@stigmer/runner 3.12.0 → 3.12.2

package/src/__test-utils__/zip-fixtures.ts

@@ -0,0 +1,206 @@
+/**
+ * Shared ZIP fixture builder for runner unit tests.
+ *
+ * Emits complete, real-shaped archives — local file headers (optionally
+ * streaming-style, the Go stdlib writer's default), payloads, central
+ * directory, and EOCD — because that is the only shape that can reach the
+ * runner: both editions' skill push gates validate artifacts with
+ * central-directory-based readers (see zip-extract.ts's module doc and
+ * design record 017). Earlier fixtures emitted local headers only, a
+ * shape no real ZIP writer produces, and were coupled to the old parser's
+ * front-to-back walk.
+ *
+ * Mirrors the conformance suite's `zipFilesStreaming()`
+ * (test/conformance/src/support/skills.ts) so unit fixtures and
+ * cross-edition fixtures share one shape.
+ *
+ * Lives in src/__test-utils__/ so `tsc --noEmit` covers it while
+ * tsconfig.build.json keeps it out of dist/.
+ */
+
+import { deflateRawSync } from "node:zlib";
+
+export interface ZipFixtureFile {
+  name: string;
+  /** Text content is UTF-8 encoded; pass bytes directly for binary payloads. */
+  content: string | Uint8Array;
+  /** Compression method for the entry. Defaults to stored. */
+  method?: "stored" | "deflated";
+  /**
+   * Emit the entry the way Go's archive/zip does by default: general-purpose
+   * flag bit 3 set, zeroed sizes in the local header, and a trailing data
+   * descriptor (with the conventional signature) carrying the real values.
+   */
+  streaming?: boolean;
+  /**
+   * Lie about the entry's uncompressed size everywhere the writer would
+   * declare it (local header, data descriptor, central directory). Models a
+   * crafted archive whose declarations disagree with its actual payload —
+   * the input class the attachment injector's declared-size enforcement
+   * exists to reject (issue #567).
+   */
+  declaredUncompressedSize?: number;
+}
+
+export interface ZipFixtureOptions {
+  /** Trailing archive comment appended after the EOCD record. */
+  comment?: string;
+  /**
+   * Drop the central directory and EOCD, leaving only local headers and
+   * payloads. No real ZIP writer produces this shape — it models a download
+   * truncated before the archive's index.
+   */
+  omitCentralDirectory?: boolean;
+}
+
+/** Build a ZIP archive from path + content pairs. */
+export function buildZip(files: ZipFixtureFile[], options?: ZipFixtureOptions): Uint8Array {
+  const out = new ByteWriter();
+
+  interface WrittenEntry {
+    nameBytes: Uint8Array;
+    payload: Uint8Array;
+    declaredUncompressed: number;
+    crc: number;
+    flags: number;
+    method: number;
+    localHeaderOffset: number;
+  }
+  const written: WrittenEntry[] = [];
+
+  for (const file of files) {
+    const contentBytes =
+      typeof file.content === "string" ? new TextEncoder().encode(file.content) : file.content;
+    const deflated = file.method === "deflated";
+    const payload = deflated ? new Uint8Array(deflateRawSync(contentBytes)) : contentBytes;
+    const entry: WrittenEntry = {
+      nameBytes: new TextEncoder().encode(file.name),
+      payload,
+      declaredUncompressed: file.declaredUncompressedSize ?? contentBytes.length,
+      crc: crc32(contentBytes),
+      flags: file.streaming ? 0x0008 : 0,
+      method: deflated ? 8 : 0,
+      localHeaderOffset: out.length,
+    };
+    written.push(entry);
+
+    out.u32(0x04034b50); // local file header signature
+    out.u16(20); // version needed to extract
+    out.u16(entry.flags);
+    out.u16(entry.method);
+    out.u16(0); // mod time
+    out.u16(0); // mod date
+    out.u32(file.streaming ? 0 : entry.crc);
+    out.u32(file.streaming ? 0 : payload.length);
+    out.u32(file.streaming ? 0 : entry.declaredUncompressed);
+    out.u16(entry.nameBytes.length);
+    out.u16(0); // extra field length
+    out.raw(entry.nameBytes);
+    out.raw(payload);
+
+    if (file.streaming) {
+      out.u32(0x08074b50); // data descriptor signature (Go writes it)
+      out.u32(entry.crc);
+      out.u32(payload.length);
+      out.u32(entry.declaredUncompressed);
+    }
+  }
+
+  if (options?.omitCentralDirectory) {
+    return out.toUint8Array();
+  }
+
+  const centralDirectoryOffset = out.length;
+  for (const entry of written) {
+    out.u32(0x02014b50); // central directory record signature
+    out.u16(20); // version made by
+    out.u16(20); // version needed to extract
+    out.u16(entry.flags);
+    out.u16(entry.method);
+    out.u16(0); // mod time
+    out.u16(0); // mod date
+    out.u32(entry.crc);
+    out.u32(entry.payload.length);
+    out.u32(entry.declaredUncompressed);
+    out.u16(entry.nameBytes.length);
+    out.u16(0); // extra field length
+    out.u16(0); // comment length
+    out.u16(0); // disk number start
+    out.u16(0); // internal attributes
+    out.u32(0); // external attributes
+    out.u32(entry.localHeaderOffset);
+    out.raw(entry.nameBytes);
+  }
+  const centralDirectorySize = out.length - centralDirectoryOffset;
+
+  const commentBytes = new TextEncoder().encode(options?.comment ?? "");
+  out.u32(0x06054b50); // EOCD signature
+  out.u16(0); // disk number
+  out.u16(0); // disk with central directory
+  out.u16(written.length); // entries on this disk
+  out.u16(written.length); // total entries
+  out.u32(centralDirectorySize);
+  out.u32(centralDirectoryOffset);
+  out.u16(commentBytes.length);
+  out.raw(commentBytes);
+
+  return out.toUint8Array();
+}
+
+// Chunked assembly instead of a number[]-per-byte accumulator: fixtures at
+// the injector's 100 MB zip-bomb limit are built from payload-sized chunks,
+// which a per-byte spread-push cannot survive (argument-count overflow).
+class ByteWriter {
+  private readonly chunks: Uint8Array[] = [];
+  private size = 0;
+
+  get length(): number {
+    return this.size;
+  }
+
+  u16(v: number): void {
+    this.raw(new Uint8Array([v & 0xff, (v >>> 8) & 0xff]));
+  }
+
+  u32(v: number): void {
+    this.raw(new Uint8Array([v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff]));
+  }
+
+  raw(b: Uint8Array): void {
+    this.chunks.push(b);
+    this.size += b.length;
+  }
+
+  toUint8Array(): Uint8Array {
+    const result = new Uint8Array(this.size);
+    let offset = 0;
+    for (const chunk of this.chunks) {
+      result.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return result;
+  }
+}
+
+// Standard CRC-32 (IEEE 802.3, the ZIP checksum), table-driven so fixtures
+// at the injector's 100 MB limit stay cheap to build. Semantically identical
+// to the conformance suite's inline bit-loop helper.
+const CRC_TABLE = (() => {
+  const table = new Uint32Array(256);
+  for (let n = 0; n < 256; n++) {
+    let c = n;
+    for (let bit = 0; bit < 8; bit++) {
+      c = (c >>> 1) ^ (0xedb88320 & -(c & 1));
+    }
+    table[n] = c;
+  }
+  return table;
+})();
+
+function crc32(data: Uint8Array): number {
+  let crc = 0xffffffff;
+  for (let i = 0; i < data.length; i++) {
+    crc = (crc >>> 8) ^ CRC_TABLE[(crc ^ data[i]!) & 0xff]!;
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}

package/src/activities/__tests__/generate-session-subject.test.ts

@@ -0,0 +1,348 @@
+/**
+ * Unit tests for the GenerateSessionSubject activity core.
+ *
+ * The LLM seam (model registry + chat model) is module-mocked; the backend
+ * client is injected through SessionSubjectClient, so every skip branch,
+ * the agent-resolution chain, and both fallback classes are pinned without
+ * Temporal or network coupling. Behavioral contract mirrors the cloud
+ * GenerateSessionSubjectActivityImpl (see the activity header).
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ConnectError, Code } from "@connectrpc/connect";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { AgentInstance } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
+
+vi.mock("../../shared/model-registry.js", () => ({
+  getSummarizationModel: vi.fn(async (primary: string) => primary),
+}));
+vi.mock("../../shared/model-client.js", () => ({
+  buildChatModel: vi.fn(),
+}));
+vi.mock("../../shared/llm-backend.js", () => ({
+  checkDirectCredentials: vi.fn(() => null),
+}));
+vi.mock("../../shared/llm-proxy.js", () => ({
+  tryInferProvider: vi.fn(() => "anthropic"),
+}));
+
+import {
+  AUTO_CREATED_SUBJECT,
+  generateSessionSubject,
+  resolveAgentId,
+  heuristicSubject,
+  cleanSubject,
+  buildUserPrompt,
+  type SessionSubjectClient,
+  type GenerateSessionSubjectOptions,
+} from "../generate-session-subject.js";
+import { buildChatModel } from "../../shared/model-client.js";
+import { checkDirectCredentials } from "../../shared/llm-backend.js";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Fixtures
+// ─────────────────────────────────────────────────────────────────────────────
+
+const EXECUTION_ID = "aex_test123";
+const SESSION_ID = "ses_test456";
+const AGENT_ID = "agt_test789";
+const INSTANCE_ID = "ain_test012";
+
+function fakeExecution(overrides: Record<string, unknown> = {}): AgentExecution {
+  return {
+    spec: {
+      sessionId: SESSION_ID,
+      agentId: AGENT_ID,
+      message: "Explain how database indexing works for PostgreSQL",
+      ...overrides,
+    },
+  } as unknown as AgentExecution;
+}
+
+function fakeSession(subject: string = AUTO_CREATED_SUBJECT, agentInstanceId = ""): Session {
+  return {
+    spec: { subject, agentInstanceId },
+  } as unknown as Session;
+}
+
+function fakeAgent(): Agent {
+  return {
+    metadata: { name: "test-agent" },
+    spec: { description: "A helpful test assistant" },
+  } as unknown as Agent;
+}
+
+function fakeInstance(agentId: string): AgentInstance {
+  return { spec: { agentId } } as unknown as AgentInstance;
+}
+
+function notFound(): ConnectError {
+  return new ConnectError("not found", Code.NotFound);
+}
+
+interface ClientBehavior {
+  execution?: AgentExecution | Error;
+  session?: Session | Error;
+  agent?: Agent | Error;
+  instance?: AgentInstance | Error;
+  updateError?: Error;
+}
+
+function fakeClient(behavior: ClientBehavior = {}) {
+  const updated: Array<{ sessionId: string; subject: string }> = [];
+  const resolve = <T>(value: T | Error | undefined, fallback: T): Promise<T> => {
+    if (value instanceof Error) return Promise.reject(value);
+    return Promise.resolve(value ?? fallback);
+  };
+  const client: SessionSubjectClient = {
+    getExecution: vi.fn(() => resolve(behavior.execution, fakeExecution())),
+    getSession: vi.fn(() => resolve(behavior.session, fakeSession())),
+    getAgent: vi.fn(() => resolve(behavior.agent, fakeAgent())),
+    getAgentInstance: vi.fn(() => resolve(behavior.instance, fakeInstance(AGENT_ID))),
+    updateSessionSubject: vi.fn((sessionId: string, subject: string) => {
+      if (behavior.updateError) return Promise.reject(behavior.updateError);
+      updated.push({ sessionId, subject });
+      return Promise.resolve(fakeSession(subject));
+    }),
+  };
+  return { client, updated };
+}
+
+const OPTIONS: GenerateSessionSubjectOptions = {
+  proxyEndpoint: null,
+  stigmerToken: null,
+  primaryModel: "claude-sonnet-4.5",
+};
+
+function mockLlmReturning(content: unknown): void {
+  vi.mocked(buildChatModel).mockResolvedValue({
+    model: { invoke: vi.fn(async () => ({ content })) },
+  } as never);
+}
+
+beforeEach(() => {
+  vi.mocked(buildChatModel).mockReset();
+  vi.mocked(checkDirectCredentials).mockReturnValue(null);
+  mockLlmReturning("PostgreSQL B-tree Indexing");
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Happy path + persistence
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("generateSessionSubject", () => {
+  it("replaces the sentinel subject with the LLM title", async () => {
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toEqual([{ sessionId: SESSION_ID, subject: "PostgreSQL B-tree Indexing" }]);
+  });
+
+  it("titles a session whose subject is empty (not just the sentinel)", async () => {
+    const { client, updated } = fakeClient({ session: fakeSession("") });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(1);
+  });
+
+  it("passes executionId into the proxy header scope for billing attribution", async () => {
+    const { client } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, {
+      ...OPTIONS,
+      proxyEndpoint: "https://proxy.example",
+      stigmerToken: "tok",
+    });
+    expect(vi.mocked(buildChatModel)).toHaveBeenCalledWith(
+      expect.objectContaining({ headerScope: { executionId: EXECUTION_ID } }),
+    );
+  });
+
+  it("swallows a persistence failure (non-critical contract)", async () => {
+    const { client } = fakeClient({ updateError: new Error("write refused") });
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).resolves.toBeUndefined();
+  });
+
+  // ───────────────────────────────────────────────────────────────────────────
+  // Skip branches (cloud-parity semantics)
+  // ───────────────────────────────────────────────────────────────────────────
+
+  it("skips when the subject was already set by a human", async () => {
+    const { client, updated } = fakeClient({ session: fakeSession("My renamed chat") });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+    expect(vi.mocked(buildChatModel)).not.toHaveBeenCalled();
+  });
+
+  it("skips when the execution has no session id", async () => {
+    const { client, updated } = fakeClient({ execution: fakeExecution({ sessionId: "" }) });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+  });
+
+  it("skips when the execution has no user message", async () => {
+    const { client, updated } = fakeClient({ execution: fakeExecution({ message: "" }) });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+  });
+
+  it.each([
+    ["execution", { execution: notFound() }],
+    ["session", { session: notFound() }],
+    ["agent", { agent: notFound() }],
+  ] as const)("skips (does not throw) when the %s is NOT_FOUND", async (_what, behavior) => {
+    const { client, updated } = fakeClient(behavior);
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).resolves.toBeUndefined();
+    expect(updated).toHaveLength(0);
+  });
+
+  it("propagates non-NOT_FOUND lookup failures as activity failures", async () => {
+    const { client } = fakeClient({
+      execution: new ConnectError("backend down", Code.Unavailable),
+    });
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).rejects.toThrow(
+      "backend down",
+    );
+  });
+
+  // ───────────────────────────────────────────────────────────────────────────
+  // Fallbacks
+  // ───────────────────────────────────────────────────────────────────────────
+
+  it("falls back to the heuristic title when the LLM call throws", async () => {
+    vi.mocked(buildChatModel).mockRejectedValue(new Error("provider 500"));
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toEqual([
+      { sessionId: SESSION_ID, subject: "Explain how database indexing works for PostgreSQL" },
+    ]);
+  });
+
+  it("falls back to the heuristic title when the LLM returns empty content", async () => {
+    mockLlmReturning("");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated[0]?.subject).toBe("Explain how database indexing works for PostgreSQL");
+  });
+
+  it("falls back to the heuristic in direct mode with no credential path", async () => {
+    vi.mocked(checkDirectCredentials).mockReturnValue("ANTHROPIC_API_KEY is missing");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(vi.mocked(buildChatModel)).not.toHaveBeenCalled();
+    expect(updated[0]?.subject).toBe("Explain how database indexing works for PostgreSQL");
+  });
+
+  it("does NOT run the credential pre-check in proxy mode", async () => {
+    vi.mocked(checkDirectCredentials).mockReturnValue("ANTHROPIC_API_KEY is missing");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, {
+      ...OPTIONS,
+      proxyEndpoint: "https://proxy.example",
+    });
+    expect(updated[0]?.subject).toBe("PostgreSQL B-tree Indexing");
+  });
+
+  it("joins array-of-parts LLM content into a single title", async () => {
+    mockLlmReturning([{ type: "text", text: "Postgres " }, { type: "text", text: "Index Tuning" }]);
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated[0]?.subject).toBe("Postgres Index Tuning");
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Agent resolution (direct + instance chain)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("resolveAgentId", () => {
+  it("prefers the execution's direct agent_id", async () => {
+    const { client } = fakeClient();
+    const id = await resolveAgentId(fakeExecution(), fakeSession(), client);
+    expect(id).toBe(AGENT_ID);
+    expect(client.getAgentInstance).not.toHaveBeenCalled();
+  });
+
+  it("resolves through the session's agent-instance chain", async () => {
+    const { client } = fakeClient({ instance: fakeInstance("agt_from_instance") });
+    const id = await resolveAgentId(
+      fakeExecution({ agentId: "" }),
+      fakeSession(AUTO_CREATED_SUBJECT, INSTANCE_ID),
+      client,
+    );
+    expect(id).toBe("agt_from_instance");
+    expect(client.getAgentInstance).toHaveBeenCalledWith(INSTANCE_ID);
+  });
+
+  it("returns empty when neither a direct id nor an instance exists", async () => {
+    const { client } = fakeClient();
+    const id = await resolveAgentId(fakeExecution({ agentId: "" }), fakeSession(), client);
+    expect(id).toBe("");
+  });
+
+  it("returns empty when the instance row is NOT_FOUND", async () => {
+    const { client } = fakeClient({ instance: notFound() });
+    const id = await resolveAgentId(
+      fakeExecution({ agentId: "" }),
+      fakeSession(AUTO_CREATED_SUBJECT, INSTANCE_ID),
+      client,
+    );
+    expect(id).toBe("");
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Title shaping helpers (lockstep with the cloud activity)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("heuristicSubject", () => {
+  it("takes at most the first 7 words", () => {
+    expect(heuristicSubject("one two three four five six seven eight nine")).toBe(
+      "one two three four five six seven",
+    );
+  });
+
+  it("keeps short messages whole", () => {
+    expect(heuristicSubject("  fix the build  ")).toBe("fix the build");
+  });
+
+  it("truncates to 50 chars with an ellipsis", () => {
+    const long = "supercalifragilistic expialidocious antidisestablishmentarianism words";
+    const subject = heuristicSubject(long);
+    expect(subject.length).toBeLessThanOrEqual(50);
+    expect(subject.endsWith("...")).toBe(true);
+  });
+});
+
+describe("cleanSubject", () => {
+  it("strips one layer of wrapping double quotes", () => {
+    expect(cleanSubject('"Postgres Index Tuning"')).toBe("Postgres Index Tuning");
+  });
+
+  it("strips one layer of wrapping single quotes", () => {
+    expect(cleanSubject("'Postgres Index Tuning'")).toBe("Postgres Index Tuning");
+  });
+
+  it("caps at 50 chars with an ellipsis", () => {
+    const cleaned = cleanSubject("x".repeat(80));
+    expect(cleaned.length).toBe(50);
+    expect(cleaned.endsWith("...")).toBe(true);
+  });
+
+  it("trims whitespace inside stripped quotes", () => {
+    expect(cleanSubject('" Postgres "')).toBe("Postgres");
+  });
+});
+
+describe("buildUserPrompt", () => {
+  it("includes the message, agent name, and purpose", () => {
+    const prompt = buildUserPrompt("fix my build", "builder", "builds things");
+    expect(prompt).toContain('User\'s first message:\n"fix my build"');
+    expect(prompt).toContain("Agent: builder");
+    expect(prompt).toContain("Agent purpose: builds things");
+    expect(prompt.endsWith("Generate the title:")).toBe(true);
+  });
+
+  it("omits the purpose line when the description is empty", () => {
+    expect(buildUserPrompt("m", "a", "")).not.toContain("Agent purpose:");
+  });
+});

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -753,11 +753,47 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([]);
     });
 
-    it("still gates a gitignored DELETE (no CAS capture path, parity with deep-agent)", async () => {
+    it("stages a non-secret gitignored DELETE and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
-      expect(h.decide(hookDelete("app.log")).permission).toBe("deny");
+      writeFileSync(join(h.root, "app.log"), "DOOMED", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      // Flowed, not denied — reviewed post-hoc as a DELETE entry, not a pause.
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.secretPaths).toEqual([]);
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("app.log");
+      // The pre-delete bytes are staged — the restorable "before" side.
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("DOOMED");
+    });
+
+    it("first-touch-wins across write-then-delete: the true pre-turn before survives", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
+      writeFileSync(join(h.root, "app.log"), "ORIGINAL", "utf-8");
+      expect(h.decide(hookWrite("app.log", "REWRITTEN")).permission).toBe("allow");
+      // Simulate the write having applied, then a delete later this turn.
+      writeFileSync(join(h.root, "app.log"), "REWRITTEN", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("ORIGINAL");
+    });
+
+    it("keeps a SECRET-LIKE gitignored delete on the deny-gate: approvable, never staged (issue #303)", async () => {
+      // Unlike a secret write (hard-blocked — its content must never surface), a
+      // delete's args expose no secret content, so a human may approve it. Its
+      // before-bytes must never enter the sidecar though: staging would both
+      // persist the secret bytes and mark the path "secret", making the boundary
+      // author a blocking DIFF_UNREVIEWABLE for a merely-gated delete.
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: [".env"] });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval"); // gated, not blocked
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]); // no secret marker for a gated delete
     });
 
     it("with captureIgnored OFF, a gitignored write stays denied and stages nothing", async () => {
@@ -768,10 +804,10 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     });
   });
 
-  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write is
-  // CAS-staged and flowed for review (not only gitignored ones), a delete stays
-  // gated (no CAS delete-capture path, parity with the deep-agent), and shell/MCP
-  // gate as always. The workspace is deliberately NOT git-initialized.
+  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write and
+  // (issue #303) every non-secret delete is CAS-staged and flowed for review —
+  // not only gitignored ones — while shell/MCP gate as always. The workspace is
+  // deliberately NOT git-initialized.
   describe("non-git workspace CAS capture (Slice 2c)", () => {
     it("stages EVERY write (not just gitignored) and allows it, no denial", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
@@ -806,12 +842,27 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([".env"]);
     });
 
-    it("still gates a DELETE (deny-gate, parity with deep-agent) and stages nothing", async () => {
+    it("stages a DELETE with its pre-delete bytes and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
-      expect(h.decide(hookDelete("notes.md")).permission).toBe("deny");
-      expect(h.ledger()).toHaveLength(1);
+      writeFileSync(join(h.root, "notes.md"), "KEEP ME", "utf-8");
+      expect(h.decide(hookDelete("notes.md")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("notes.md");
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("KEEP ME");
+    });
+
+    it("keeps a secret-like DELETE gated (approvable) and stages nothing", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval");
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]);
     });
 
     it("still gates shell (never git-reversible, never CAS-captured)", async () => {