@stigmer/runner 3.12.4 → 3.12.5

package/src/shared/__tests__/skill-writer.test.ts

@@ -1,17 +1,18 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { ConnectError, Code } from "@connectrpc/connect";
 import {
   mergeSkillRefs,
   fetchSkillsByRefs,
-  writeSkills,
-  computeSkillPaths,
-  checkSkillIntegrity,
+  mountSkills,
   generatePromptSection,
   generateAlsoAvailableSection,
-  fetchSkillArtifacts,
 } from "../skill-writer.js";
 import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
-import type { WorkspaceBackend } from "../workspace/types.js";
+import { buildZip } from "../../__test-utils__/zip-fixtures.js";
 
 // ─── Helpers ─────────────────────────────────────────────────────────────
 
@@ -19,16 +20,18 @@ function makeSkill(overrides: {
   id?: string;
   name?: string;
   slug?: string;
+  org?: string;
   description?: string;
   skillMd?: string;
   artifactStorageKey?: string;
+  versionHash?: string;
 } = {}): Skill {
   return {
     metadata: {
       id: overrides.id ?? "skill-id-1",
       name: overrides.name ?? overrides.slug ?? "test-skill",
       slug: overrides.slug ?? "test-skill",
-      org: "test-org",
+      org: overrides.org ?? "test-org",
     },
     spec: {
       name: overrides.name ?? "test-skill",
@@ -38,7 +41,7 @@ function makeSkill(overrides: {
     },
     status: {
       artifactStorageKey: overrides.artifactStorageKey ?? "",
-      versionHash: "abc123",
+      versionHash: overrides.versionHash ?? "abc123",
       state: "active",
     },
   } as any;
@@ -48,48 +51,21 @@ function makeRef(slug: string, org = "test-org"): ApiResourceReference {
   return { slug, org, kind: 43 } as any;
 }
 
+/** A server that predates the transfer lane (#675) answers the mint RPC
+ * with UNIMPLEMENTED, pinning these tests to the unary fallback. */
 function makeMockClient(overrides: Record<string, unknown> = {}) {
   return {
     getSkillByReference: vi.fn().mockImplementation((ref: any) =>
       Promise.resolve(makeSkill({ slug: ref.slug, name: ref.slug })),
     ),
     getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
+    getSkillArtifactDownloadUrl: vi.fn().mockRejectedValue(
+      new ConnectError("unimplemented", Code.Unimplemented),
+    ),
     ...overrides,
   } as any;
 }
 
-function makeMockBackend(): WorkspaceBackend & {
-  writtenFiles: Map<string, string>;
-  executedCommands: string[];
-  existingFiles: Set<string>;
-} {
-  const writtenFiles = new Map<string, string>();
-  const executedCommands: string[] = [];
-  const existingFiles = new Set<string>();
-  return {
-    rootDir: "/workspace",
-    writtenFiles,
-    executedCommands,
-    existingFiles,
-    async writeFile(path: string, content: string) {
-      writtenFiles.set(path, content);
-    },
-    async writeFileBuffer(path: string, content: Buffer) {
-      writtenFiles.set(path, content.toString("utf-8"));
-    },
-    async readFile(path: string) {
-      return writtenFiles.get(path) ?? "";
-    },
-    async exists(path: string) {
-      return writtenFiles.has(path) || existingFiles.has(path);
-    },
-    async execute(command: string) {
-      executedCommands.push(command);
-      return "";
-    },
-  };
-}
-
 // ─── mergeSkillRefs ──────────────────────────────────────────────────────
 
 describe("mergeSkillRefs", () => {
@@ -151,86 +127,171 @@ describe("fetchSkillsByRefs", () => {
   });
 });
 
-// ─── writeSkills ─────────────────────────────────────────────────────────
+// ─── mountSkills ─────────────────────────────────────────────────────────
+
+describe("mountSkills", () => {
+  let platformDir: string;
+
+  beforeEach(() => {
+    platformDir = mkdtempSync(join(tmpdir(), "skill-writer-platform-"));
+  });
 
-describe("writeSkills", () => {
-  it("writes SKILL.md from spec when no artifact", async () => {
-    const backend = makeMockBackend();
+  afterEach(() => {
+    rmSync(platformDir, { recursive: true, force: true });
+  });
+
+  it("writes SKILL.md and returns agent-visible paths keyed by skill id", async () => {
+    const client = makeMockClient();
     const skills = [makeSkill({ name: "calculator", skillMd: "# Calculator\n\nAdds numbers." })];
-    const result = await writeSkills(skills, backend, new Map());
+    const result = await mountSkills(client, skills, platformDir);
 
     expect(result.paths.get("skill-id-1")).toBe(".stigmer/skills/calculator");
-    expect(backend.writtenFiles.has(".stigmer/skills/calculator/SKILL.md")).toBe(true);
-    expect(backend.writtenFiles.get(".stigmer/skills/calculator/SKILL.md"))
+    expect(readFileSync(join(platformDir, "skills", "calculator", "SKILL.md"), "utf-8"))
       .toBe("# Calculator\n\nAdds numbers.");
   });
 
-  it("runs chmod on script extensions", async () => {
-    const backend = makeMockBackend();
-    const skills = [makeSkill({ name: "runner" })];
-    await writeSkills(skills, backend, new Map());
-    expect(backend.executedCommands.length).toBeGreaterThan(0);
-    expect(backend.executedCommands[0]).toContain("chmod");
+  it("extracts artifact files alongside SKILL.md", async () => {
+    const artifact = buildZip([
+      { name: "SKILL.md", content: "# Stale zip copy" },
+      { name: "references/schema.md", content: "schema" },
+    ]);
+    const client = makeMockClient({
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact }),
+    });
+    const skills = [makeSkill({
+      name: "db-skill",
+      skillMd: "# Authoritative",
+      artifactStorageKey: "artifacts/db.zip",
+    })];
+    await mountSkills(client, skills, platformDir);
+
+    const skillDir = join(platformDir, "skills", "db-skill");
+    expect(readFileSync(join(skillDir, "SKILL.md"), "utf-8")).toBe("# Authoritative");
+    expect(readFileSync(join(skillDir, "references", "schema.md"), "utf-8")).toBe("schema");
   });
 
   it("handles multiple skills", async () => {
-    const backend = makeMockBackend();
+    const client = makeMockClient();
     const skills = [
       makeSkill({ id: "id-1", name: "skill-a", skillMd: "# A" }),
       makeSkill({ id: "id-2", name: "skill-b", skillMd: "# B" }),
     ];
-    const result = await writeSkills(skills, backend, new Map());
+    const result = await mountSkills(client, skills, platformDir);
     expect(result.paths.size).toBe(2);
     expect(result.paths.get("id-1")).toBe(".stigmer/skills/skill-a");
     expect(result.paths.get("id-2")).toBe(".stigmer/skills/skill-b");
+    expect(existsSync(join(platformDir, "skills", "skill-a", "SKILL.md"))).toBe(true);
+    expect(existsSync(join(platformDir, "skills", "skill-b", "SKILL.md"))).toBe(true);
   });
 
-  it("skips write when skill has no skillMd and no artifact", async () => {
-    const backend = makeMockBackend();
-    const skills = [makeSkill({ skillMd: "" })];
-    (skills[0] as any).spec.skillMd = "";
-    await writeSkills(skills, backend, new Map());
-    expect(backend.writtenFiles.size).toBe(0);
-  });
-});
+  it("skips the artifact download when the mounted hash matches (cache hit)", async () => {
+    const artifact = buildZip([{ name: "references/guide.md", content: "guide" }]);
+    const client = makeMockClient({
+      getSkillArtifact: vi.fn().mockResolvedValue({ artifact }),
+    });
+    const skill = makeSkill({
+      name: "cached-skill",
+      artifactStorageKey: "artifacts/cached.zip",
+      versionHash: "hash-v1",
+    });
 
-// ─── computeSkillPaths ───────────────────────────────────────────────────
+    await mountSkills(client, [skill], platformDir);
+    expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
 
-describe("computeSkillPaths", () => {
-  it("computes paths without side effects", () => {
-    const skills = [
-      makeSkill({ id: "id-1", name: "calculator" }),
-      makeSkill({ id: "id-2", name: "web-scraper" }),
-    ];
-    const paths = computeSkillPaths(skills);
-    expect(paths.get("id-1")).toBe(".stigmer/skills/calculator");
-    expect(paths.get("id-2")).toBe(".stigmer/skills/web-scraper");
+    // Second execution of the same session: same hash, no transfer.
+    const second = await mountSkills(client, [skill], platformDir);
+    expect(client.getSkillArtifact).toHaveBeenCalledTimes(1);
+    expect(second.paths.get("skill-id-1")).toBe(".stigmer/skills/cached-skill");
+    expect(readFileSync(
+      join(platformDir, "skills", "cached-skill", "references", "guide.md"), "utf-8",
+    )).toBe("guide");
   });
 
-  it("returns empty map for empty skills", () => {
-    expect(computeSkillPaths([])).toEqual(new Map());
+  it("remounts on version change and clears stale files from the old mount", async () => {
+    const artifactV1 = buildZip([{ name: "references/removed-in-v2.md", content: "old" }]);
+    const artifactV2 = buildZip([{ name: "references/new-in-v2.md", content: "new" }]);
+    const client = makeMockClient({
+      getSkillArtifact: vi.fn()
+        .mockResolvedValueOnce({ artifact: artifactV1 })
+        .mockResolvedValueOnce({ artifact: artifactV2 }),
+    });
+
+    await mountSkills(client, [makeSkill({
+      name: "evolving-skill",
+      skillMd: "# V1",
+      artifactStorageKey: "artifacts/v1.zip",
+      versionHash: "hash-v1",
+    })], platformDir);
+
+    await mountSkills(client, [makeSkill({
+      name: "evolving-skill",
+      skillMd: "# V2",
+      artifactStorageKey: "artifacts/v2.zip",
+      versionHash: "hash-v2",
+    })], platformDir);
+
+    const skillDir = join(platformDir, "skills", "evolving-skill");
+    expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+    expect(readFileSync(join(skillDir, "SKILL.md"), "utf-8")).toBe("# V2");
+    expect(readFileSync(join(skillDir, "references", "new-in-v2.md"), "utf-8")).toBe("new");
+    // The v1-only file must not linger in the v2 mount (the stale-file leak).
+    expect(existsSync(join(skillDir, "references", "removed-in-v2.md"))).toBe(false);
   });
-});
 
-// ─── checkSkillIntegrity ─────────────────────────────────────────────────
+  it("does not cache a degraded SKILL.md-only mount — the next execution retries", async () => {
+    const artifact = buildZip([{ name: "references/late.md", content: "finally" }]);
+    const client = makeMockClient({
+      getSkillArtifact: vi.fn()
+        .mockRejectedValueOnce(new Error("Network timeout"))
+        .mockResolvedValueOnce({ artifact }),
+    });
+    const skill = makeSkill({
+      name: "retry-skill",
+      artifactStorageKey: "artifacts/retry.zip",
+      versionHash: "hash-v1",
+    });
 
-describe("checkSkillIntegrity", () => {
-  it("returns true when sentinel exists", async () => {
-    const backend = makeMockBackend();
-    backend.existingFiles.add(".stigmer/skills/calculator/SKILL.md");
-    const skills = [makeSkill({ id: "id-1", name: "calculator" })];
-    expect(await checkSkillIntegrity(skills, backend)).toBe(true);
+    // First pass degrades to SKILL.md only — never throws.
+    const first = await mountSkills(client, [skill], platformDir);
+    const skillDir = join(platformDir, "skills", "retry-skill");
+    expect(first.paths.get("skill-id-1")).toBe(".stigmer/skills/retry-skill");
+    expect(existsSync(join(skillDir, "SKILL.md"))).toBe(true);
+    expect(existsSync(join(skillDir, "references"))).toBe(false);
+
+    // Second pass retries and completes the mount.
+    await mountSkills(client, [skill], platformDir);
+    expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
+    expect(readFileSync(join(skillDir, "references", "late.md"), "utf-8")).toBe("finally");
+
+    // Third pass is a cache hit.
+    await mountSkills(client, [skill], platformDir);
+    expect(client.getSkillArtifact).toHaveBeenCalledTimes(2);
   });
 
-  it("returns false when sentinel is missing", async () => {
-    const backend = makeMockBackend();
-    const skills = [makeSkill({ id: "id-1", name: "calculator" })];
-    expect(await checkSkillIntegrity(skills, backend)).toBe(false);
+  it("mounts only the first claimant when two skills resolve to the same directory", async () => {
+    const client = makeMockClient();
+    const skills = [
+      makeSkill({ id: "id-1", org: "org-a", slug: "shared-a", name: "shared-name", skillMd: "# First" }),
+      makeSkill({ id: "id-2", org: "org-b", slug: "shared-b", name: "shared-name", skillMd: "# Second" }),
+    ];
+    const result = await mountSkills(client, skills, platformDir);
+
+    // Both ids resolve to the (single) directory; the first claimant's content wins.
+    expect(result.paths.get("id-1")).toBe(".stigmer/skills/shared-name");
+    expect(result.paths.get("id-2")).toBe(".stigmer/skills/shared-name");
+    expect(readFileSync(join(platformDir, "skills", "shared-name", "SKILL.md"), "utf-8"))
+      .toBe("# First");
   });
 
-  it("returns true for empty skills list", async () => {
-    const backend = makeMockBackend();
-    expect(await checkSkillIntegrity([], backend)).toBe(true);
+  it("skips skills with no skillMd content", async () => {
+    const client = makeMockClient();
+    const skill = makeSkill({ name: "broken", skillMd: "" });
+    (skill as any).spec.skillMd = "";
+    const result = await mountSkills(client, [skill], platformDir);
+
+    // The path entry exists (naming is total) but nothing was mounted.
+    expect(result.paths.get("skill-id-1")).toBe(".stigmer/skills/broken");
+    expect(existsSync(join(platformDir, "skills", "broken"))).toBe(false);
   });
 });
 
@@ -309,41 +370,3 @@ describe("generateAlsoAvailableSection", () => {
     expect(section).toContain("relevant to your task");
   });
 });
-
-// ─── fetchSkillArtifacts ─────────────────────────────────────────────────
-
-describe("fetchSkillArtifacts", () => {
-  it("returns empty map when no skills have artifacts", async () => {
-    const client = makeMockClient();
-    const skills = [makeSkill({ artifactStorageKey: "" })];
-    const result = await fetchSkillArtifacts(client, skills);
-    expect(result.size).toBe(0);
-    expect(client.getSkillArtifact).not.toHaveBeenCalled();
-  });
-
-  it("fetches artifacts for skills with storage keys", async () => {
-    const artifactData = new Uint8Array([80, 75, 3, 4]); // ZIP magic bytes
-    const client = makeMockClient({
-      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: artifactData }),
-    });
-    const skills = [makeSkill({ id: "id-1", artifactStorageKey: "artifacts/key.zip" })];
-    const result = await fetchSkillArtifacts(client, skills);
-    expect(result.size).toBe(1);
-    expect(result.get("id-1")).toEqual(artifactData);
-  });
-
-  it("handles partial failures gracefully", async () => {
-    const client = makeMockClient({
-      getSkillArtifact: vi.fn()
-        .mockResolvedValueOnce({ artifact: new Uint8Array([1, 2, 3]) })
-        .mockRejectedValueOnce(new Error("Network error")),
-    });
-    const skills = [
-      makeSkill({ id: "id-1", name: "good", artifactStorageKey: "key1" }),
-      makeSkill({ id: "id-2", name: "bad", artifactStorageKey: "key2" }),
-    ];
-    const result = await fetchSkillArtifacts(client, skills);
-    expect(result.size).toBe(1);
-    expect(result.has("id-1")).toBe(true);
-  });
-});

package/src/shared/__tests__/vertex-adapter.test.ts

@@ -123,9 +123,9 @@ describe("buildChatModel vertex adapter", () => {
     // default applies. That default prefix-matches the model string — and the
     // vertex branch hands ChatAnthropic the TRANSLATED string. This pins the
     // equality the zero-behavior-change criterion rests on (verified 16384 ==
-    // 16384 for 4.5-generation ids at @langchain/anthropic 1.4.0); a future
-    // bump that diverges the two forms fails here instead of silently capping
-    // vertex deployments differently from public ones.
+    // 16384 for 4.5-generation ids at @langchain/anthropic 1.4.0, re-verified
+    // at 1.5.5); a future bump that diverges the two forms fails here instead
+    // of silently capping vertex deployments differently from public ones.
     for (const canonical of [
       "claude-sonnet-4-5-20250929",
       "claude-haiku-4-5-20251001",
@@ -137,6 +137,33 @@ describe("buildChatModel vertex adapter", () => {
     }
   });
 
+  it("model.profile goes empty exactly when translation rewrites the id", () => {
+    // ChatAnthropic.profile resolves per model name, and — unlike the
+    // maxTokens default above — its lookup does NOT prefix-match: a dated
+    // id rewritten to Vertex's `@` form resolves {} (verified at
+    // @langchain/anthropic 1.4.0 and again at 1.5.5), while undated ids
+    // pass through toVertexModelId unchanged and keep their full profile.
+    // Nothing in the runner consumes profile directly, but deepagents'
+    // SummarizationMiddleware reads profile.maxInputTokens when present, so
+    // vertex deployments pinned to DATED ids summarize on its fallback
+    // budget rather than the model's real window. This pins both halves of
+    // that contract: if a bump starts resolving `@`-form ids (a welcome
+    // improvement — those deployments' summarization budgets would change),
+    // or stops resolving canonical ids, this fails and the behavior gets
+    // re-decided consciously instead of shifting silently.
+    for (const dated of ["claude-sonnet-4-5-20250929", "claude-haiku-4-5-20251001"]) {
+      const publicModel = new ChatAnthropic({ model: dated, apiKey: "probe" });
+      const vertexModel = new ChatAnthropic({ model: toVertexModelId(dated), apiKey: "probe" });
+      expect(publicModel.profile.maxInputTokens, dated).toBeGreaterThan(0);
+      expect(vertexModel.profile, dated).toEqual({});
+    }
+    const undated = "claude-sonnet-4-6";
+    expect(toVertexModelId(undated)).toBe(undated);
+    expect(
+      new ChatAnthropic({ model: undated, apiKey: "probe" }).profile.maxInputTokens,
+    ).toBeGreaterThan(0);
+  });
+
   it("forwards the request timeout to the SDK client (STIGMER_LLM_REQUEST_TIMEOUT_MS path)", async () => {
     // The timeout rides clientOptions -> factory options -> SDK constructor.
     // A factory that drops it silently unbounds the operator's timeout on

package/src/shared/__tests__/vertex-seam.test.ts

@@ -4,13 +4,13 @@
  *
  * This is NOT a unit test of our code (there is no production vertex code
  * yet). It pins the exact cross-package behavior production will rely on:
- * the REAL `ChatAnthropic` (@langchain/anthropic, bundling @anthropic-ai/sdk
- * 0.95.x) driving the REAL `AnthropicVertex` client (@anthropic-ai/vertex-sdk,
- * bundling its own nested @anthropic-ai/sdk >=0.115). If a future bump of
+ * the REAL `ChatAnthropic` (@langchain/anthropic) driving the REAL
+ * `AnthropicVertex` client (@anthropic-ai/vertex-sdk), both resolving the
+ * single override-pinned @anthropic-ai/sdk copy. If a future bump of
  * either side changes request shaping, streaming event handling, tool-call
  * assembly, or usage accounting across this seam, this suite fails in CI
- * instead of production. See scripts/check-langchain-deps.sh for why two
- * @anthropic-ai/sdk copies coexist and when they collapse to one.
+ * instead of production. See scripts/check-langchain-deps.sh for the
+ * override rationale and the single-copy invariant it guards.
  *
  * Determinism: zero credentials, zero network. Google auth is bypassed by
  * injecting a fake `authClient` (the SDK's supported constructor option —

package/src/shared/__tests__/worker-shutdown.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, it } from "vitest";
+import {
+  classifyTurnInterruption,
+  getShutdownSignalForQueue,
+  registerWorkerShutdownSignal,
+  signalWorkerShutdown,
+  unregisterWorkerShutdownSignal,
+} from "../worker-shutdown.js";
+
+describe("worker-shutdown signal registry", () => {
+  it("registers a live signal an activity can resolve by queue name", () => {
+    const controller = registerWorkerShutdownSignal("session:reg-1");
+    const signal = getShutdownSignalForQueue("session:reg-1");
+    expect(signal).toBe(controller.signal);
+    expect(signal?.aborted).toBe(false);
+    unregisterWorkerShutdownSignal("session:reg-1");
+  });
+
+  it("aborting via signalWorkerShutdown marks the queue's signal (idempotent, unknown queues are no-ops)", () => {
+    registerWorkerShutdownSignal("session:abort-1");
+    signalWorkerShutdown("session:abort-1");
+    signalWorkerShutdown("session:abort-1");
+    expect(getShutdownSignalForQueue("session:abort-1")?.aborted).toBe(true);
+    expect(() => signalWorkerShutdown("session:never-registered")).not.toThrow();
+    unregisterWorkerShutdownSignal("session:abort-1");
+  });
+
+  it("re-registering a reused queue replaces an aborted signal with a fresh one", () => {
+    // A re-created worker on a reused queue (desktop re-opens a session) must
+    // not observe the previous worker's aborted signal as its own shutdown.
+    const first = registerWorkerShutdownSignal("session:reuse-1");
+    first.abort();
+    const second = registerWorkerShutdownSignal("session:reuse-1");
+    expect(getShutdownSignalForQueue("session:reuse-1")).toBe(second.signal);
+    expect(getShutdownSignalForQueue("session:reuse-1")?.aborted).toBe(false);
+    unregisterWorkerShutdownSignal("session:reuse-1");
+  });
+
+  it("unregistering removes the signal", () => {
+    registerWorkerShutdownSignal("session:gone-1");
+    unregisterWorkerShutdownSignal("session:gone-1");
+    expect(getShutdownSignalForQueue("session:gone-1")).toBeUndefined();
+  });
+});
+
+describe("classifyTurnInterruption", () => {
+  const none = {
+    heartbeatCancelled: false,
+    heartbeatWorkerShutdown: false,
+    cancellationSignalAborted: false,
+    shutdownSignalAborted: false,
+  };
+
+  it("an uninterrupted turn is none", () => {
+    expect(classifyTurnInterruption(none)).toBe("none");
+  });
+
+  it("GRACE-WINDOW GUARD (#776): an aborted shutdown signal alone stays none — a run that completed inside the drain grace window must not be failed", () => {
+    expect(
+      classifyTurnInterruption({ ...none, shutdownSignalAborted: true }),
+    ).toBe("none");
+  });
+
+  it("heartbeat cancellation without a shutdown signal is the orchestrator's pause", () => {
+    expect(
+      classifyTurnInterruption({ ...none, heartbeatCancelled: true }),
+    ).toBe("pause");
+  });
+
+  it("heartbeat cancellation WITH the shutdown signal aborted is a worker shutdown, not a pause (the #776 misclassification)", () => {
+    expect(
+      classifyTurnInterruption({
+        ...none,
+        heartbeatCancelled: true,
+        shutdownSignalAborted: true,
+      }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("the heartbeat's own workerShutdown flag classifies directly", () => {
+    expect(
+      classifyTurnInterruption({ ...none, heartbeatWorkerShutdown: true }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("a delivered cancellation with the shutdown signal aborted is a worker shutdown (signal races the heartbeat tick)", () => {
+    expect(
+      classifyTurnInterruption({
+        ...none,
+        cancellationSignalAborted: true,
+        shutdownSignalAborted: true,
+      }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("a delivered cancellation alone (heartbeat timeout / infra cancel) is neither shutdown nor pause", () => {
+    expect(
+      classifyTurnInterruption({ ...none, cancellationSignalAborted: true }),
+    ).toBe("none");
+  });
+});

package/src/shared/args-preview.ts

@@ -34,11 +34,25 @@ export const MAX_ARGS_PREVIEW_LENGTH = 500;
  * Cursor gate path must instead use {@link buildElidedArgsPreview}, which keeps
  * the JSON valid and preserves the salient identity fields.
  */
-export function sanitizeArgsPreview(args: Record<string, unknown>): string {
-  const sanitized: Record<string, unknown> = {};
+/**
+ * Redact secret-keyed values (see {@link SENSITIVE_ARG_KEYS}), preserving every
+ * other entry verbatim. The shared first step of both preview builders, and the
+ * shape stamped as `args` on interrupt-placeholder tool calls (issue #754's
+ * header fix): full enough for the UI's path/primary-arg extraction, never
+ * carrying a secret value.
+ */
+export function redactSensitiveArgs(
+  args: Record<string, unknown>,
+): Record<string, unknown> {
+  const redacted: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(args)) {
-    sanitized[key] = SENSITIVE_ARG_KEYS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+    redacted[key] = SENSITIVE_ARG_KEYS.has(key.toLowerCase()) ? "[REDACTED]" : value;
   }
+  return redacted;
+}
+
+export function sanitizeArgsPreview(args: Record<string, unknown>): string {
+  const sanitized = redactSensitiveArgs(args);
   try {
     const json = JSON.stringify(sanitized);
     return json.length > MAX_ARGS_PREVIEW_LENGTH

package/src/shared/artifact-storage.ts

@@ -56,7 +56,17 @@ export interface ArtifactStorage {
   exists(key: string): Promise<boolean>;
 }
 
-export type ArtifactStorageType = "local" | "proxy";
+/**
+ * "none" is the explicit no-store posture: capture degrades to the deny-gate
+ * (file writes gated pre-execution, DD-22/DD-26) and offload is disabled —
+ * the same first-class absent-store state a proxy misconfig or unwritable
+ * local path resolves to, but chosen deliberately (ARTIFACT_STORAGE_TYPE=none)
+ * instead of reached by failure. The e2e file-gate stack boots with it, and
+ * an operator can use it to force gate-everything behavior. It is only valid
+ * where an absent store is: claimcheck (fail-hard by contract) refuses it at
+ * construction.
+ */
+export type ArtifactStorageType = "local" | "proxy" | "none";
 
 // ── Local Backend ────────────────────────────────────────────────────
 
@@ -371,6 +381,7 @@ export function loadArtifactStorageConfig(config: Config): ArtifactStorageConfig
   const type: ArtifactStorageType =
     envType === "proxy" ? "proxy" :
     envType === "local" ? "local" :
+    envType === "none" ? "none" :
     config.proxyEndpoint ? "proxy" : "local";
 
   return {
@@ -387,6 +398,14 @@ export function loadArtifactStorageConfig(config: Config): ArtifactStorageConfig
 }
 
 export function createArtifactStorage(cfg: ArtifactStorageConfig): ArtifactStorage {
+  if (cfg.type === "none") {
+    // Deliberate no-store posture. Throwing keeps both consumers honest:
+    // resolveUsableArtifactStorage catches and degrades to the deny-gate
+    // (the intent of "none"), while claimcheck's direct fail-hard call
+    // surfaces the config contradiction at boot instead of silently
+    // dropping Temporal payloads.
+    throw new Error("ARTIFACT_STORAGE_TYPE=none: artifact storage deliberately disabled");
+  }
   if (cfg.type === "proxy") {
     if (!cfg.proxyEndpoint) {
       throw new Error("Proxy artifact storage requires STIGMER_PROXY_ENDPOINT");