution=${executionId}`);
             return slimStatus(status);
         }
-        // Phase 12: Surface tools the preToolUse hook gated (HITL).
-        //
-        // The hook records each denial to the ledger; we mark the corresponding tool
-        // calls WAITING_APPROVAL. The backend projects pending_approvals from that
-        // tool-call status (PendingApprovalComputer), so — exactly like the native
-        // harness — the approval surface is driven entirely by tool-call status. We
-        // deliberately do NOT set status.pendingApprovals here: any value would be
-        // discarded by the backend's recompute on the next updateStatus.
-        //
-        // Before reading the ledger, wait (timeboxed) for the first-denial-stop's
-        // run.cancel() to settle. run.cancel() races the SDK's auto-execution: until
-        // it lands, the agent process may still attempt a post-denial workaround
-        // whose hook denial would land AFTER a premature ledger read — the row then
-        // never collapses and renders as RUNNING forever (production case
-        // aex_01kwj07f7g23c3wp9sn8496z5g) — or a late tool could mutate the tree
-        // mid-capture. The timebox keeps a wedged cancel from hanging the pause;
-        // the Phase 12 trims below remain the backstop for that degraded case.
-        if (firstDenialDetected && denialCancelSettled) {
-            await Promise.race([
-                denialCancelSettled,
-                new Promise((resolve) => {
-                    const timer = setTimeout(resolve, FIRST_DENIAL_CANCEL_TIMEOUT_MS);
-                    timer.unref();
-                }),
-            ]);
-        }
-        const deniedLedger = await readDenialLedger(hitlDir ?? "");
-        // Capture mode: author the net change set to the file_review ledger as the
-        // CANDIDATE_CAPTURED event (projected server-side to a file_change_set
-        // AWAITING_REVIEW — the single review surface). The runner-owned gate files
-        // are excluded from the capture. The agent's edits are LEFT applied on the
-        // working tree (Cursor parity — the user reviews the real change; nothing is
-        // committed and the next turn is blocked until approval, and a reject snaps
-        // each file back on resume). Runs BEFORE the denial reconcile so a denied
-        // (gitignored) write stays on the deny-gate path while every flowed edit is
-        // captured to the ledger.
-        let capturedChangeCount = 0;
-        // `baselineTree !== undefined` means a baseline was authored this turn — the
-        // git tree sha for a git workspace, or "" (empty, but authored) for a non-git
-        // one. A plain truthiness check would wrongly skip the non-git capture.
-        if (captureMode && baselineTree !== undefined && primaryWorkspaceDir) {
-            const deniedTokens = new Set(deniedLedger.map((e) => e.token));
-            // Approved-command turn facts (DD-28): when every mutation-capable call
-            // this turn was a consented shell command, attach the provenance so the
-            // backend can verify the cited consent rows and auto-keep the set instead
-            // of arming a second gate. Fail-closed: any non-qualifying turn attaches
-            // nothing and reviews manually exactly as before.
-            const commandProvenance = deriveTurnCommandProvenance({
-                messages: status.messages,
-                turnStartIndex: turnStartMessageIndex,
-                deniedTokens,
-                grantTokenToConsentId: new Map((approvalGrants ?? []).map((g) => [
-                    primaryToken(g.key, g.salient, g.contentDigest),
-                    g.sourceToolCallId,
-                ])),
-                globalBypass,
-            });
-            if (commandProvenance) {
-                console.log(`ExecuteCursor capture: turn qualifies for approved-command auto-keep ` +
-                    `(consent rows: ${commandProvenance.consentToolCallIds.join(",") || "(auto_approve_all)"}); ` +
-                    `attaching provenance to candidate (execution=${executionId})`);
-            }
-            const captured = await captureTurnToLedger({
-                status,
-                gitRoot: primaryWorkspaceDir,
-                executionId,
-                changeSetId,
-                baselineTree,
-                messages: status.messages,
-                deniedTokens,
-                commandProvenance,
-                // Scope sub-agent row stamping to this turn: the seeded prior sub-agents
-                // (cloned in on resume) are the "before this turn" rows to skip.
-                priorSubAgentToolCallIds: collectSubAgentToolCallIds(seededSubAgents),
-                // The CAS half: read the sidecar the hook staged this turn and compose it
-                // into the change set. hitlDir + storage are present when captureIgnored
-                // was on (a git tree's gitignored writes, or ALL writes in a non-git
-                // workspace). In a git tree this composes with the git diff (HYBRID); in a
-                // non-git workspace it IS the whole change set (CAS-only).
-                hitlDir,
-                storage: artifactStorage,
-                gitWorkspace,
-            });
-            capturedChangeCount = captured.length;
-            if (capturedChangeCount > 0) {
-                console.log(`ExecuteCursor capture: ${capturedChangeCount} file change(s) authored to the ` +
-                    `file_review ledger (change_set=${changeSetId}), working tree left applied ` +
-                    `for review (execution=${executionId})`);
-            }
-        }
-        // The gate reads each denied file's pre-edit `before` from the workspace the
-        // runner is co-located with (local FS for OSS; the sandbox in cloud), so a
-        // whole-file rewrite gate renders a true before/after diff. The tool was
-        // DENIED, so disk still holds the old content. User files are never platform
-        // paths, so no platformDir routing is needed here.
-        const gateWorkspaceBackend = new LocalWorkspaceBackend(primaryWorkspaceDir);
-        const deniedToolCalls = await reconcileDeniedToolCalls(status.messages, deniedLedger, mergedPolicies, gateWorkspaceBackend);
-        // Observability: a synthesized placeholder (id `approval:*`) means a denial
-        // correlated to NO streamed tool call in either the exact or the normalized
-        // pass. After the normalized-path fallback this should be ~0; a non-zero rate
-        // is the early-warning signal of a NEW identity drift (the gate would then
-        // show "No preview available" with no diff). Logged, not thrown — the
-        // synthesized gate still safely surfaces the approval.
-        const synthesizedGateCount = deniedToolCalls.filter((tc) => tc.id.startsWith("approval:")).length;
-        if (synthesizedGateCount > 0) {
-            console.warn(`ExecuteCursor reconcile synthesized ${synthesizedGateCount} placeholder gate(s) ` +
-                `with no correlated stream call (execution=${executionId}); ` +
-                `possible hook/stream identity drift — gate(s) will lack a diff`);
-        }
-        if (deniedToolCalls.length > 0 || capturedChangeCount > 0) {
-            if (deniedToolCalls.length > 0) {
-                // Deterministic clean-pause: a turn that pauses for approval must read as
-                // the same shape the native harness produces — pre-tool text + the gated
-                // tool calls — never the model's provisional reaction to Cursor's deny
-                // (e.g. "blocked by a hook; enable it in your Cursor settings"). We blank
-                // that reaction in place (keeping the message count, so the finalize stays
-                // append-only) rather than removing it. See
-                // clearProvisionalPostDenialNarration for the full rationale.
-                const redactedNarration = clearProvisionalPostDenialNarration(status.messages, deniedToolCalls);
-                if (redactedNarration.length > 0) {
-                    console.log(`ExecuteCursor redacted ${redactedNarration.length} provisional post-denial narration message(s) before pausing for approval`);
-                }
-            }
+        // Phase 12: The turn boundary — author this turn's change set to the
+        // file_review ledger (CANDIDATE_CAPTURED) and overlay the hook's denials as
+        // WAITING_APPROVAL gate rows. The full pipeline and its ordering rationale
+        // live in turn-boundary.ts; this closure binds the turn's state so the
+        // recovery retries below (which re-run the agent AFTER this primary call)
+        // can re-enter the IDENTICAL pipeline — a retry's edits must reach the
+        // ledger or they silently escape review. `baselineTree` is read at call
+        // time, so both entries see the baseline authored at turn start.
+        const runBoundary = (denialSettled) => runTurnBoundary({
+            status,
+            executionId,
+            changeSetId,
+            hitlDir,
+            captureMode,
+            baselineTree,
+            primaryWorkspaceDir,
+            gitWorkspace,
+            turnStartMessageIndex,
+            approvalGrants,
+            globalBypass,
+            seededSubAgents,
+            artifactStorage,
+            mergedPolicies,
+            denialCancelSettled: denialSettled,
+        });
+        // Pauses for review exactly like the native harness: the boundary mutated
+        // the transcript in place; we flip the phase, persist, and RETURN to the
+        // workflow, which waits for the approval/file-review signal and reinvokes.
+        const enterApprovalPause = async (boundary) => {
             status.phase = ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL;
             await persist(status);
-            console.log(`ExecuteCursor returning WAITING_FOR_APPROVAL: ${deniedToolCalls.length} gated tool(s), ` +
-                `${capturedChangeCount} file card(s) pending`);
+            console.log(`ExecuteCursor returning WAITING_FOR_APPROVAL: ${boundary.deniedToolCallCount} gated tool(s), ` +
+                `${boundary.capturedChangeCount} file card(s) pending`);
             return slimStatus(status);
+        };
+        // Stream epilogue + boundary re-entry for a recovery retry (poisoned-handle /
+        // transport-timeout). The retry re-runs the agent AFTER the primary epilogue
+        // and boundary already ran, so its stream state must be settled the same way:
+        //  - flush the enricher's buffered deltas onto the rows (the primary loop
+        //    applies them every iteration; the bare retry loop does not — without the
+        //    flush, a completed tool call never receives its completedAt evidence and
+        //    finalize's reconciliation sweep leaves it RUNNING forever);
+        //  - finalize streaming state and sync sub-agents;
+        //  - refresh streaming usage (the retry's turns accumulated in memory only)
+        //    and re-stamp completedAt (stamped below BEFORE the retry ran);
+        //  - re-enter the turn boundary so edits made by the retry reach the
+        //    file_review ledger / approval gates — without this, a retry's file
+        //    edits silently escape review (production case
+        //    aex_01kws27q1e2esvkqjpvectttxf).
+        // Returns undefined for a cancelled retry: parity with the primary path,
+        // where cancellation exits before the boundary — there is no review to open.
+        const settleRetryTurn = async (retryResultStatus) => {
+            accumulator.finalize();
+            deltaEnricher.applyEnrichments(status.messages);
+            deltaEnricher.finalize(status.messages);
+            status.subAgentExecutions = accumulator.subAgentExecutions;
+            if (usageAccumulator.hasTurns) {
+                status.streamingUsage = create(StreamingUsageSummarySchema, usageAccumulator.snapshot());
+            }
+            // Re-flush the (dev-only) event recorder: flush rewrites the full JSONL,
+            // so the recorded trace now includes the retry's events too.
+            await eventRecorder?.flush();
+            const retryBoundary = retryResultStatus === "cancelled" ? undefined : await runBoundary();
+            // Phase 13 stamped completedAt BEFORE the retry ran. A terminal outcome
+            // re-stamps it to the true end; a review pause CLEARS it — the primary
+            // pause path never stamps it (a waiting turn is not complete).
+            status.completedAt = retryBoundary?.waiting ? "" : utcTimestamp();
+            return retryBoundary;
+        };
+        // The denial-settle wait applies only when a first denial stopped THIS run;
+        // the recovery retries have no early stop and pass no promise.
+        const boundary = await runBoundary(firstDenialDetected ? denialCancelSettled : undefined);
+        if (boundary.waiting) {
+            return enterApprovalPause(boundary);
         }
         // Phase 13: Map final result
         const result = await run.wait();
@@ -1239,7 +1262,9 @@ turnSeq) {
                             if (Context.current().cancellationSignal.aborted)
                                 break;
                             retryWatchdog.recordActivity();
+                            eventRecorder?.record(retryEvent, eventCount);
                             accumulator.processEvent(retryEvent);
+                            eventCount++;
                             if (retryEvent.type === "status") {
                                 const retryStatusEvent = retryEvent;
                                 if (retryStatusEvent.status === "ERROR" && retryStatusEvent.message) {
@@ -1255,6 +1280,15 @@ turnSeq) {
                     const retryResult = await retryRun.wait();
                     console.log(`ExecuteCursor retry run.wait(): execution=${executionId}, ` +
                         `retryResult=${JSON.stringify(retryResult)}`);
+                    const retryBoundary = await settleRetryTurn(retryResult.status);
+                    if (retryBoundary?.waiting) {
+                        // The retry's edits/denials armed the gate — pause for review. On a
+                        // retry error this supersedes the failure, exactly as on the primary
+                        // path (a captured change pauses the turn before run.wait() is
+                        // consulted).
+                        console.log(`ExecuteCursor poisoned-handle recovery paused for review: execution=${executionId}`);
+                        return enterApprovalPause(retryBoundary);
+                    }
                     if (retryResult.status === "finished") {
                         status.phase = ExecutionPhase.EXECUTION_COMPLETED;
                         console.log(`ExecuteCursor poisoned-handle recovery SUCCEEDED: execution=${executionId}`);
@@ -1336,7 +1370,9 @@ turnSeq) {
                             if (Context.current().cancellationSignal.aborted)
                                 break;
                             retryWatchdog.recordActivity();
+                            eventRecorder?.record(retryEvent, eventCount);
                             accumulator.processEvent(retryEvent);
+                            eventCount++;
                             if (retryEvent.type === "status") {
                                 const retryStatusEvent = retryEvent;
                                 if (retryStatusEvent.status === "ERROR" && retryStatusEvent.message) {
@@ -1350,6 +1386,14 @@ turnSeq) {
                         retryWatchdog.stop();
                     }
                     const retryResult = await retryRun.wait();
+                    const retryBoundary = await settleRetryTurn(retryResult.status);
+                    if (retryBoundary?.waiting) {
+                        // The retry's edits/denials armed the gate — pause for review (see
+                        // the poisoned-handle branch above for the precedence rationale).
+                        console.log(`ExecuteCursor transport-timeout recovery paused for review: execution=${executionId}`);
+                        resolution = { ...resolution, agent: freshAgent, agentId: freshAgent.agentId, isNew: true };
+                        return enterApprovalPause(retryBoundary);
+                    }
                     if (retryResult.status === "finished") {
                         status.phase = ExecutionPhase.EXECUTION_COMPLETED;
                         resolution = { ...resolution, agent: freshAgent, agentId: freshAgent.agentId, isNew: true };
@@ -1409,10 +1453,10 @@ turnSeq) {
             if (structuredOutput !== undefined) {
                 status.structuredOutput = structuredOutput;
             }
-            // Plan mode: publish the final plan message as a plan.md artifact. The
-            // Cursor harness has no auto-publish pipeline, so this is the only
-            // artifact path; build storage from the same config-driven factory the
-            // native harness uses.
+            // Plan mode: publish the final plan message as a plan artifact (named
+            // from the plan's title). The Cursor harness has no auto-publish
+            // pipeline, so this is the only artifact path; build storage from the
+            // same config-driven factory the native harness uses.
             if (interactionMode === InteractionMode.PLAN && finalText && artifactStorage) {
                 try {
                     await publishPlanArtifact({ status, executionId, planText: finalText, artifactStorage });
@@ -1613,6 +1657,12 @@ turnSeq) {
                     `execution=${executionId}, error=${cleanupErr instanceof Error ? cleanupErr.message : cleanupErr}`);
             }
         }
+        // Release the workspace turn lock LAST — hitlCleanup above still mutates
+        // the tree (restores .cursor/hooks.json), and the next queued turn must
+        // not baseline until every mutation of this one has landed. Idempotent
+        // and non-throwing (see workspace-lock.ts), so it can never mask the
+        // turn's real outcome.
+        await releaseWorkspaceLock?.();
     }
 }
 /**
@@ -1702,7 +1752,7 @@ import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
  *    agent after resume failure   skills; no prior conversation to inherit)
  */
 export function buildPrompt(input) {
-    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachmentPaths, interactionMode, } = input;
+    const { resolution, approvalDecisions, instructions, userMessage, skills, subAgents, workspaceDirs, workspaceFileRefs, attachmentPaths, interactionMode, buildFromPlan, } = input;
     const isHitlReinvocation = approvalDecisions !== undefined && approvalDecisions.size > 0;
     // HITL reinvocation: the agent is resumed, so its native context carries the
     // prior conversation; the reinvocation prompt conveys the approval decisions
@@ -1711,9 +1761,20 @@ export function buildPrompt(input) {
         return buildReinvocationPrompt(input.pendingApprovals, approvalDecisions, input.appliedToolCallIds);
     }
     // A successfully resumed agent carries its own conversation context via the
-    // SDK's native store — send the raw user message with no preamble.
+    // SDK's native store — send the raw user message with no preamble. The
+    // exceptions are the per-EXECUTION directives, which never inherit from the
+    // session's first turn: the interaction-mode prefix (a follow-up can switch
+    // Agent→Plan mid-session, and for Cursor the prompt is the only plan-mode
+    // enforcement) and the implement-plan directive (the build turn is usually
+    // a follow-up on a resumed agent).
     if (resolution.reason === "resumed_successfully") {
-        return userMessage;
+        const prefixes = [
+            formatInteractionModePrefix(interactionMode),
+            formatImplementPlanSection(buildFromPlan, attachmentPaths),
+        ].filter((p) => p !== undefined);
+        return prefixes.length > 0
+            ? [...prefixes, userMessage].join("\n\n")
+            : userMessage;
     }
     // First execution, or a fresh agent created after a resume failure: there is
     // no prior conversation to inherit, so start a new turn with full context.
@@ -1726,6 +1787,7 @@ export function buildPrompt(input) {
         workspaceFileRefs,
         attachmentPaths,
         interactionMode,
+        buildFromPlan,
     });
 }
 // ---------------------------------------------------------------------------