@stigmer/runner 3.12.4 → 3.12.5

package/src/activities/execute-deep-agent/setup.ts

@@ -32,6 +32,7 @@ import {
   resolveCallerIdentity,
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
+import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
@@ -88,12 +89,9 @@ import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
 import {
   mergeSkillRefs,
   fetchSkillsByRefs,
-  writeSkills,
-  computeSkillPaths,
-  checkSkillIntegrity,
+  mountSkills,
   generatePromptSection,
   generateAlsoAvailableSection,
-  fetchSkillArtifacts,
 } from "../../shared/skill-writer.js";
 import { filterSkills, SKILL_COUNT_THRESHOLD } from "../../shared/skill-relevance.js";
 import { injectAttachments } from "./attachment-injector.js";
@@ -478,8 +476,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       const skills = await fetchSkillsByRefs(client, skillRefs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(client, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // platformDir is an invariant of this path: provisionWorkspace below
+        // threads ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          client, skills, workspaceBackend.platformDir!,
+        );
 
         const userMessage = execution.spec!.message || "";
         const skillNames = skills.map(s => s.spec?.name || s.metadata?.slug || "unknown");
@@ -573,6 +574,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       contextBridge: readContextBridge(session.spec!.metadata),
       senderIdentity: readSenderIdentity(session.spec!.metadata),
       sessionContext: readSessionContext(session.spec!.metadata),
+      declaredPreferences: readDeclaredPreferences(
+        execution.spec!.declaredPreferences,
+      ),
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -606,16 +610,13 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     const execConfig = execution.spec!.executionConfig;
     const isPlanMode = execConfig?.interactionMode === InteractionMode.PLAN;
     const shellEnv = isPlanMode ? undefined : buildShellEnv(envResult.mergedEnvVars);
-    // Plan mode's filesystem permission rules, hoisted once: the parent graph,
-    // every sub-agent graph, AND the path-normalization middleware (issue #429)
-    // all derive from this single value, so a rule-bearing graph can never miss
-    // the shim that keeps prompt-compliant relative paths from dying in rule
-    // validation (`path must be absolute`). Built from the same rootDir the
-    // backends and the shim resolve against, so the workspace read boundary
-    // (issue #528) and the paths it must admit agree by construction.
-    const planModePermissions = isPlanMode
-      ? buildPlanModePermissions(workspaceBackend.rootDir)
-      : undefined;
+    // Plan mode's filesystem permission rules, hoisted once: the parent graph
+    // and every sub-agent graph carry this single value. The rules are the
+    // write-deny half of plan mode only — the read boundary is structural
+    // (virtual-rooted backends, issue #754), and the path-normalization shim
+    // is no longer tied to the rules: every native graph installs it (see
+    // buildMiddlewareStack below) so the whole harness speaks one dialect.
+    const planModePermissions = isPlanMode ? buildPlanModePermissions() : undefined;
 
     const toolServerMap = new Map<string, string>();
     if (mcpConnection) {
@@ -729,9 +730,10 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       } : null,
       otelSpans: { toolServerMap },
       approvalGate: approvalGateConfig,
-      pathNormalization: planModePermissions
-        ? { rootDir: workspaceBackend.rootDir }
-        : null,
+      // Every graph, every mode (issue #754): the dialect-repair seam that
+      // keeps model-supplied paths canonical for the virtual-rooted backend
+      // and every downstream consumer (gate, capture, spans).
+      pathNormalization: { rootDir: workspaceBackend.rootDir },
     });
     timing.mark("build_middleware");
 

package/src/activities/execute-deep-agent/subagent-transformer.ts

@@ -42,8 +42,7 @@ import { SubAgentGate } from "../../shared/subagent-gate.js";
 import { isModelRegistered } from "../../shared/model-registry.js";
 import {
   fetchSkillsByRefs,
-  fetchSkillArtifacts,
-  writeSkills,
+  mountSkills,
   generatePromptSection,
 } from "../../shared/skill-writer.js";
 
@@ -493,6 +492,10 @@ export function resolveSubagentSkillPrompt(
  *   (approval-gated by the sub-agent's own middleware). Absent (plan mode),
  *   the backend is filesystem-only — read-only by construction, matching the
  *   parent.
+ *
+ * Every variant is virtual-rooted (`virtualMode: true`) like the parent's —
+ * see the cas-capture-backend.ts header (issue #754): workspace confinement
+ * is structural on every graph, sub-agents included.
  */
 async function buildSubagentBackend(opts: {
   readonly workspaceRootDir: string;
@@ -508,11 +511,12 @@ async function buildSubagentBackend(opts: {
   }
 
   if (opts.shellEnv === undefined) {
-    return new FilesystemBackend({ rootDir: opts.workspaceRootDir });
+    return new FilesystemBackend({ rootDir: opts.workspaceRootDir, virtualMode: true });
   }
 
   const shellBackend = new LocalShellBackend({
     rootDir: opts.workspaceRootDir,
+    virtualMode: true,
     env: opts.shellEnv,
   });
   await shellBackend.initialize();
@@ -554,17 +558,14 @@ export async function compileSubagents(
       // Structural coupling (DD-19): a sub-agent gate flows gitignored writes into
       // CAS iff a CAS observer backs that sub-agent's filesystem backend. Deriving
       // both from the same `casObserver` makes "unobserved unreviewable bytes"
-      // impossible by construction. Same idiom for path normalization
-      // (issue #429): derived from the same `permissions` baked into the graph
-      // below, so a rule-bearing graph always carries the shim that keeps
-      // prompt-compliant relative paths from dying in rule validation.
+      // impossible by construction. Path normalization is unconditional
+      // (issue #754): every graph speaks the virtual dialect, so every graph
+      // carries the repair seam — matching the parent's composition.
       const middleware = buildSubAgentMiddleware({
         costCap: opts.costCap,
         approvalGate: opts.approvalGate,
         captureIgnored: !!opts.casObserver,
-        ...(opts.permissions?.length
-          ? { pathNormalization: { rootDir: opts.workspaceRootDir } }
-          : {}),
+        pathNormalization: { rootDir: opts.workspaceRootDir },
       });
 
       const modelName = spec.model ?? opts.parentModelName;
@@ -679,8 +680,14 @@ export async function transformAndCompileSubagents(
       const skills = await fetchSkillsByRefs(skillClient, refs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(skillClient, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // Runs after the parent's setup step 7b mounted its skills, so any
+        // skill shared by parent and sub-agent is a cache hit here — the
+        // hash-keyed marker turns the old double download into a no-op.
+        // platformDir is an invariant: provisionWorkspace threads
+        // ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          skillClient, skills, workspaceBackend.platformDir!,
+        );
 
         for (const skill of skills) {
           const slug = (skill as { metadata?: { slug?: string } }).metadata?.slug;

package/src/activities/execute-deep-agent/subagent-wiring.ts

@@ -75,9 +75,9 @@ export interface SubAgentMiddlewareOptions {
    */
   readonly captureIgnored?: boolean;
   /**
-   * Workspace-relative path normalization (issue #429). Present iff this
-   * sub-agent's graph carries filesystem permission rules — the caller
-   * derives it from the same `permissions` value it bakes into the graph.
+   * Virtual-dialect path normalization (issues #429/#754). Present on every
+   * sub-agent graph — the backends are virtual-rooted, so every graph
+   * carries the repair seam, matching the parent composition.
    */
   readonly pathNormalization?: PathNormalizationConfig;
 }

package/src/index.ts

@@ -14,7 +14,7 @@
  * import { createStigmerRunner } from '@stigmer/runner';
  *
  * const runner = await createStigmerRunner({
- *   taskQueue: 'agent_execution_runner',
+ *   taskQueue: 'stigmer_runner',
  *   temporalAddress: 'localhost:7233',
  *   stigmerEndpoint: 'http://localhost:7234',
  * });

package/src/middleware/__tests__/path-normalization.test.ts

@@ -35,36 +35,47 @@ async function argsSeenByHandler(
 }
 
 describe("normalizeWorkspacePathArg", () => {
-  it("maps a workspace-relative path to its rootDir-joined absolute form", () => {
-    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe(`${ROOT}/src/main.py`);
+  it("maps a workspace-relative path to its virtual-absolute form", () => {
+    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe("/src/main.py");
   });
 
-  it("strips a leading ./ before joining", () => {
-    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+  it("strips a leading ./ before rooting", () => {
+    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe("/notes.md");
   });
 
   it("handles multi-workspace entry-relative paths", () => {
     expect(normalizeWorkspacePathArg("entry-1/src/main.py", ROOT)).toBe(
-      `${ROOT}/entry-1/src/main.py`,
+      "/entry-1/src/main.py",
     );
   });
 
   it("resolves interior .. segments that stay inside the root", () => {
-    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe("/notes.md");
+    // Same repair on an already-virtual path: the virtual resolver rejects
+    // `..` outright, so the safe interior collapse happens at this seam.
+    expect(normalizeWorkspacePathArg("/src/../notes.md", ROOT)).toBe("/notes.md");
   });
 
-  it("leaves absolute paths untouched", () => {
+  it("maps a REAL-absolute in-root path to its virtual form (legacy-dialect compatibility)", () => {
+    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBe("/src/main.py");
+    // The root itself is the virtual root.
+    expect(normalizeWorkspacePathArg(ROOT, ROOT)).toBe("/");
+  });
+
+  it("leaves canonical virtual-absolute paths untouched", () => {
+    // In the virtual dialect these are already canonical names — "/etc/hosts"
+    // means the WORKSPACE's etc/hosts, not the host file.
     expect(normalizeWorkspacePathArg("/etc/hosts", ROOT)).toBeUndefined();
-    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("/", ROOT)).toBeUndefined();
   });
 
   it("refuses to rewrite relatives that escape the workspace root", () => {
-    // A naive join would resolve `..` away and hand upstream validation a
-    // clean out-of-root absolute path — an out-of-root read that today's
-    // validation refuses. The guard keeps the refusal.
+    // posix.normalize would silently swallow a leading ".." on an absolute
+    // path — rewriting the call onto a DIFFERENT in-root file. The escape is
+    // detected in relative form and left raw for the upstream refusal.
     expect(normalizeWorkspacePathArg("../sibling/secret.txt", ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("src/../../escape.txt", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("/src/../../escape.txt", ROOT)).toBeUndefined();
   });
 
   it("leaves ~-carrying paths untouched (upstream refuses them either way)", () => {
@@ -84,7 +95,7 @@ describe("createPathNormalizationMiddleware", () => {
         file_path: "src/main.py",
         content: "x",
       });
-      expect(args.file_path).toBe(`${ROOT}/src/main.py`);
+      expect(args.file_path).toBe("/src/main.py");
       // Sibling args ride along untouched.
       expect(args.content).toBe("x");
     }
@@ -93,27 +104,26 @@ describe("createPathNormalizationMiddleware", () => {
   it("rewrites the base path on ls/glob/grep", async () => {
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { path: "src", pattern: "**/*.py" });
-      expect(args.path).toBe(`${ROOT}/src`);
+      expect(args.path).toBe("/src");
       // The pattern is never a path — byte-untouched.
       expect(args.pattern).toBe("**/*.py");
     }
   });
 
-  it("passes absolute paths through byte-untouched", async () => {
+  it("passes canonical virtual paths through byte-untouched", async () => {
     const args = await argsSeenByHandler("read_file", { file_path: "/etc/hosts" });
     expect(args.file_path).toBe("/etc/hosts");
   });
 
-  it("supplies the workspace root when the base path is omitted on ls/glob/grep", async () => {
-    // Deliberate reversal of the original #429 pin ("leaves an omitted base
-    // path alone"): the tools' schema default is "/" — the OS ROOT under the
-    // legacy backend — applied inside the tool AFTER this seam, so under the
-    // #528 workspace read boundary an untouched omission would deny the bare
-    // first listing. The middleware fills the omission with the root it
-    // already knows.
+  it("leaves an omitted base path alone — the tools' '/' default IS the workspace root now", async () => {
+    // Deliberate reversal of the #528 injection: under the legacy backend the
+    // schema default "/" meant the OS ROOT, so the middleware had to fill the
+    // omission. Under the virtual root (issue #754) the default already means
+    // the workspace root — filling it would just duplicate the tool's own
+    // behavior.
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { pattern: "TOKEN" });
-      expect(args.path).toBe(ROOT);
+      expect(args.path).toBeUndefined();
       expect(args.pattern).toBe("TOKEN");
     }
   });
@@ -125,16 +135,6 @@ describe("createPathNormalizationMiddleware", () => {
     expect(args.file_path).toBeUndefined();
   });
 
-  it("leaves an explicit '/' untouched on the dir tools — the rules answer it honestly", async () => {
-    // The model asked for the OS root; under plan mode's read boundary the
-    // honest answer is the rules' denial, not silently substituted workspace
-    // contents (the #429 never-convert-a-refusal-into-an-allowance doctrine).
-    for (const tool of ["ls", "glob", "grep"]) {
-      const args = await argsSeenByHandler(tool, { path: "/" });
-      expect(args.path).toBe("/");
-    }
-  });
-
   it("never touches tools outside the built-in filesystem set", async () => {
     // An MCP tool could plausibly carry a same-named arg with different
     // semantics; only the six built-in names are rewritten.

package/src/middleware/path-normalization.ts

@@ -1,55 +1,49 @@
 /**
- * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issues #429, #528).
+ * Canonical virtual-path normalization for the native harness's built-in
+ * filesystem tools (issues #429, #528, #754).
  *
- * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
- * rule or backend runs, and its validation refuses non-absolute paths — on
- * EVERY filesystem tool call once a graph carries any permission rules, reads
- * included. Plan mode is the only rule-bearing production configuration
- * (shared/plan-mode-permissions.ts), so there a workspace-relative path —
- * the shape the multi-workspace prompt explicitly mandates, and one models
- * routinely choose in single-workspace sessions — fails with
- * `path must be absolute` instead of just working, burning tool rounds until
- * the model adapts by switching to absolute paths.
+ * The native harness speaks ONE path dialect end to end: the VIRTUAL ROOT,
+ * where "/" denotes the workspace root (backends are constructed with
+ * `virtualMode: true` — see execute-deep-agent/cas-capture-backend.ts). This
+ * middleware is the dialect-repair seam at the model boundary. It rewrites,
+ * on the deepagents built-in filesystem tools only:
  *
- * This middleware repairs the contract at our own seam: it rewrites
- * workspace-relative paths on the deepagents built-in filesystem tools to
- * workspace-absolute before the tool (and therefore enforcement) runs. The
- * write-deny rule then fires as designed and reads succeed on the first try.
- * Rule-less (act-mode) graphs never install it — the legacy backend already
- * resolves relative paths under the workspace root, so act mode keeps a
- * byte-zero delta.
+ *  - workspace-relative paths ("src/x.py", "./notes.md") to their virtual
+ *    absolute form ("/src/x.py") — deepagents' permission validation refuses
+ *    non-absolute shapes on rule-bearing graphs (plan mode), and the prompt
+ *    explicitly mandates entry-relative paths, so without this seam a
+ *    prompt-compliant call would die with `path must be absolute`;
+ *  - REAL-absolute paths under the workspace root ("{root}/src/x.py") to
+ *    their virtual form ("/src/x.py") — the compatibility mapping for the
+ *    pre-#754 dialect, where tool results and transcripts surfaced real
+ *    filesystem paths that a model may still echo back;
+ *  - interior `..` segments that stay inside the root ("src/../notes.md" →
+ *    "/notes.md") — the virtual resolver rejects `..` outright, so a safe
+ *    interior collapse is repaired here rather than burning a tool round.
  *
- * It also supplies the workspace root when `ls`/`glob`/`grep` are called
- * with NO path argument (issue #528). Those tools' schema default is "/" —
- * the OS ROOT under the legacy backend — and the default is applied inside
- * the tool, after this seam, so under the workspace read boundary a bare
- * first `ls` would otherwise die with `permission denied for read on /`
- * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
- * deliberately NOT rewritten: the model asked for the OS root, and the
- * honest answer under plan mode's read boundary is the rules' denial —
- * silently substituting workspace contents would be an answer to a
- * different question.
+ * Nothing becomes newly reachable: escaping relatives ("../x") and
+ * `~`-carrying paths are left raw so the upstream refusal keeps speaking,
+ * and every rewritten path is workspace-confined by the virtual resolver
+ * regardless. The middleware converts false errors into correct behavior —
+ * never a refusal into an allowance.
  *
- * Invariant — nothing becomes newly reachable: only paths whose resolution
- * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
- * and `~`-carrying paths are left raw so today's validation refusal keeps
- * speaking (a naive join would resolve `..` away and smuggle an out-of-root
- * read past validation), and absolute paths pass through byte-untouched.
- * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide. (The absent-path
- * injection honors the same line: it narrows the tool's own OS-root default
- * to the workspace, granting nothing the rules would refuse.)
+ * Installed on EVERY native graph (parent and sub-agent, act and plan mode)
+ * so all downstream consumers — the approval gate's capturability checks,
+ * the CAS observer, otel spans — observe one canonical dialect. The pre-#754
+ * version was installed only beside permission rules and also injected the
+ * workspace root when `ls`/`glob`/`grep` omitted their path (the tools'
+ * schema default "/" was the OS ROOT under the legacy backend); under the
+ * virtual root that default already MEANS the workspace root, so the
+ * injection is retired.
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
  * rewrite touches only the tool's path-bearing argument, never glob/grep
  * patterns. Install FIRST in the stack so every downstream middleware
- * (approval gate, error hints, otel spans) observes canonical paths.
+ * observes canonical paths.
  */
 
-import { isAbsolute, relative } from "node:path";
-import { resolveWorkspacePath } from "../shared/file-change.js";
+import { isAbsolute, relative, posix } from "node:path";
 import type { StigmerMiddleware } from "./types.js";
 
 /**
@@ -66,55 +60,65 @@ const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["edit_file", "file_path"],
 ]);
 
-/**
- * The tools whose path argument is optional with an OS-root ("/") schema
- * default. When the model omits it, this middleware supplies the workspace
- * root instead (issue #528). The file tools are deliberately excluded: an
- * absent `file_path` is a genuine model error, and the tool's own input
- * validation gives the better message.
- */
-const DIR_DEFAULTING_TOOLS: ReadonlySet<string> = new Set(["ls", "glob", "grep"]);
-
 export interface PathNormalizationConfig {
-  /** The workspace root the graph's filesystem backend resolves against. */
+  /**
+   * The REAL workspace root the graph's backend is rooted at — used only for
+   * the legacy-dialect compatibility mapping (real-absolute in-root paths →
+   * virtual). The virtual rewrite itself needs no root.
+   */
   readonly rootDir: string;
 }
 
 /**
- * Rewrite `raw` to its workspace-absolute form, or return undefined when the
- * value must be left untouched (absolute already, `~`-carrying, or escaping
- * the workspace root). Exported for direct unit testing of the mapping table.
+ * Rewrite `raw` to its canonical virtual-absolute form, or return undefined
+ * when the value must be left untouched. Exported for direct unit testing of
+ * the mapping table.
+ *
+ * Left raw (undefined): empty strings, `~`-carrying paths (refused upstream
+ * in every mode), escaping relatives ("../x" — the refusal is the honest
+ * answer), real-absolute paths OUTSIDE the root (virtual dialect: they name
+ * an in-workspace path that simply does not exist — resolution answers
+ * honestly), and paths already in canonical virtual form.
  */
 export function normalizeWorkspacePathArg(
   raw: string,
   rootDir: string,
 ): string | undefined {
-  if (raw.length === 0 || isAbsolute(raw)) return undefined;
-  // Upstream validation refuses `~` segments even in absolute paths, so a
-  // rewrite could not make such a call succeed — leave the raw shape (and
-  // therefore the honest refusal) intact.
+  if (raw.length === 0) return undefined;
+  // Upstream validation refuses `~` segments in every position, and a rewrite
+  // could not make such a call succeed — leave the honest refusal intact.
   if (raw.split("/").includes("~")) return undefined;
 
-  const { absolutePath } = resolveWorkspacePath(raw, rootDir, false);
-
-  // No-new-reachability guard: `join` inside the resolver normalizes `..`
-  // segments away, so an escaping relative would otherwise pass upstream
-  // validation as a clean out-of-root absolute path. Today that shape is
-  // refused; keep it that way.
-  const rel = relative(rootDir, absolutePath);
-  if (rel.startsWith("..") || isAbsolute(rel)) return undefined;
-
-  return absolutePath;
+  // Legacy-dialect compatibility: a REAL absolute path under the workspace
+  // root maps to its virtual form. Any other absolute path is already a
+  // virtual-dialect name — reduced to relative form for canonicalization.
+  let candidate: string;
+  if (isAbsolute(raw)) {
+    const rel = relative(rootDir, raw);
+    if (rel === "") return "/";
+    candidate =
+      rel && !rel.startsWith("..") && !isAbsolute(rel)
+        ? rel
+        : raw.replace(/^\/+/, "");
+  } else {
+    candidate = raw;
+  }
+
+  // Canonicalize in RELATIVE form first: posix.normalize keeps a leading
+  // ".." on relative paths but silently swallows it on absolute ones, and a
+  // swallowed escape would rewrite the call onto a DIFFERENT in-root path —
+  // a refusal converted into an allowance. Detect the escape while it is
+  // still visible, and leave it raw for the upstream refusal.
+  const normalizedRel = posix.normalize(candidate);
+  if (normalizedRel === ".." || normalizedRel.startsWith("../")) return undefined;
+
+  const virtual = normalizedRel === "." ? "/" : `/${normalizedRel}`;
+  return virtual === raw ? undefined : virtual;
 }
 
 /**
- * Create middleware that normalizes workspace-relative paths on the built-in
- * filesystem tools before permission enforcement sees them.
- *
- * Installed only on graphs that carry filesystem permission rules — derive
- * the install condition from the same expression that supplies the rules
- * (setup.ts / compileSubagents) so the rules and their normalization shim
- * cannot drift apart.
+ * Create the dialect-repair middleware (see module header). Stateless per
+ * request; safe on every graph.
  */
 export function createPathNormalizationMiddleware(
   config: PathNormalizationConfig,
@@ -129,22 +133,6 @@ export function createPathNormalizationMiddleware(
       if (!argKey) return handler(request);
 
       const raw = request.toolCall.args[argKey];
-
-      // Absent base directory on ls/glob/grep: the middleware sees the
-      // model's raw args, BEFORE the tool's zod parse applies the "/"
-      // (OS root) schema default — so the omission must be filled here,
-      // where the workspace root is known. An explicit "/" is not this
-      // case and flows through to an honest rule denial (header doctrine).
-      if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
-        return handler({
-          ...request,
-          toolCall: {
-            ...request.toolCall,
-            args: { ...request.toolCall.args, [argKey]: rootDir },
-          },
-        });
-      }
-
       if (typeof raw !== "string") return handler(request);
 
       const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/src/middleware/types.ts

@@ -117,9 +117,9 @@ export interface MiddlewareStackConfig {
   readonly otelSpans?: Partial<OtelSpansConfig>;
   readonly approvalGate?: ApprovalGateConfig | null;
   /**
-   * Workspace-relative path normalization (issue #429). Set iff the graph
-   * carries filesystem permission rules — derive from the same expression
-   * that supplies the rules so the two cannot drift apart.
+   * Virtual-dialect path normalization (issues #429/#754). Set on every
+   * native graph: the backends are virtual-rooted, so every graph carries
+   * the repair seam that keeps model-supplied paths canonical.
    */
   readonly pathNormalization?: PathNormalizationConfig | null;
 }

package/src/runner-manager.ts

@@ -49,6 +49,10 @@ import {
   setQueueDrainCallback,
   forgetQueue,
 } from "./in-flight.js";
+import {
+  registerWorkerShutdownSignal,
+  unregisterWorkerShutdownSignal,
+} from "./shared/worker-shutdown.js";
 
 const SESSION_QUEUE_PREFIX = "session:";
 const WFEXEC_QUEUE_PREFIX = "wfexec:";
@@ -57,16 +61,10 @@ const WFEXEC_QUEUE_PREFIX = "wfexec:";
 // Mirrors SessionDispatchService's convention: lowercase kind, colon, id.
 const POOL_CONTROL_QUEUE_PREFIX = "sandbox:";
 
-/**
- * Module-level registry of shutdown signals per task queue.
- * Activities running in the same process can read this to determine
- * whether their worker is being shut down (vs orchestrator pause).
- */
-const _shutdownSignalRegistry = new Map<string, AbortSignal>();
-
-export function getShutdownSignalForQueue(taskQueue: string): AbortSignal | undefined {
-  return _shutdownSignalRegistry.get(taskQueue);
-}
+// Re-export for existing importers; the registry itself lives in
+// shared/worker-shutdown.ts so the static runner (runner.ts) and the
+// activities can share it without importing this manager module.
+export { getShutdownSignalForQueue } from "./shared/worker-shutdown.js";
 
 export interface RunnerManagerOptions {
   /**
@@ -411,15 +409,12 @@ export async function createStigmerRunnerManager(
 
   const sessions = new Map<string, ManagedSession>();
   const workflowExecutions = new Map<string, ManagedSession>();
-  const shutdownSignals = new Map<string, AbortController>();
   // At most one per process: a pool member IS its control worker's identity.
   let poolControl: { taskQueue: string; managed: ManagedSession } | null = null;
   let shuttingDown = false;
 
   async function createWorkerOnQueue(taskQueue: string): Promise<ManagedSession> {
-    const shutdownController = new AbortController();
-    shutdownSignals.set(taskQueue, shutdownController);
-    _shutdownSignalRegistry.set(taskQueue, shutdownController.signal);
+    const shutdownController = registerWorkerShutdownSignal(taskQueue);
 
     const worker = await Worker.create({
       connection,
@@ -481,8 +476,7 @@ export async function createStigmerRunnerManager(
     managed.worker.shutdown();
     await managed.runPromise;
     registry.delete(id);
-    shutdownSignals.delete(taskQueue);
-    _shutdownSignalRegistry.delete(taskQueue);
+    unregisterWorkerShutdownSignal(taskQueue);
     forgetQueue(taskQueue);
     console.log(`[runner-manager] Removed ${kind} ${id} (active=${registry.size})`);
   }
@@ -620,6 +614,22 @@ export async function createStigmerRunnerManager(
         `[runner-manager] Shutting down ${totalWorkers} workers (${sessions.size} sessions, ${workflowExecutions.size} workflow executions)...`,
       );
 
+      // Mark every queue's shutdown signal BEFORE draining, so an in-flight
+      // activity cancelled by the drain classifies it as a worker shutdown
+      // rather than a user pause (issue #776 — a SIGTERM'd pool member used
+      // to persist EXECUTION_PAUSED and let raw Temporal drain text reach
+      // status.error). Aborting is classification-only: it stops nothing;
+      // worker.shutdown() below still owns the drain. This is deliberately
+      // NOT done in teardownManaged — single-worker teardowns only run once
+      // the queue is idle, and aborting there is the old view-close bug.
+      for (const session of sessions.values()) {
+        session.shutdownController.abort();
+      }
+      for (const execution of workflowExecutions.values()) {
+        execution.shutdownController.abort();
+      }
+      poolControl?.managed.shutdownController.abort();
+
       const shutdownPromises = [
         ...Array.from(sessions.entries()).map(
           async ([id, session]) => {