@stigmer/runner 3.12.4 → 3.12.5

package/src/activities/execute-cursor/cursor-mcp-config.ts

@@ -0,0 +1,107 @@
+/**
+ * The Cursor harness's MCP output adapter: maps the shared resolver's
+ * {@link ResolvedMcpServer} servers into the Cursor SDK's mcpServers config
+ * for Agent.create(), plus the harness's env pre-flight check.
+ *
+ * Resolution itself lives in shared/mcp-resolver.ts (oss#387 consolidated the
+ * near-duplicate resolver this file used to carry) — this module is the
+ * symmetric twin of the deep-agent harness's toMcpClientConfig in
+ * shared/mcp-manager.ts: both consume the identical intermediate, only the
+ * final SDK serialization differs.
+ */
+
+import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { ResolvedMcpServer } from "../../shared/mcp-resolver.js";
+
+/**
+ * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
+ * Defined here to avoid tight coupling to the SDK's internal types.
+ */
+export type CursorMcpServerConfig =
+  | {
+      type?: "stdio";
+      command: string;
+      args?: string[];
+      env?: Record<string, string>;
+      cwd?: string;
+    }
+  | {
+      type?: "http" | "sse";
+      url: string;
+      headers?: Record<string, string>;
+    };
+
+/**
+ * Transform resolved MCP servers into the Cursor SDK's mcpServers config
+ * for Agent.create().
+ *
+ * Call it ONCE, after the last mutation of the resolved-server list (backfill,
+ * synthesized-attachment injection): the config is a projection of that list,
+ * and building it early just creates a stale copy someone must remember to
+ * rebuild. The Cursor SDK config cannot hide tools, so enabledTools is NOT
+ * expressed here — the HITL hook enforces it (see ResolvedMcpServer.enabledTools).
+ */
+export function toCursorMcpConfig(
+  servers: ResolvedMcpServer[],
+): Record<string, CursorMcpServerConfig> {
+  const result: Record<string, CursorMcpServerConfig> = {};
+
+  for (const server of servers) {
+    if (server.connectionType === "stdio") {
+      if (!server.command) continue;
+      result[server.slug] = {
+        type: "stdio",
+        command: server.command,
+        args: server.args,
+        env: server.env,
+        cwd: server.cwd,
+      };
+    } else {
+      if (!server.url) continue;
+      result[server.slug] = {
+        type: server.connectionType,
+        url: server.url,
+        headers: server.headers,
+      };
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Validate that resolved MCP servers have their required env vars populated.
+ * Returns a list of warnings for servers with empty/missing env.
+ * Used as a pre-flight check before agent.send() to surface config issues early.
+ */
+export function validateMcpServerEnv(
+  servers: ResolvedMcpServer[],
+  usages: McpServerUsage[],
+): string[] {
+  const warnings: string[] = [];
+
+  for (const usage of usages) {
+    const slug = usage.mcpServerRef?.slug;
+    if (!slug) continue;
+
+    const resolved = servers.find((s) => s.slug === slug);
+    if (!resolved) {
+      warnings.push(`MCP server '${slug}': failed to resolve (server may not exist or is inaccessible)`);
+      continue;
+    }
+
+    if (resolved.connectionType === "stdio" && resolved.env) {
+      const emptyKeys = Object.entries(resolved.env)
+        .filter(([, v]) => !v)
+        .map(([k]) => k);
+      if (emptyKeys.length > 0) {
+        warnings.push(
+          `MCP server '${slug}': env vars [${emptyKeys.join(", ")}] are empty — ` +
+          `server subprocess will likely fail to connect`,
+        );
+      }
+    }
+  }
+
+  return warnings;
+}

package/src/activities/execute-cursor/index.ts

@@ -56,6 +56,7 @@ import {
   resolveCallerIdentity,
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
+import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
 import { withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { StallTimeoutError, formatStallFailure } from "../../shared/stall-watchdog.js";
 import { resolveUsableArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
@@ -71,7 +72,8 @@ import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
 import { StreamingUpdateScheduler, loadStreamingConfig } from "../../shared/streaming-scheduler.js";
 import { createCursorEventRecorder } from "./cursor-event-recorder.js";
-import { resolveMcpServers, toCursorMcpConfig, validateMcpServerEnv } from "./mcp-resolver.js";
+import { resolveMcpServers } from "../../shared/mcp-resolver.js";
+import { toCursorMcpConfig, validateMcpServerEnv } from "./cursor-mcp-config.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
 import {
   discoverChannelMessaging,
@@ -85,7 +87,7 @@ import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment
 import { mergeApprovalPolicies } from "./approval-policy.js";
 import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
 import { enabledToolsBySlug } from "../../shared/mcp-enabled-tools.js";
-import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
+import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
 import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
@@ -147,7 +149,7 @@ import type { ClassifiedError } from "./error-classifier.js";
 import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
-import { getShutdownSignalForQueue } from "../../runner-manager.js";
+import { classifyTurnInterruption, getShutdownSignalForQueue } from "../../shared/worker-shutdown.js";
 
 /**
  * Creates the activity functions bound to the runner config.
@@ -627,16 +629,19 @@ async function executeCursorInner(
       ),
       sessionId,
     );
-    let mcpResolution = await resolveMcpServers(
+    // The resolved-server list mutates through backfill and attachment
+    // injection below; the Cursor SDK config is projected from it exactly
+    // once, after the last mutation (see toCursorMcpConfig).
+    let resolvedMcpServers = (await resolveMcpServers(
       client, blueprint.mergedMcpServerUsages, mcpEnvVars, transportPosture,
-    );
+    )).resolvedServers;
     setupTiming.mark("resolve_mcp_servers");
 
     // Phase 4a: Connect backfill for undiscovered MCP servers
     heartbeatPhase = "resolving_mcp_servers";
     const sessionOrg = session.metadata?.org ?? "";
-    mcpResolution = await backfillMcpServersIfNeeded(
-      client, mcpResolution, blueprint.mergedMcpServerUsages, mcpEnvVars, sessionOrg,
+    resolvedMcpServers = await backfillMcpServersIfNeeded(
+      client, resolvedMcpServers, blueprint.mergedMcpServerUsages, mcpEnvVars, sessionOrg,
       transportPosture, heartbeat, secretKeys,
     );
     setupTiming.mark("backfill_mcp");
@@ -684,13 +689,9 @@ async function executeCursorInner(
         backendEndpoint: config.stigmerBackendEndpoint,
       });
       if (attachment) {
-        const resolvedServers = injectSynthesizedAttachment(
-          mcpResolution.resolvedServers, attachment, "channel messaging",
+        resolvedMcpServers = injectSynthesizedAttachment(
+          resolvedMcpServers, attachment, "channel messaging",
         );
-        mcpResolution = {
-          resolvedServers,
-          cursorConfig: toCursorMcpConfig(resolvedServers),
-        };
       }
     }
 
@@ -710,15 +711,13 @@ async function executeCursorInner(
       },
     );
     if (conversationAttachment) {
-      const resolvedServers = injectSynthesizedAttachment(
-        mcpResolution.resolvedServers, conversationAttachment, "conversation participation",
+      resolvedMcpServers = injectSynthesizedAttachment(
+        resolvedMcpServers, conversationAttachment, "conversation participation",
       );
-      mcpResolution = {
-        resolvedServers,
-        cursorConfig: toCursorMcpConfig(resolvedServers),
-      };
     }
-    const mcpConfig = mcpResolution.cursorConfig;
+    // The one projection point: every mutation above is now visible in the
+    // Cursor SDK config by construction (no per-mutation rebuild to forget).
+    const mcpConfig = toCursorMcpConfig(resolvedMcpServers);
 
     // Phase 4b: Merge approval policies from all layers.
     //
@@ -734,16 +733,15 @@ async function executeCursorInner(
     // see ResolvedMcpServer.toolApprovalOverrides (issue #349) — so there
     // is no separate override input to pass here.
     const mergedPolicies = mergeApprovalPolicies(
-      mcpResolution.resolvedServers,
+      resolvedMcpServers,
       leases,
     );
     heartbeat();
 
     // Phase 4c: Validate MCP server env health (diagnostic, non-blocking)
     const mcpWarnings = validateMcpServerEnv(
-      mcpResolution.resolvedServers,
+      resolvedMcpServers,
       blueprint.mergedMcpServerUsages,
-      envVars,
     );
     if (mcpWarnings.length > 0) {
       console.warn(
@@ -910,7 +908,7 @@ async function executeCursorInner(
       // servers' allow-lists, enforced by the hook's "disabled" arm ahead of
       // every approval bypass. The Cursor SDK config cannot hide a server's
       // tools, so this deny-at-call is the harness's enforcement.
-      enabledToolsBySlug(mcpResolution.resolvedServers),
+      enabledToolsBySlug(resolvedMcpServers),
     );
     const hitlGate = await installHitlGate({
       workspaceRoot: primaryWorkspaceDir,
@@ -1175,6 +1173,7 @@ async function executeCursorInner(
       contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
       senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
       sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
+      declaredPreferences: readDeclaredPreferences(spec.declaredPreferences),
       conversationCatchup: readConversationCatchup(spec.conversationCatchup),
       // The turn's recorded transcript, seeded from the persisted execution
       // on a reinvocation (Phase 3). Consumed only by the HITL-recovery
@@ -1401,13 +1400,21 @@ async function executeCursorInner(
     // classifies a shutdown from the shutdown signal directly (in
     // resolvePreBoundaryTerminal). The heartbeat timer may set `cancelled` before
     // the AbortSignal microtask propagates; the direct signal check catches that.
-    const isShutdown = periodicHeartbeat.workerShutdown || (shutdownSignal?.aborted ?? false);
-    if (isShutdown) {
+    // The decision table (including #776's grace-window guard: an aborted
+    // shutdown signal with NO interruption evidence stays "none") lives in
+    // classifyTurnInterruption — shared/worker-shutdown.ts.
+    const interruption = classifyTurnInterruption({
+      heartbeatCancelled: periodicHeartbeat.cancelled,
+      heartbeatWorkerShutdown: periodicHeartbeat.workerShutdown,
+      cancellationSignalAborted: Context.current().cancellationSignal.aborted,
+      shutdownSignalAborted: shutdownSignal?.aborted ?? false,
+    });
+    if (interruption === "worker-shutdown") {
       turnState.pauseDetected = false;
-    } else if (periodicHeartbeat.cancelled) {
+    } else if (interruption === "pause") {
       turnState.pauseDetected = true;
     }
-    workerShutdownDetected = isShutdown;
+    workerShutdownDetected = interruption === "worker-shutdown";
 
     // Post-stream finalize, shared by the primary turn and both recovery retries:
     // finalize the transcript + streaming flags, mark any in-flight sub-agent
@@ -1505,10 +1512,16 @@ async function executeCursorInner(
         return { kind: "return" };
       }
 
-      // Worker shutdown: the runner-manager aborted the shutdown signal. NOT a
+      // Worker shutdown: the runner/manager aborted the shutdown signal. NOT a
       // user pause. Checked via the shutdown signal directly so a retry (whose
-      // periodic heartbeat is already stopped) still classifies it correctly.
-      if (workerShutdownDetected || (shutdownSignal?.aborted ?? false)) {
+      // periodic heartbeat is already stopped) still classifies it correctly —
+      // but only alongside a delivered cancellation: a retry that completed
+      // normally inside the drain grace window must stay a completion (#776's
+      // grace-window guard, mirroring the primary's `interrupted` gate).
+      if (
+        workerShutdownDetected ||
+        ((shutdownSignal?.aborted ?? false) && Context.current().cancellationSignal.aborted)
+      ) {
         status.phase = ExecutionPhase.EXECUTION_FAILED;
         status.error = "Execution interrupted: runner worker was shut down. Retry or resume.";
         status.completedAt = utcTimestamp();
@@ -1865,6 +1878,7 @@ async function executeCursorInner(
             contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
             senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
             sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
+            declaredPreferences: readDeclaredPreferences(spec.declaredPreferences),
             conversationCatchup: readConversationCatchup(spec.conversationCatchup),
             // Composed fresh (not reused from Phase 10): the failed primary
             // stream may have appended partial work onto status.messages,
@@ -2150,9 +2164,12 @@ async function executeCursorInner(
     periodicHeartbeat?.stop();
 
     if (err instanceof CancelledFailure) {
-      // workerShutdownDetected means the runner-manager signaled shutdown
-      // before the worker drained. This is infrastructure failure, not pause.
-      if (workerShutdownDetected) {
+      // Worker shutdown is infrastructure failure, not pause. The direct
+      // signal check covers a CancelledFailure thrown BEFORE the post-stream
+      // classification ran (workerShutdownDetected still false); no extra
+      // interruption-evidence gate is needed here — the caught
+      // CancelledFailure IS the evidence (#776).
+      if (workerShutdownDetected || (shutdownSignal?.aborted ?? false)) {
         console.log(`ExecuteCursor cancelled (worker shutdown) for execution ${executionId}`);
         status.phase = ExecutionPhase.EXECUTION_FAILED;
         status.error = "Execution interrupted: runner worker was shut down. Retry or resume.";
@@ -2451,10 +2468,19 @@ export interface BuildPromptInput {
    * turn.
    */
   sessionContext?: string;
+  /**
+   * Platform-declared standing preferences from the execution spec's
+   * `declared_preferences` (stigmer/stigmer#293). Like the bridge, only
+   * the enhanced-prompt path consumes it — deliberately frozen per Cursor
+   * session (DD-002 D3): the first turn delivers it into the agent's own
+   * conversation store, and repeating it on resumed turns would bloat the
+   * store with identical content.
+   */
+  declaredPreferences?: import("../../shared/declared-preferences.js").DeclaredPreferencesContent;
   /**
    * Conversation catchup from the execution spec's `conversation_catchup`
    * (cloud DD-006): what happened on the channel conversation that the
-   * agent has not seen. PER-TURN, so unlike the three standing values
+   * agent has not seen. PER-TURN, so unlike the standing values
    * above it rides BOTH prompt paths — the enhanced prompt and a resumed
    * turn's prefix (the `interaction_mode` shape). Handback lands
    * mid-session on a resumed agent: the resumed path is the one that
@@ -2589,6 +2615,7 @@ export function buildPrompt(input: BuildPromptInput): string {
           contextBridge: input.contextBridge,
           senderIdentity: input.senderIdentity,
           sessionContext: input.sessionContext,
+          declaredPreferences: input.declaredPreferences,
           conversationCatchup,
         },
         {
@@ -2655,6 +2682,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     contextBridge: input.contextBridge,
     senderIdentity: input.senderIdentity,
     sessionContext: input.sessionContext,
+    declaredPreferences: input.declaredPreferences,
     conversationCatchup,
   });
 }

package/src/activities/execute-cursor/prompt-builder.ts

@@ -31,6 +31,10 @@ import {
   type SenderIdentity,
 } from "../../shared/sender-identity.js";
 import { formatSessionContextText } from "../../shared/session-context.js";
+import {
+  formatDeclaredPreferencesText,
+  type DeclaredPreferencesContent,
+} from "../../shared/declared-preferences.js";
 import {
   visionDisclosureLines,
   type NotViewableEntry,
@@ -147,11 +151,20 @@ export interface EnhancedPromptOptions {
    * store — the context is constant for the session's lifetime.
    */
   sessionContext?: string;
+  /**
+   * Platform-declared standing preferences (stigmer/stigmer#293): the org's
+   * and user's standing context, server-snapshotted onto the execution
+   * spec's `declared_preferences` at create. Like the bridge, it lands in
+   * the first message and persists in the cursor agent's own conversation
+   * store — deliberately frozen per Cursor session (DD-002 D3): repeating
+   * it every resumed turn would bloat the store with identical content.
+   */
+  declaredPreferences?: DeclaredPreferencesContent;
   /**
    * Conversation catchup (cloud DD-006): what happened on the channel
    * conversation that the agent has not seen, read from the execution
-   * spec's `conversation_catchup`. PER-TURN, unlike the three standing
-   * siblings above: it rides BOTH prompt paths — this enhanced prompt and
+   * spec's `conversation_catchup`. PER-TURN, unlike the standing siblings
+   * above: it rides BOTH prompt paths — this enhanced prompt and
    * a resumed turn's prefix (the `interaction_mode` shape) — because
    * handback lands mid-session on a resumed agent, the exact case the
    * metadata lane cannot reach.
@@ -232,6 +245,14 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatSenderIdentitySection(options.senderIdentity));
   }
 
+  // Platform-declared standing facts precede embedder-supplied context
+  // (DD-002 D3): both are standing background, but the declared preferences
+  // are platform-authored while session context is the embedder's overlay —
+  // the more specific overlay reads later and naturally refines.
+  if (options.declaredPreferences) {
+    sections.push(formatDeclaredPreferencesSection(options.declaredPreferences));
+  }
+
   // Standing facts about the user (session context) come before the
   // carried conversation (bridge): the bridge may refer back to them.
   if (options.sessionContext) {
@@ -445,6 +466,12 @@ export function formatSenderIdentitySection(identity: SenderIdentity): string {
   return `<conversation_sender>\n${formatSenderIdentityText(identity)}\n</conversation_sender>`;
 }
 
+export function formatDeclaredPreferencesSection(
+  preferences: DeclaredPreferencesContent,
+): string {
+  return `<declared_preferences>\n${formatDeclaredPreferencesText(preferences)}\n</declared_preferences>`;
+}
+
 export function formatSessionContextSection(context: string): string {
   return `<session_context>\n${formatSessionContextText(context)}\n</session_context>`;
 }

package/src/activities/execute-cursor/session-lifecycle.ts

@@ -47,7 +47,7 @@ import type {
   ModelParameterValue,
 } from "@cursor/sdk";
 import { withTimeout, TimeoutError } from "../../shared/with-timeout.js";
-import type { CursorMcpServerConfig } from "./mcp-resolver.js";
+import type { CursorMcpServerConfig } from "./cursor-mcp-config.js";
 
 // ---------------------------------------------------------------------------
 // Constants

package/src/activities/execute-cursor/skill-resolver.ts

@@ -2,8 +2,8 @@
  * Resolves skill resources and writes them to the platform-managed directory.
  *
  * - Fetches skills via gRPC (by reference)
- * - Writes SKILL.md to .stigmer/skills/{name}/SKILL.md
- * - Downloads and extracts ZIP artifacts (references/, scripts/, etc.)
+ * - Mounts each skill via the shared skill-mount mechanics (SKILL.md +
+ *   extracted artifact, hash-keyed cache — see shared/skill-mount.ts)
  * - Uses a platform-managed directory outside the workspace
  * - Ensures the workspace `.stigmer` symlink (see stigmer-link.ts)
  * - Returns metadata for prompt injection
@@ -17,38 +17,20 @@
  * transfer.
  */
 
-import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
-import { join, dirname } from "node:path";
-import { ConnectError, Code } from "@connectrpc/connect";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
 import type { StigmerClient } from "../../client/stigmer-client.js";
-import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import type { ApiResourceReference } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { SkillMetadata } from "./prompt-builder.js";
 import { getPlatformDir } from "../../shared/workspace/platform-dir.js";
-import { extractZipFileEntries } from "../../shared/zip-extract.js";
+import {
+  SKILLS_SUBDIR,
+  mountIsFresh,
+  downloadArtifact,
+  writeSkillMount,
+} from "../../shared/skill-mount.js";
 import { ensureStigmerSymlink, STIGMER_LOCAL_STATE_DIR } from "../../shared/workspace/stigmer-link.js";
 
-const SKILLS_SUBDIR = "skills";
-
-/**
- * Marker recording what a skill's mount directory currently holds. Written
- * LAST, after every file of the mount landed — a crash mid-write leaves no
- * marker, so the next execution remounts instead of trusting a partial tree.
- */
-const MOUNT_MARKER_FILE = ".stigmer-mount.json";
-
-interface MountMarker {
-  /** Content-addressed version hash (`Skill.status.version_hash`) of the mounted content. */
-  versionHash: string;
-  /**
-   * Whether the artifact's files are part of the mount. `false` when the
-   * skill has no artifact OR when the download failed and the mount fell
-   * back to SKILL.md only — the latter makes the next execution retry the
-   * download rather than cache the degraded mount.
-   */
-  artifactMounted: boolean;
-}
-
 export interface SkillResolverOptions {
   sessionId: string;
   primaryWorkspaceDir: string;
@@ -145,112 +127,3 @@ export async function resolveSkills(
 
   return results;
 }
-
-/**
- * Whether the mount at `skillDir` already holds this version's content.
- *
- * Fresh means: the marker's hash matches AND the mount isn't a degraded
- * SKILL.md-only fallback when the skill does carry an artifact. Any read or
- * parse failure counts as stale — the remount is the safe default.
- */
-async function mountIsFresh(skillDir: string, versionHash: string, wantsArtifact: boolean): Promise<boolean> {
-  try {
-    const raw = await readFile(join(skillDir, MOUNT_MARKER_FILE), "utf-8");
-    const marker = JSON.parse(raw) as Partial<MountMarker>;
-    return marker.versionHash === versionHash && (marker.artifactMounted === true || !wantsArtifact);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Download a skill artifact's ZIP bytes, transfer lane first (#675).
- *
- * The URL lane (getArtifactDownloadUrl → HTTP GET) carries any valid skill
- * size; the unary getArtifact response is capped by the server's 10MB gRPC
- * message limit. Servers that predate the lane (and cloud until its sibling
- * lands) answer the mint with UNIMPLEMENTED — those fall back to the unary
- * path, which behaves exactly as before for ≤10MB artifacts.
- *
- * Runs only on a mount-cache miss (#672's hash-keyed marker above) — a hit
- * skips the transfer entirely, whichever lane would have carried it.
- *
- * Exported for tests.
- */
-export async function downloadArtifact(
-  client: StigmerClient,
-  artifactStorageKey: string,
-): Promise<Uint8Array | undefined> {
-  let minted;
-  try {
-    minted = await client.getSkillArtifactDownloadUrl(artifactStorageKey);
-  } catch (err) {
-    if (err instanceof ConnectError && err.code === Code.Unimplemented) {
-      const resp = await client.getSkillArtifact(artifactStorageKey);
-      return resp.artifact && resp.artifact.length > 0 ? resp.artifact : undefined;
-    }
-    throw err;
-  }
-
-  const resp = await fetch(minted.url);
-  if (!resp.ok) {
-    throw new Error(`artifact fetch failed: HTTP ${resp.status} from ${minted.url}`);
-  }
-  const bytes = new Uint8Array(await resp.arrayBuffer());
-  if (minted.sizeBytes > 0n && BigInt(bytes.length) !== minted.sizeBytes) {
-    throw new Error(
-      `artifact fetch truncated: got ${bytes.length} bytes, expected ${minted.sizeBytes}`,
-    );
-  }
-  return bytes.length > 0 ? bytes : undefined;
-}
-
-/**
- * (Re)write a skill's mount directory from scratch.
- *
- * The directory is removed first so files deleted between versions don't
- * linger in the mount, then SKILL.md and the artifact files are written, and
- * the marker is stamped LAST (see MOUNT_MARKER_FILE for the crash-safety
- * contract). SKILL.md always comes from `spec.skillMd` — the server's
- * authoritative copy — never from the zip; both the zip's SKILL.md and any
- * stray marker-named entry are excluded from extraction so the mount's
- * ownership of those two files is unconditional.
- */
-async function writeSkillMount(
-  skill: Skill,
-  skillDir: string,
-  artifactBytes: Uint8Array | undefined,
-): Promise<void> {
-  await rm(skillDir, { recursive: true, force: true });
-  await mkdir(skillDir, { recursive: true });
-
-  await writeFile(join(skillDir, "SKILL.md"), skill.spec!.skillMd, "utf-8");
-
-  const artifactMounted = artifactBytes !== undefined && artifactBytes.length > 0;
-  if (artifactMounted) {
-    const entries = await extractZipFileEntries(artifactBytes, { exclude: ["SKILL.md", MOUNT_MARKER_FILE] });
-    for (const entry of entries) {
-      const filePath = join(skillDir, entry.path);
-      await mkdir(dirname(filePath), { recursive: true });
-      await writeFile(filePath, entry.content);
-    }
-  }
-
-  const versionHash = skill.status?.versionHash ?? "";
-  if (versionHash !== "") {
-    const marker: MountMarker = { versionHash, artifactMounted };
-    await writeFile(join(skillDir, MOUNT_MARKER_FILE), JSON.stringify(marker), "utf-8");
-  }
-}
-
-/**
- * Clean up platform-managed skill directory for a session.
- */
-export async function cleanupSkills(sessionId: string): Promise<void> {
-  const platformDir = getPlatformDir(sessionId);
-  try {
-    await rm(platformDir, { recursive: true, force: true });
-  } catch {
-    // best-effort
-  }
-}

package/src/activities/execute-deep-agent/__tests__/approval-file-change.test.ts

@@ -81,4 +81,19 @@ describe("captureApprovalArtifacts", () => {
     const { argsPreview } = captureApprovalArtifacts({ toolCallId: "call-1", messages });
     expect(argsPreview).toContain("needle");
   });
+
+  it("returns the redacted args object for stamping the placeholder row (issue #754)", () => {
+    // The interrupt-placeholder ToolCall must carry `args`, not just the
+    // preview string: the row header extracts its filename-first path from
+    // args, so a placeholder without them rendered a pathless "Write" gate.
+    // Redaction posture matches the preview: secret keys never surface.
+    const messages = [
+      aiMessage([
+        { id: "call-1", name: "write_file", args: { file_path: "a.txt", content: "hi", token: "sk-secret" } },
+      ]),
+    ];
+    const { args } = captureApprovalArtifacts({ toolCallId: "call-1", messages });
+
+    expect(args).toEqual({ file_path: "a.txt", content: "hi", token: "[REDACTED]" });
+  });
 });