@stigmer/runner 3.11.0 → 3.11.1-dev.20260812192248

package/src/activities/execute-cursor/prompt-builder.ts

@@ -36,6 +36,7 @@ import {
   visionDisclosureLines,
   type NotViewableEntry,
 } from "../../shared/attachment-vision.js";
+import { formatTurnRecoveryText } from "./turn-recovery.js";
 import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
 import {
   buildImplementPlanDirective,
@@ -338,6 +339,56 @@ export function buildReinvocationPrompt(
   return parts.join("\n\n");
 }
 
+/**
+ * Build the prompt for a fresh agent that replaced a lost one MID-HITL —
+ * the stored handle failed to resume when the approval landed, or the
+ * resumed handle proved poisoned mid-send (issue #366, both crossings).
+ *
+ * A resumed agent gets {@link buildReinvocationPrompt} alone because its
+ * native conversation carries everything else. A replacement agent's
+ * conversation is EMPTY, so the bare decisions prompt would strand it with
+ * instructions and no story — and, because recovery repoints the session at
+ * the new agent, every later turn would inherit that amnesia. This prompt
+ * rebuilds the whole story in chronological-narrative order:
+ *
+ * 1. the full enhanced prompt (blueprint, standing context, protocol, and
+ *    the turn's ORIGINAL user message as `<user_request>`),
+ * 2. `<turn_recovery>` — the state-loss disclosure plus the recorded
+ *    transcript of the turn so far (turn-recovery.ts; rendered even with no
+ *    transcript, since without the disclosure the decisions below would read
+ *    as reactions to proposals this agent never made),
+ * 3. the reinvocation decisions verbatim — already-applied / approved /
+ *    skipped semantics byte-identical to the resumed path, ending on its
+ *    "continue the task" directive.
+ *
+ * Appending past `<user_request>` is the chronology speaking (request →
+ * work done → decisions → continue), the same shape as the activity-level
+ * structured-output suffix.
+ */
+export function buildHitlRecoveryPrompt(
+  options: EnhancedPromptOptions,
+  recovery: {
+    turnDigest: string | undefined;
+    pendingApprovals: PendingApproval[];
+    approvalDecisions: Map<string, ApprovalAction>;
+    appliedToolCallIds?: ReadonlySet<string>;
+  },
+): string {
+  return [
+    buildEnhancedPrompt(options),
+    formatTurnRecoverySection(recovery.turnDigest),
+    buildReinvocationPrompt(
+      recovery.pendingApprovals,
+      recovery.approvalDecisions,
+      recovery.appliedToolCallIds,
+    ),
+  ].join("\n\n---\n\n");
+}
+
+export function formatTurnRecoverySection(digest: string | undefined): string {
+  return `<turn_recovery>\n${formatTurnRecoveryText(digest)}\n</turn_recovery>`;
+}
+
 /**
  * Render a pending approval as a short human-readable action description for the
  * reinvocation prompt. Prefers the already-resolved approval message; falls back

package/src/activities/execute-cursor/turn-recovery.ts

@@ -0,0 +1,208 @@
+/**
+ * Turn-recovery digest: the platform's recorded transcript of the current
+ * turn, rendered as prompt context for a fresh agent that replaced one whose
+ * conversation state was lost mid-turn (issue #366).
+ *
+ * A HITL-paused turn can lose its agent two ways — the stored handle fails
+ * to resume when the approval lands, or the resumed handle turns out to be
+ * poisoned mid-send. Either way the replacement agent starts with an EMPTY
+ * conversation, so the approval decisions alone read as instructions with no
+ * story: the agent no longer knows what it was doing. This module rebuilds
+ * that story from `status.messages` — the persisted execution transcript
+ * seeded on every re-invocation — which is the platform's durable record of
+ * the turn AND exactly what the user watched happen (introspecting the dead
+ * agent's own conversation is best-effort at most; the handle is the thing
+ * that failed).
+ *
+ * Doctrine (mirrors `ChannelRolloverBridgeComposer`, cloud DD-013 — the
+ * platform's reference for conversation digests):
+ * - Content here, presentation framing separate: {@link composeTurnRecoveryDigest}
+ *   emits bare `Assistant:` / `Tool:` / `System:` lines;
+ *   {@link formatTurnRecoveryText} adds the behavioral preamble; the prompt
+ *   builder wraps the section tag (the context-bridge / conversation-catchup
+ *   split).
+ * - Oldest-first reading order; over budget, the OLDEST lines drop first
+ *   (recency wins) and the drop is disclosed.
+ * - Best-effort by contract: composition never throws — a failed digest
+ *   degrades to recovery-without-transcript, never a failed recovery.
+ *
+ * Scope: the CURRENT turn only. Prior turns live in other execution records
+ * and are not recoverable runner-side (that is the rollover bridge's domain,
+ * composed cloud-side); the enhanced prompt's standing-context sections carry
+ * whatever the session already had.
+ */
+
+import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/** Per-line text budget; longer texts are cut with an ellipsis (DD-013 twin). */
+const MAX_LINE_CHARS = 400;
+
+/**
+ * Args-preview budget inside a tool line — the `describeApproval` precedent
+ * (prompt-builder.ts), so tool renderings are bounded the same way on both
+ * surfaces that describe them.
+ */
+const MAX_ARGS_CHARS = 200;
+
+/**
+ * Whole-digest budget (DD-013 twin). Enforced by dropping the OLDEST lines
+ * first — recency wins, matching how a human skims their own recent work
+ * before continuing it.
+ */
+const MAX_DIGEST_CHARS = 4000;
+
+const ELLIPSIS = "\u2026";
+
+/** Disclosed in place of the dropped prefix so the record never lies by omission. */
+const OMISSION_NOTICE = `[${ELLIPSIS} earlier activity in this turn omitted for length]`;
+
+/**
+ * How the transcript is introduced to the model. Establishes the three facts
+ * the replacement agent must hold: the work below is its OWN (continue, don't
+ * restart), completed actions are DONE (don't redo them), and the workspace —
+ * not this summary — is the source of truth for exact current state.
+ */
+const TURN_RECOVERY_PREAMBLE =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it. " +
+  "Below is the platform's recorded transcript of your progress in this " +
+  "turn, oldest first. Treat it as work YOU already did: do not start the " +
+  "task over, do not redo actions shown as completed, and check the " +
+  "workspace's current state where exact details matter.";
+
+/**
+ * Fallback framing when the turn produced no renderable transcript (or
+ * composition failed): the state-loss disclosure still matters — without it,
+ * the appended approval decisions read as reactions to proposals this agent
+ * never made.
+ */
+const TURN_RECOVERY_NO_TRANSCRIPT =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it " +
+  "and no transcript of your progress is available. Check the workspace's " +
+  "current state to see what you already did before continuing.";
+
+/**
+ * Render the turn's persisted transcript as bare digest lines, or undefined
+ * when there is nothing worth carrying. Never throws.
+ *
+ * Human messages are skipped — the turn's user message is already rendered
+ * in the enhanced prompt's `<user_request>`, and duplicating it here would
+ * dilute the budget. Thinking content is skipped as model-internal (the
+ * replacement agent forms its own). System notices are kept: platform
+ * messages like budget warnings or degradation notices are turn context the
+ * agent acted under.
+ */
+export function composeTurnRecoveryDigest(
+  messages: readonly AgentMessage[],
+): string | undefined {
+  try {
+    const lines: string[] = [];
+    for (const message of messages) {
+      lines.push(...messageLines(message));
+    }
+    if (lines.length === 0) return undefined;
+
+    // Oldest-first; drop from the FRONT when over budget so the newest work
+    // always survives, and disclose the drop (DD-013 enforcement shape). The
+    // notice participates in the budget so the result never overshoots.
+    let first = 0;
+    while (first < lines.length && totalLength(lines, first) > MAX_DIGEST_CHARS) {
+      first++;
+    }
+    if (first >= lines.length) {
+      // Degenerate case: even the newest line alone busts the budget (it is
+      // already line-truncated, so this would take a pathological budget/line
+      // ratio) — keep that one line rather than rendering nothing.
+      first = lines.length - 1;
+    }
+    const kept = lines.slice(first);
+    if (first > 0) kept.unshift(OMISSION_NOTICE);
+    return kept.join("\n");
+  } catch (err) {
+    console.warn("Turn-recovery digest composition failed — recovering without a transcript:", err);
+    return undefined;
+  }
+}
+
+/**
+ * The framed recovery body (preamble + digest), ready for section wrapping.
+ * Accepts an absent digest: the state-loss disclosure is load-bearing even
+ * when there is no transcript to show (see {@link TURN_RECOVERY_NO_TRANSCRIPT}).
+ */
+export function formatTurnRecoveryText(digest: string | undefined): string {
+  if (digest === undefined || digest.trim() === "") {
+    return TURN_RECOVERY_NO_TRANSCRIPT;
+  }
+  return `${TURN_RECOVERY_PREAMBLE}\n\n${digest.trim()}`;
+}
+
+/** The digest lines one transcript message contributes (possibly none). */
+function messageLines(message: AgentMessage): string[] {
+  const lines: string[] = [];
+  const text = message.content.trim();
+  switch (message.type) {
+    case MessageType.MESSAGE_AI:
+      if (text) lines.push(`Assistant: ${truncate(text, MAX_LINE_CHARS)}`);
+      // Tool calls ride AI messages (message.proto contract); render them
+      // even when the surrounding text is blank.
+      for (const toolCall of message.toolCalls) {
+        lines.push(toolCallLine(toolCall));
+      }
+      return lines;
+    case MessageType.MESSAGE_SYSTEM:
+      if (text) lines.push(`System: ${truncate(text, MAX_LINE_CHARS)}`);
+      return lines;
+    default:
+      // Human (already in <user_request>), thinking (model-internal), tool
+      // results (each ToolCall line already carries its outcome), unknown.
+      return lines;
+  }
+}
+
+/**
+ * One bounded line per tool call: what was attempted and how it ended.
+ * Prefers the resolved approval message where one exists — the same
+ * human-meaningful description the user approved against
+ * (the `describeApproval` convention).
+ */
+function toolCallLine(toolCall: ToolCall): string {
+  const action = toolCall.approvalMessage
+    ? toolCall.approvalMessage
+    : toolCall.argsPreview
+      ? `${toolCall.name}(${truncate(toolCall.argsPreview, MAX_ARGS_CHARS)})`
+      : toolCall.name;
+  return `Tool: ${truncate(action, MAX_LINE_CHARS)} — ${outcome(toolCall)}`;
+}
+
+function outcome(toolCall: ToolCall): string {
+  switch (toolCall.status) {
+    case ToolCallStatus.TOOL_CALL_COMPLETED:
+      return "completed";
+    case ToolCallStatus.TOOL_CALL_FAILED:
+      return toolCall.error
+        ? `failed: ${truncate(toolCall.error, MAX_ARGS_CHARS)}`
+        : "failed";
+    case ToolCallStatus.TOOL_CALL_WAITING_APPROVAL:
+      return "paused for user approval";
+    case ToolCallStatus.TOOL_CALL_SKIPPED:
+      return "skipped";
+    default:
+      // PENDING / RUNNING / unknown: in flight when the session was lost.
+      return "interrupted before it finished";
+  }
+}
+
+function truncate(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max)}${ELLIPSIS}`;
+}
+
+/** Joined length of lines[first..] plus the omission notice when one would render. */
+function totalLength(lines: readonly string[], first: number): number {
+  let total = first > 0 ? OMISSION_NOTICE.length + 1 : 0;
+  for (let i = first; i < lines.length; i++) {
+    total += lines[i].length + 1;
+  }
+  return total;
+}

package/src/activities/execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts

@@ -0,0 +1,174 @@
+/**
+ * End-to-end proof (real deepagents + LangGraph runtime, no LLM/network) that
+ * a plan-mode PARENT graph accepts workspace-relative paths (issue #429).
+ *
+ * Before the fix, deepagents' permission enforcement canonicalized every
+ * filesystem tool-call path BEFORE any rule ran and refused non-absolute
+ * shapes, so on a rule-bearing graph a workspace-relative call — reads
+ * included — died with `path must be absolute` instead of just working. The
+ * path-normalization middleware (middleware/path-normalization.ts) rewrites
+ * relative paths to workspace-absolute at our seam, before enforcement sees
+ * them.
+ *
+ * The graph here is composed exactly the way setup.ts composes the parent:
+ * the PRODUCTION buildMiddlewareStack (pathNormalization present, the
+ * rule-bearing shape) + the CAS capture backend + the PRODUCTION
+ * PLAN_MODE_PERMISSIONS constant. These tests are also the empirical proof
+ * that langchain's wrapToolCall seam delivers rewritten args to the tool —
+ * if it did not, the relative read below could never succeed.
+ *
+ * The sub-agent twin of this contract is pinned in
+ * subagent-plan-mode-permissions.test.ts (issue #255 wiring).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, mkdir, rm, readFile, writeFile, access } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { HumanMessage, ToolMessage, type BaseMessage } from "@langchain/core/messages";
+import { MemorySaver } from "@langchain/langgraph";
+import { createDeepAgent } from "deepagents";
+
+import { PLAN_MODE_PERMISSIONS } from "../../../shared/plan-mode-permissions.js";
+import { buildMiddlewareStack } from "../../../middleware/index.js";
+import { createCasCaptureBackend } from "../cas-capture-backend.js";
+import { CasCaptureObserver } from "../cas-capture-observer.js";
+import { ScriptedModel, type ScriptSelector } from "../__test-utils__/scripted-model.js";
+
+const SEEDED_CONTENT = "PLAN_MODE_README_TOKEN: hello from the seeded file";
+
+describe("plan-mode parent path normalization (issue #429)", () => {
+  let root: string;
+  let observer: CasCaptureObserver;
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "plan-path-"));
+    await mkdir(join(root, "src"), { recursive: true });
+    await writeFile(join(root, "src/notes.md"), SEEDED_CONTENT);
+    observer = new CasCaptureObserver({ rootDir: root, isIgnored: async () => true });
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  /**
+   * Build a parent graph the way setup.ts does in plan mode: the production
+   * middleware stack with pathNormalization set (derived, like the graph's
+   * permissions, from the plan-mode rules), a filesystem-only CAS capture
+   * backend (no shellEnv — plan mode clears it), and PLAN_MODE_PERMISSIONS
+   * on the graph.
+   */
+  async function buildPlanModeParent(script: ScriptSelector) {
+    const { middleware } = buildMiddlewareStack({
+      approvalGate: null,
+      pathNormalization: { rootDir: root },
+    });
+    const backend = await createCasCaptureBackend({ rootDir: root, observer });
+    return createDeepAgent({
+      model: new ScriptedModel(script),
+      checkpointer: new MemorySaver() as never,
+      backend,
+      middleware: middleware as never[],
+      permissions: PLAN_MODE_PERMISSIONS,
+    } as Parameters<typeof createDeepAgent>[0]);
+  }
+
+  function toolResultById(messages: BaseMessage[], toolCallId: string): string {
+    const match = messages.find(
+      (m): m is ToolMessage => m instanceof ToolMessage && m.tool_call_id === toolCallId,
+    );
+    expect(match, `expected a tool result for call '${toolCallId}'`).toBeDefined();
+    return typeof match!.content === "string" ? match!.content : JSON.stringify(match!.content);
+  }
+
+  async function invokeOnce(script: ScriptSelector, threadId: string) {
+    const agent = await buildPlanModeParent(script);
+    return (await agent.invoke(
+      { messages: [new HumanMessage({ content: "go" })] },
+      { configurable: { thread_id: threadId }, recursionLimit: 50 },
+    )) as { messages: BaseMessage[] };
+  }
+
+  it("a prompt-compliant relative read succeeds on the first tool round", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: "src/notes.md" }, id: "c_read_rel" },
+        ],
+        done: "done",
+      }),
+      "t_read_rel",
+    );
+
+    const readResult = toolResultById(result.messages, "c_read_rel");
+    expect(readResult).toContain("PLAN_MODE_README_TOKEN");
+    expect(readResult).not.toMatch(/path must be absolute/i);
+    expect(readResult).not.toMatch(/permission denied/i);
+  });
+
+  it("a relative write is refused by the RULES — permission denied, not a path-shape error", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "write_file", args: { file_path: "src/out.txt", content: "x" }, id: "c_write_rel" },
+        ],
+        done: "done",
+      }),
+      "t_write_rel",
+    );
+
+    // The deny-all-writes rule fires on the normalized path — the honest
+    // plan-mode refusal the model can reason about, instead of the
+    // pre-fix validation error that taught it to abandon relative paths.
+    expect(toolResultById(result.messages, "c_write_rel")).toMatch(/permission denied for write/i);
+    expect(toolResultById(result.messages, "c_write_rel")).not.toMatch(/path must be absolute/i);
+    await expect(access(join(root, "src/out.txt"))).rejects.toThrow();
+    expect(observer.before.size).toBe(0);
+  });
+
+  it("an escaping relative read is still refused — normalization grants no new reachability", async () => {
+    // Outside the root, reachable only if `..` were naively joined away.
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: "../escape.txt" }, id: "c_read_escape" },
+        ],
+        done: "done",
+      }),
+      "t_read_escape",
+    );
+
+    // Left raw by the middleware, refused by upstream validation exactly as
+    // before the fix.
+    expect(toolResultById(result.messages, "c_read_escape")).toMatch(/must not contain|path must be absolute/i);
+  });
+
+  it("absolute in-workspace paths keep working unchanged", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: join(root, "src/notes.md") }, id: "c_read_abs" },
+        ],
+        done: "done",
+      }),
+      "t_read_abs",
+    );
+
+    expect(toolResultById(result.messages, "c_read_abs")).toContain("PLAN_MODE_README_TOKEN");
+  });
+
+  it("relative ls flows through normalization to list the workspace directory", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [{ name: "ls", args: { path: "src" }, id: "c_ls_rel" }],
+        done: "done",
+      }),
+      "t_ls_rel",
+    );
+
+    const lsResult = toolResultById(result.messages, "c_ls_rel");
+    expect(lsResult).toContain("notes.md");
+    expect(lsResult).not.toMatch(/path must be absolute/i);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/shell-env.test.ts

@@ -1,22 +1,36 @@
 import { describe, it, expect } from "vitest";
 import { buildShellEnv, SHELL_ENV_DENYLIST } from "../shell-env.js";
+import { RUNNER_CREDENTIAL_ENV_KEYS } from "../../../shared/runner-credential-keys.js";
 
 describe("buildShellEnv", () => {
-  it("strips runner-internal credentials from the base env", () => {
-    const base = {
-      PATH: "/usr/bin",
-      HOME: "/home/runner",
-      STIGMER_RUNNER_HITL_SECRET: "secret",
-      CURSOR_API_KEY: "cursor-key",
-      STIGMER_TOKEN: "stigmer-token",
-    };
+  it("strips every runner credential from the base env", () => {
+    // Plant a value for every name in the source-of-truth list, so a key
+    // added to runner-credential-keys.ts is covered here automatically.
+    const base: NodeJS.ProcessEnv = { PATH: "/usr/bin", HOME: "/home/runner" };
+    for (const key of RUNNER_CREDENTIAL_ENV_KEYS) {
+      base[key] = `leaked-${key}`;
+    }
 
     const env = buildShellEnv({}, base);
 
     expect(env.PATH).toBe("/usr/bin");
     expect(env.HOME).toBe("/home/runner");
-    for (const key of SHELL_ENV_DENYLIST) {
-      expect(env[key]).toBeUndefined();
+    for (const key of RUNNER_CREDENTIAL_ENV_KEYS) {
+      expect(env[key], `runner credential '${key}' must not reach the shell env`).toBeUndefined();
+    }
+  });
+
+  it("denies the full credential list, not just the original three (issue #385)", () => {
+    // Pins the five names #385 added. The parameterized test above would
+    // pass even if the list regressed to three; this one cannot.
+    for (const key of [
+      "ANTHROPIC_API_KEY",
+      "OPENAI_API_KEY",
+      "STIGMER_AUTH_TOKEN",
+      "ANTHROPIC_FOUNDRY_API_KEY",
+      "AWS_BEARER_TOKEN_BEDROCK",
+    ]) {
+      expect(SHELL_ENV_DENYLIST, `'${key}' must be in the shell denylist`).toContain(key);
     }
   });
 

package/src/activities/execute-deep-agent/__tests__/subagent-plan-mode-permissions.test.ts

@@ -83,12 +83,10 @@ describe("plan-mode sub-agent filesystem permissions (issue #255)", () => {
     // One turn, three tool calls: both mutation tools must be denied by the
     // permission rules; the read must pass through untouched (the deny rule
     // covers the `write` operation class only).
-    // Real absolute workspace paths, as production models use (the prompt's
-    // file tree is absolute, and the tools' contract says absolute). With
-    // permission rules present this is also the only shape that reaches the
-    // rules at all: enforcePermission's canonicalization refuses relative
-    // paths with a validation error before any rule or backend runs — a
-    // different denial, but still nothing written.
+    // Absolute workspace paths — the canonical shape after enforcement
+    // canonicalization, and what the single-workspace prompt's prose (the
+    // absolute rootDir) steers models toward. The workspace-relative shape
+    // is pinned separately below (issue #429).
     const script: ScriptSelector = () => ({
       toolCalls: [
         { name: "write_file", args: { file_path: join(root, "dist/out.txt"), content: "new file" }, id: "c_write" },
@@ -143,19 +141,20 @@ describe("plan-mode sub-agent filesystem permissions (issue #255)", () => {
     expect(observer.before.size).toBe(1);
   });
 
-  it("relative-path mutations are refused too — by validation, before the rules", async () => {
-    // The native prompt steers models to workspace-relative paths, but
-    // deepagents' permission canonicalization accepts only absolute ones, so
-    // with rules present a relative-path call fails validation before any
-    // rule (or backend) runs. Read-only still holds — nothing is written —
-    // but the model sees "path must be absolute", not "permission denied",
-    // and prompt-compliant relative READS degrade the same way. That
-    // relative-vs-absolute friction is a pre-existing parent-plan-mode
-    // behavior, tracked as issue #429; this pins that the sub-agent's
-    // read-only contract survives it.
+  it("relative-path writes are refused by the RULES, and relative reads flow (issue #429)", async () => {
+    // The multi-workspace prompt mandates workspace-relative paths, and
+    // models routinely choose them in single-workspace sessions too. Before
+    // the #429 fix, deepagents' permission canonicalization refused the
+    // shape outright — every relative call, reads included, died with
+    // "path must be absolute" before any rule ran. compileSubagents now
+    // derives a path-normalization shim from the same `permissions` it
+    // bakes into the graph, so the relative shape reaches the rules in
+    // canonical form: writes get the honest plan-mode denial, reads just
+    // work. Read-only-by-construction (issue #255) holds throughout.
     const script: ScriptSelector = () => ({
       toolCalls: [
         { name: "write_file", args: { file_path: "dist/out.txt", content: "new file" }, id: "c_write_rel" },
+        { name: "read_file", args: { file_path: "notes.md" }, id: "c_read_rel" },
       ],
       done: "worker done",
     });
@@ -166,8 +165,14 @@ describe("plan-mode sub-agent filesystem permissions (issue #255)", () => {
       { configurable: { thread_id: "t3" }, recursionLimit: 50 },
     )) as { messages: BaseMessage[] };
 
-    expect(toolResultById(result.messages, "c_write_rel")).toMatch(/path must be absolute/i);
+    const writeResult = toolResultById(result.messages, "c_write_rel");
+    expect(writeResult).toMatch(/permission denied for write/i);
+    expect(writeResult).not.toMatch(/path must be absolute/i);
     await expect(access(join(root, "dist/out.txt"))).rejects.toThrow();
     expect(observer.before.size).toBe(0);
+
+    const readResult = toolResultById(result.messages, "c_read_rel");
+    expect(readResult).toContain("PLAN_MODE_README_TOKEN");
+    expect(readResult).not.toMatch(/path must be absolute/i);
   });
 });

package/src/activities/execute-deep-agent/setup.ts

@@ -635,17 +635,14 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // Step 9: Construct the LLM model. Resolution to the provider API id
     // happens inside buildChatModel; modelName stays the registry id for
     // pricing, the native-thinking heuristic, and sub-agent inheritance.
-    // Operator input: only a positive integer means "bound the request" —
-    // unset, non-numeric, zero, and negative all normalize to no bound.
-    const parsedTimeoutMs =
-      Number.parseInt(process.env.STIGMER_LLM_REQUEST_TIMEOUT_MS ?? "", 10);
-    const requestTimeoutMs = parsedTimeoutMs > 0 ? parsedTimeoutMs : undefined;
+    // The operator's STIGMER_LLM_REQUEST_TIMEOUT_MS bound is applied inside
+    // buildChatModel (#468) — the sub-agent modelFactory below silently
+    // dropped it when each caller parsed the env itself.
     const { model } = await buildChatModel({
       modelName,
       proxyEndpoint: config.proxyEndpoint ?? undefined,
       stigmerToken: config.stigmerToken ?? undefined,
       headerScope: { executionId },
-      timeoutMs: requestTimeoutMs,
     });
     timing.mark("build_model");
 
@@ -655,6 +652,12 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     const execConfig = execution.spec!.executionConfig;
     const isPlanMode = execConfig?.interactionMode === InteractionMode.PLAN;
     const shellEnv = isPlanMode ? undefined : buildShellEnv(envResult.mergedEnvVars);
+    // Plan mode's filesystem permission rules, hoisted once: the parent graph,
+    // every sub-agent graph, AND the path-normalization middleware (issue #429)
+    // all derive from this single value, so a rule-bearing graph can never miss
+    // the shim that keeps prompt-compliant relative paths from dying in rule
+    // validation (`path must be absolute`).
+    const planModePermissions = isPlanMode ? PLAN_MODE_PERMISSIONS : undefined;
 
     const toolServerMap = new Map<string, string>();
     if (mcpConnection) {
@@ -760,6 +763,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       } : null,
       otelSpans: { toolServerMap },
       approvalGate: approvalGateConfig,
+      pathNormalization: planModePermissions
+        ? { rootDir: workspaceBackend.rootDir }
+        : null,
     });
     timing.mark("build_middleware");
 
@@ -823,7 +829,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         // Plan mode's deny-all-writes rule, mirrored onto every sub-agent graph
         // (issue #255) — pre-built CompiledSubAgents never inherit the parent's
         // permissions, so read-only-by-construction must be baked in here.
-        ...(isPlanMode ? { permissions: PLAN_MODE_PERMISSIONS } : {}),
+        // compileSubagents derives each sub-agent's path-normalization shim
+        // from this same value (issue #429).
+        ...(planModePermissions ? { permissions: planModePermissions } : {}),
       });
       timing.mark("compile_subagents");
     }
@@ -857,7 +865,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       middleware: middleware as any,
       subagents: compiledSubagents ?? undefined,
       ...(responseFormat ? { responseFormat } : {}),
-      ...(isPlanMode ? { permissions: PLAN_MODE_PERMISSIONS } : {}),
+      ...(planModePermissions ? { permissions: planModePermissions } : {}),
     } as Parameters<typeof createDeepAgent>[0]);
 
     // Step 11: Prepare invocation input and config. The conversation catchup

package/src/activities/execute-deep-agent/shell-env.ts

@@ -6,15 +6,14 @@
  * never once at process start.
  */
 
-/** Runner-internal keys that must never reach agent shell commands. */
-export const SHELL_ENV_DENYLIST: readonly string[] = [
-  // Derives HITL approval fingerprints — an agent that reads this could forge receipts.
-  "STIGMER_RUNNER_HITL_SECRET",
-  // Cursor harness credential; shell commands do not need direct Cursor API access.
-  "CURSOR_API_KEY",
-  // Stigmer control-plane auth; shell commands use ExecutionContext overlay instead.
-  "STIGMER_TOKEN",
-];
+import { RUNNER_CREDENTIAL_ENV_KEYS } from "../../shared/runner-credential-keys.js";
+
+/**
+ * Runner-internal keys that must never reach agent shell commands: every
+ * credential the runner holds for its own outbound calls (issue #385). The
+ * names — and the rule for adding one — live in runner-credential-keys.ts.
+ */
+export const SHELL_ENV_DENYLIST: readonly string[] = RUNNER_CREDENTIAL_ENV_KEYS;
 
 /**
  * Build the environment map passed to deepagents' LocalShellBackend.