@stigmer/runner 3.12.1 → 3.12.2

package/src/activities/__tests__/generate-session-subject.test.ts

@@ -0,0 +1,348 @@
+/**
+ * Unit tests for the GenerateSessionSubject activity core.
+ *
+ * The LLM seam (model registry + chat model) is module-mocked; the backend
+ * client is injected through SessionSubjectClient, so every skip branch,
+ * the agent-resolution chain, and both fallback classes are pinned without
+ * Temporal or network coupling. Behavioral contract mirrors the cloud
+ * GenerateSessionSubjectActivityImpl (see the activity header).
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ConnectError, Code } from "@connectrpc/connect";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { AgentInstance } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
+
+vi.mock("../../shared/model-registry.js", () => ({
+  getSummarizationModel: vi.fn(async (primary: string) => primary),
+}));
+vi.mock("../../shared/model-client.js", () => ({
+  buildChatModel: vi.fn(),
+}));
+vi.mock("../../shared/llm-backend.js", () => ({
+  checkDirectCredentials: vi.fn(() => null),
+}));
+vi.mock("../../shared/llm-proxy.js", () => ({
+  tryInferProvider: vi.fn(() => "anthropic"),
+}));
+
+import {
+  AUTO_CREATED_SUBJECT,
+  generateSessionSubject,
+  resolveAgentId,
+  heuristicSubject,
+  cleanSubject,
+  buildUserPrompt,
+  type SessionSubjectClient,
+  type GenerateSessionSubjectOptions,
+} from "../generate-session-subject.js";
+import { buildChatModel } from "../../shared/model-client.js";
+import { checkDirectCredentials } from "../../shared/llm-backend.js";
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Fixtures
+// ─────────────────────────────────────────────────────────────────────────────
+
+const EXECUTION_ID = "aex_test123";
+const SESSION_ID = "ses_test456";
+const AGENT_ID = "agt_test789";
+const INSTANCE_ID = "ain_test012";
+
+function fakeExecution(overrides: Record<string, unknown> = {}): AgentExecution {
+  return {
+    spec: {
+      sessionId: SESSION_ID,
+      agentId: AGENT_ID,
+      message: "Explain how database indexing works for PostgreSQL",
+      ...overrides,
+    },
+  } as unknown as AgentExecution;
+}
+
+function fakeSession(subject: string = AUTO_CREATED_SUBJECT, agentInstanceId = ""): Session {
+  return {
+    spec: { subject, agentInstanceId },
+  } as unknown as Session;
+}
+
+function fakeAgent(): Agent {
+  return {
+    metadata: { name: "test-agent" },
+    spec: { description: "A helpful test assistant" },
+  } as unknown as Agent;
+}
+
+function fakeInstance(agentId: string): AgentInstance {
+  return { spec: { agentId } } as unknown as AgentInstance;
+}
+
+function notFound(): ConnectError {
+  return new ConnectError("not found", Code.NotFound);
+}
+
+interface ClientBehavior {
+  execution?: AgentExecution | Error;
+  session?: Session | Error;
+  agent?: Agent | Error;
+  instance?: AgentInstance | Error;
+  updateError?: Error;
+}
+
+function fakeClient(behavior: ClientBehavior = {}) {
+  const updated: Array<{ sessionId: string; subject: string }> = [];
+  const resolve = <T>(value: T | Error | undefined, fallback: T): Promise<T> => {
+    if (value instanceof Error) return Promise.reject(value);
+    return Promise.resolve(value ?? fallback);
+  };
+  const client: SessionSubjectClient = {
+    getExecution: vi.fn(() => resolve(behavior.execution, fakeExecution())),
+    getSession: vi.fn(() => resolve(behavior.session, fakeSession())),
+    getAgent: vi.fn(() => resolve(behavior.agent, fakeAgent())),
+    getAgentInstance: vi.fn(() => resolve(behavior.instance, fakeInstance(AGENT_ID))),
+    updateSessionSubject: vi.fn((sessionId: string, subject: string) => {
+      if (behavior.updateError) return Promise.reject(behavior.updateError);
+      updated.push({ sessionId, subject });
+      return Promise.resolve(fakeSession(subject));
+    }),
+  };
+  return { client, updated };
+}
+
+const OPTIONS: GenerateSessionSubjectOptions = {
+  proxyEndpoint: null,
+  stigmerToken: null,
+  primaryModel: "claude-sonnet-4.5",
+};
+
+function mockLlmReturning(content: unknown): void {
+  vi.mocked(buildChatModel).mockResolvedValue({
+    model: { invoke: vi.fn(async () => ({ content })) },
+  } as never);
+}
+
+beforeEach(() => {
+  vi.mocked(buildChatModel).mockReset();
+  vi.mocked(checkDirectCredentials).mockReturnValue(null);
+  mockLlmReturning("PostgreSQL B-tree Indexing");
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Happy path + persistence
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("generateSessionSubject", () => {
+  it("replaces the sentinel subject with the LLM title", async () => {
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toEqual([{ sessionId: SESSION_ID, subject: "PostgreSQL B-tree Indexing" }]);
+  });
+
+  it("titles a session whose subject is empty (not just the sentinel)", async () => {
+    const { client, updated } = fakeClient({ session: fakeSession("") });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(1);
+  });
+
+  it("passes executionId into the proxy header scope for billing attribution", async () => {
+    const { client } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, {
+      ...OPTIONS,
+      proxyEndpoint: "https://proxy.example",
+      stigmerToken: "tok",
+    });
+    expect(vi.mocked(buildChatModel)).toHaveBeenCalledWith(
+      expect.objectContaining({ headerScope: { executionId: EXECUTION_ID } }),
+    );
+  });
+
+  it("swallows a persistence failure (non-critical contract)", async () => {
+    const { client } = fakeClient({ updateError: new Error("write refused") });
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).resolves.toBeUndefined();
+  });
+
+  // ───────────────────────────────────────────────────────────────────────────
+  // Skip branches (cloud-parity semantics)
+  // ───────────────────────────────────────────────────────────────────────────
+
+  it("skips when the subject was already set by a human", async () => {
+    const { client, updated } = fakeClient({ session: fakeSession("My renamed chat") });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+    expect(vi.mocked(buildChatModel)).not.toHaveBeenCalled();
+  });
+
+  it("skips when the execution has no session id", async () => {
+    const { client, updated } = fakeClient({ execution: fakeExecution({ sessionId: "" }) });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+  });
+
+  it("skips when the execution has no user message", async () => {
+    const { client, updated } = fakeClient({ execution: fakeExecution({ message: "" }) });
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toHaveLength(0);
+  });
+
+  it.each([
+    ["execution", { execution: notFound() }],
+    ["session", { session: notFound() }],
+    ["agent", { agent: notFound() }],
+  ] as const)("skips (does not throw) when the %s is NOT_FOUND", async (_what, behavior) => {
+    const { client, updated } = fakeClient(behavior);
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).resolves.toBeUndefined();
+    expect(updated).toHaveLength(0);
+  });
+
+  it("propagates non-NOT_FOUND lookup failures as activity failures", async () => {
+    const { client } = fakeClient({
+      execution: new ConnectError("backend down", Code.Unavailable),
+    });
+    await expect(generateSessionSubject(EXECUTION_ID, client, OPTIONS)).rejects.toThrow(
+      "backend down",
+    );
+  });
+
+  // ───────────────────────────────────────────────────────────────────────────
+  // Fallbacks
+  // ───────────────────────────────────────────────────────────────────────────
+
+  it("falls back to the heuristic title when the LLM call throws", async () => {
+    vi.mocked(buildChatModel).mockRejectedValue(new Error("provider 500"));
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated).toEqual([
+      { sessionId: SESSION_ID, subject: "Explain how database indexing works for PostgreSQL" },
+    ]);
+  });
+
+  it("falls back to the heuristic title when the LLM returns empty content", async () => {
+    mockLlmReturning("");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated[0]?.subject).toBe("Explain how database indexing works for PostgreSQL");
+  });
+
+  it("falls back to the heuristic in direct mode with no credential path", async () => {
+    vi.mocked(checkDirectCredentials).mockReturnValue("ANTHROPIC_API_KEY is missing");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(vi.mocked(buildChatModel)).not.toHaveBeenCalled();
+    expect(updated[0]?.subject).toBe("Explain how database indexing works for PostgreSQL");
+  });
+
+  it("does NOT run the credential pre-check in proxy mode", async () => {
+    vi.mocked(checkDirectCredentials).mockReturnValue("ANTHROPIC_API_KEY is missing");
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, {
+      ...OPTIONS,
+      proxyEndpoint: "https://proxy.example",
+    });
+    expect(updated[0]?.subject).toBe("PostgreSQL B-tree Indexing");
+  });
+
+  it("joins array-of-parts LLM content into a single title", async () => {
+    mockLlmReturning([{ type: "text", text: "Postgres " }, { type: "text", text: "Index Tuning" }]);
+    const { client, updated } = fakeClient();
+    await generateSessionSubject(EXECUTION_ID, client, OPTIONS);
+    expect(updated[0]?.subject).toBe("Postgres Index Tuning");
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Agent resolution (direct + instance chain)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("resolveAgentId", () => {
+  it("prefers the execution's direct agent_id", async () => {
+    const { client } = fakeClient();
+    const id = await resolveAgentId(fakeExecution(), fakeSession(), client);
+    expect(id).toBe(AGENT_ID);
+    expect(client.getAgentInstance).not.toHaveBeenCalled();
+  });
+
+  it("resolves through the session's agent-instance chain", async () => {
+    const { client } = fakeClient({ instance: fakeInstance("agt_from_instance") });
+    const id = await resolveAgentId(
+      fakeExecution({ agentId: "" }),
+      fakeSession(AUTO_CREATED_SUBJECT, INSTANCE_ID),
+      client,
+    );
+    expect(id).toBe("agt_from_instance");
+    expect(client.getAgentInstance).toHaveBeenCalledWith(INSTANCE_ID);
+  });
+
+  it("returns empty when neither a direct id nor an instance exists", async () => {
+    const { client } = fakeClient();
+    const id = await resolveAgentId(fakeExecution({ agentId: "" }), fakeSession(), client);
+    expect(id).toBe("");
+  });
+
+  it("returns empty when the instance row is NOT_FOUND", async () => {
+    const { client } = fakeClient({ instance: notFound() });
+    const id = await resolveAgentId(
+      fakeExecution({ agentId: "" }),
+      fakeSession(AUTO_CREATED_SUBJECT, INSTANCE_ID),
+      client,
+    );
+    expect(id).toBe("");
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Title shaping helpers (lockstep with the cloud activity)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe("heuristicSubject", () => {
+  it("takes at most the first 7 words", () => {
+    expect(heuristicSubject("one two three four five six seven eight nine")).toBe(
+      "one two three four five six seven",
+    );
+  });
+
+  it("keeps short messages whole", () => {
+    expect(heuristicSubject("  fix the build  ")).toBe("fix the build");
+  });
+
+  it("truncates to 50 chars with an ellipsis", () => {
+    const long = "supercalifragilistic expialidocious antidisestablishmentarianism words";
+    const subject = heuristicSubject(long);
+    expect(subject.length).toBeLessThanOrEqual(50);
+    expect(subject.endsWith("...")).toBe(true);
+  });
+});
+
+describe("cleanSubject", () => {
+  it("strips one layer of wrapping double quotes", () => {
+    expect(cleanSubject('"Postgres Index Tuning"')).toBe("Postgres Index Tuning");
+  });
+
+  it("strips one layer of wrapping single quotes", () => {
+    expect(cleanSubject("'Postgres Index Tuning'")).toBe("Postgres Index Tuning");
+  });
+
+  it("caps at 50 chars with an ellipsis", () => {
+    const cleaned = cleanSubject("x".repeat(80));
+    expect(cleaned.length).toBe(50);
+    expect(cleaned.endsWith("...")).toBe(true);
+  });
+
+  it("trims whitespace inside stripped quotes", () => {
+    expect(cleanSubject('" Postgres "')).toBe("Postgres");
+  });
+});
+
+describe("buildUserPrompt", () => {
+  it("includes the message, agent name, and purpose", () => {
+    const prompt = buildUserPrompt("fix my build", "builder", "builds things");
+    expect(prompt).toContain('User\'s first message:\n"fix my build"');
+    expect(prompt).toContain("Agent: builder");
+    expect(prompt).toContain("Agent purpose: builds things");
+    expect(prompt.endsWith("Generate the title:")).toBe(true);
+  });
+
+  it("omits the purpose line when the description is empty", () => {
+    expect(buildUserPrompt("m", "a", "")).not.toContain("Agent purpose:");
+  });
+});

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -753,11 +753,47 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([]);
     });
 
-    it("still gates a gitignored DELETE (no CAS capture path, parity with deep-agent)", async () => {
+    it("stages a non-secret gitignored DELETE and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
-      expect(h.decide(hookDelete("app.log")).permission).toBe("deny");
+      writeFileSync(join(h.root, "app.log"), "DOOMED", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      // Flowed, not denied — reviewed post-hoc as a DELETE entry, not a pause.
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.secretPaths).toEqual([]);
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("app.log");
+      // The pre-delete bytes are staged — the restorable "before" side.
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("DOOMED");
+    });
+
+    it("first-touch-wins across write-then-delete: the true pre-turn before survives", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: ["*.log"] });
+      writeFileSync(join(h.root, "app.log"), "ORIGINAL", "utf-8");
+      expect(h.decide(hookWrite("app.log", "REWRITTEN")).permission).toBe("allow");
+      // Simulate the write having applied, then a delete later this turn.
+      writeFileSync(join(h.root, "app.log"), "REWRITTEN", "utf-8");
+      expect(h.decide(hookDelete("app.log")).permission).toBe("allow");
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("ORIGINAL");
+    });
+
+    it("keeps a SECRET-LIKE gitignored delete on the deny-gate: approvable, never staged (issue #303)", async () => {
+      // Unlike a secret write (hard-blocked — its content must never surface), a
+      // delete's args expose no secret content, so a human may approve it. Its
+      // before-bytes must never enter the sidecar though: staging would both
+      // persist the secret bytes and mark the path "secret", making the boundary
+      // author a blocking DIFF_UNREVIEWABLE for a merely-gated delete.
+      const h = setup({ captureMode: true, captureIgnored: true, gitignored: [".env"] });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval"); // gated, not blocked
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]); // no secret marker for a gated delete
     });
 
     it("with captureIgnored OFF, a gitignored write stays denied and stages nothing", async () => {
@@ -768,10 +804,10 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     });
   });
 
-  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write is
-  // CAS-staged and flowed for review (not only gitignored ones), a delete stays
-  // gated (no CAS delete-capture path, parity with the deep-agent), and shell/MCP
-  // gate as always. The workspace is deliberately NOT git-initialized.
+  // Slice 2c: a NON-git workspace has no git snapshot, so EVERY file write and
+  // (issue #303) every non-secret delete is CAS-staged and flowed for review —
+  // not only gitignored ones — while shell/MCP gate as always. The workspace is
+  // deliberately NOT git-initialized.
   describe("non-git workspace CAS capture (Slice 2c)", () => {
     it("stages EVERY write (not just gitignored) and allows it, no denial", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
@@ -806,12 +842,27 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
       expect(obs.secretPaths).toEqual([".env"]);
     });
 
-    it("still gates a DELETE (deny-gate, parity with deep-agent) and stages nothing", async () => {
+    it("stages a DELETE with its pre-delete bytes and allows it (issue #303)", async () => {
       const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
-      expect(h.decide(hookDelete("notes.md")).permission).toBe("deny");
-      expect(h.ledger()).toHaveLength(1);
+      writeFileSync(join(h.root, "notes.md"), "KEEP ME", "utf-8");
+      expect(h.decide(hookDelete("notes.md")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+      const obs = await h.observations();
+      expect(obs.captured).toHaveLength(1);
+      expect(obs.captured[0].path).toBe("notes.md");
+      expect(Buffer.from(obs.captured[0].before!).toString("utf8")).toBe("KEEP ME");
+    });
+
+    it("keeps a secret-like DELETE gated (approvable) and stages nothing", async () => {
+      const h = setup({ captureMode: true, captureIgnored: true, gitWorkspace: false });
+      writeFileSync(join(h.root, ".env"), "API_KEY=abc", "utf-8");
+      const d = h.decide(hookDelete(".env"));
+      expect(d.permission).toBe("deny");
+      expect(d.raw).toContain("submitted to the user for approval");
+      expect(h.ledger().map((e) => e.kind)).toEqual(["approval"]);
       const obs = await h.observations();
       expect(obs.captured).toEqual([]);
+      expect(obs.secretPaths).toEqual([]);
     });
 
     it("still gates shell (never git-reversible, never CAS-captured)", async () => {

package/src/activities/execute-cursor/__tests__/skill-resolver.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, existsSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { resolveSkills } from "../skill-resolver.js";
@@ -17,6 +17,7 @@ function makeSkillProto(overrides: {
   description?: string;
   skillMd?: string;
   artifactStorageKey?: string;
+  versionHash?: string;
 } = {}) {
   return {
     metadata: {
@@ -31,7 +32,7 @@ function makeSkillProto(overrides: {
     },
     status: {
       artifactStorageKey: overrides.artifactStorageKey ?? "",
-      versionHash: "abc",
+      versionHash: overrides.versionHash ?? "abc",
     },
   } as any;
 }
@@ -75,12 +76,14 @@ describe("resolveSkills — artifact extraction", () => {
       ...clientOverrides,
     } as any;
 
+    // Re-run resolution for the same session — the mount-cache tests model
+    // one session's successive executions, which share the platform dir.
+    const resolveAgain = () =>
+      resolveSkills(client, refs, { sessionId, primaryWorkspaceDir: workspaceDir });
+
     try {
-      const result = await resolveSkills(client, refs, {
-        sessionId,
-        primaryWorkspaceDir: workspaceDir,
-      });
-      return { result, platformDir, client };
+      const result = await resolveAgain();
+      return { result, platformDir, client, resolveAgain };
     } catch (err) {
       // Clean up on failure
       rmSync(platformDir, { recursive: true, force: true });
@@ -189,6 +192,159 @@ describe("resolveSkills — artifact extraction", () => {
     }
   });
 
+  it("re-resolving an unchanged version skips the artifact download (mount cache hit)", async () => {
+    const artifact = buildZip([
+      { name: "SKILL.md", content: "# Cached" },
+      { name: "references/guide.md", content: "guide" },
+    ]);
+    const getSkillByReference = vi.fn().mockResolvedValue(
+      makeSkillProto({
+        name: "cached-skill",
+        slug: "cached-skill",
+        skillMd: "# Cached",
+        artifactStorageKey: "artifacts/cached.zip",
+        versionHash: "hash-v1",
+      }),
+    );
+    const getSkillArtifact = vi.fn().mockResolvedValue({ artifact });
+
+    const { result, platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("cached-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      expect(result).toHaveLength(1);
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
+
+      const second = await resolveAgain();
+      expect(second).toHaveLength(1);
+      expect(second[0].name).toBe("cached-skill");
+      // Metadata was re-fetched (latest-version freshness)...
+      expect(client.getSkillByReference).toHaveBeenCalledTimes(2);
+      // ...but the artifact transfer and rewrite were skipped.
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
+
+      const skillDir = join(platformDir, "skills", "cached-skill");
+      expect(readFileSync(join(skillDir, "references", "guide.md"), "utf-8")).toBe("guide");
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("re-downloads on version change and clears stale files from the old mount", async () => {
+    const v1 = makeSkillProto({
+      name: "evolving-skill",
+      slug: "evolving-skill",
+      skillMd: "# V1",
+      artifactStorageKey: "artifacts/v1.zip",
+      versionHash: "hash-v1",
+    });
+    const v2 = makeSkillProto({
+      name: "evolving-skill",
+      slug: "evolving-skill",
+      skillMd: "# V2",
+      artifactStorageKey: "artifacts/v2.zip",
+      versionHash: "hash-v2",
+    });
+    const artifactV1 = buildZip([{ name: "references/removed-in-v2.md", content: "old" }]);
+    const artifactV2 = buildZip([{ name: "references/new-in-v2.md", content: "new" }]);
+
+    const getSkillByReference = vi.fn().mockResolvedValueOnce(v1).mockResolvedValueOnce(v2);
+    const getSkillArtifact = vi
+      .fn()
+      .mockResolvedValueOnce({ artifact: artifactV1 })
+      .mockResolvedValueOnce({ artifact: artifactV2 });
+
+    const { platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("evolving-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      const skillDir = join(platformDir, "skills", "evolving-skill");
+      expect(readFileSync(join(skillDir, "references", "removed-in-v2.md"), "utf-8")).toBe("old");
+
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "SKILL.md"), "utf-8")).toBe("# V2");
+      expect(readFileSync(join(skillDir, "references", "new-in-v2.md"), "utf-8")).toBe("new");
+      // The v1-only file must not linger in the v2 mount (the stale-file leak).
+      expect(existsSync(join(skillDir, "references", "removed-in-v2.md"))).toBe(false);
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("does not cache a SKILL.md-only fallback — the next execution retries the download", async () => {
+    const proto = makeSkillProto({
+      name: "retry-skill",
+      slug: "retry-skill",
+      skillMd: "# Retry",
+      artifactStorageKey: "artifacts/retry.zip",
+      versionHash: "hash-v1",
+    });
+    const artifact = buildZip([{ name: "references/late.md", content: "finally" }]);
+    const getSkillByReference = vi.fn().mockResolvedValue(proto);
+    const getSkillArtifact = vi
+      .fn()
+      .mockRejectedValueOnce(new Error("Network timeout"))
+      .mockResolvedValueOnce({ artifact });
+
+    const { result, platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("retry-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      // First pass degraded to SKILL.md only.
+      expect(result).toHaveLength(1);
+      const skillDir = join(platformDir, "skills", "retry-skill");
+      expect(existsSync(join(skillDir, "references"))).toBe(false);
+
+      // Second pass retries and completes the mount.
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "references", "late.md"), "utf-8")).toBe("finally");
+
+      // Third pass is a cache hit.
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
+  it("treats a corrupted mount marker as stale and remounts", async () => {
+    const artifact = buildZip([{ name: "references/guide.md", content: "guide" }]);
+    const getSkillByReference = vi.fn().mockResolvedValue(
+      makeSkillProto({
+        name: "tampered-skill",
+        slug: "tampered-skill",
+        skillMd: "# Tampered",
+        artifactStorageKey: "artifacts/tampered.zip",
+        versionHash: "hash-v1",
+      }),
+    );
+    const getSkillArtifact = vi.fn().mockResolvedValue({ artifact });
+
+    const { platformDir, client, resolveAgain } = await resolveWithMockClient(
+      [makeRef("tampered-skill")],
+      { getSkillByReference, getSkillArtifact },
+    );
+
+    try {
+      const skillDir = join(platformDir, "skills", "tampered-skill");
+      writeFileSync(join(skillDir, ".stigmer-mount.json"), "not json {");
+
+      await resolveAgain();
+      expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+      expect(readFileSync(join(skillDir, "references", "guide.md"), "utf-8")).toBe("guide");
+    } finally {
+      cleanupPlatformDir(platformDir);
+    }
+  });
+
   it("SKILL.md from spec takes precedence over ZIP copy", async () => {
     const specContent = "# Authoritative SKILL.md from spec";
     const zipContent = "# Stale SKILL.md from ZIP";

package/src/activities/execute-cursor/capture-flow.ts

@@ -112,10 +112,11 @@ export function captureBaselineToLedger(opts: {
  * bytes withheld from durable storage.
  *
  * `deniedTokens` are the identities the hook gated this turn (shell/MCP, or a
- * gitignored delete). A streamed file-edit row whose identity is in that set is
- * left for the deny-gate reconcile path — it did NOT flow. A flowed gitignored
- * write is NOT in that set (the hook allowed it), so it is stamped like any
- * other flowed edit and its captured delta surfaces as a CAS entry in the set.
+ * secret-like delete — non-secret CAS deletes flow since issue #303). A streamed
+ * file-edit row whose identity is in that set is left for the deny-gate
+ * reconcile path — it did NOT flow. A flowed gitignored write or delete is NOT
+ * in that set (the hook allowed it), so it is stamped like any other flowed
+ * edit and its captured delta surfaces as a CAS entry in the set.
  *
  * `hitlDir`/`storage` are omitted only by callers with no artifact storage
  * (captureIgnored off); the CAS half is then skipped and this is a git-only