@stigmer/runner 3.12.4 → 3.12.6

package/src/activities/execute-deep-agent/cas-capture-backend.ts

@@ -25,8 +25,25 @@
  * records its before-bytes at authorization time instead (`captureDeleteBefore`,
  * issue #303). A delete via shell (`rm`) stays on the approval gate as always.
  *
+ * VIRTUAL ROOT — THE ONE PATH DIALECT (issue #754)
+ * ------------------------------------------------
+ * Every backend here is constructed with `virtualMode: true`: a leading "/"
+ * denotes the WORKSPACE ROOT, traversal (`..`, `~`) is rejected, and every
+ * resolution stays inside `rootDir` by construction. This is the same dialect
+ * the rest of the harness already speaks — the system prompt's path-resolution
+ * directive, `resolveWorkspacePath(..., virtualRoot=true)` in the CAS observer
+ * and turn-boundary capture, `InlinePublisher.normalizePath`, and the approval
+ * gate's capturability checks. Before this flag, deepagents' legacy default
+ * passed absolute paths through to the REAL filesystem: a `write_file("/tmp/x")`
+ * escaped the session workspace onto the host AND escaped review entirely
+ * (auto-approved as capture-mode flow, but the observer/boundary/publisher all
+ * looked inside the workspace and found nothing). Read-side, the same legacy
+ * pass-through was why plan mode needed rule-based read fencing at all. Do not
+ * remove this flag: workspace confinement is structural, not policy.
+ *
  * @since File-Change HITL Redesign (Phase 3 — CAS deep-agent wiring); sub-agent
- * gitignored capture parity (Session 26, DD-19); shell restore (issue #248)
+ * gitignored capture parity (Session 26, DD-19); shell restore (issue #248);
+ * virtual-root confinement (issue #754)
  */
 
 import { FilesystemBackend, LocalShellBackend } from "deepagents";
@@ -111,12 +128,12 @@ export async function createCasCaptureBackend(
 
   if (shellEnv !== undefined) {
     const backend = new CasCaptureShellBackend(
-      { rootDir, env: shellEnv },
+      { rootDir, virtualMode: true, env: shellEnv },
       { observer },
     );
     await backend.initialize();
     return backend;
   }
 
-  return new CasCaptureFilesystemBackend({ rootDir }, { observer });
+  return new CasCaptureFilesystemBackend({ rootDir, virtualMode: true }, { observer });
 }

package/src/activities/execute-deep-agent/index.ts

@@ -78,10 +78,33 @@ import { stampFlowedFileEditRows, stampFlowedSubAgentFileEditRows } from "./stam
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
 import { describeExecutionError } from "../../shared/model-error.js";
 import { inferProvider, type LlmProvider } from "../../shared/llm-proxy.js";
+import { getShutdownSignalForQueue } from "../../shared/worker-shutdown.js";
 
 /** The harness id stamped on the deep-agent's file-review ledger events. */
 const DEEP_AGENT_HARNESS_ID = "deep-agent";
 
+/**
+ * The worker-shutdown terminal status (#776). A shutdown is not a pause: the
+ * execution will not resume on this worker, so persisting PAUSED would strand
+ * the user with a lie. The copy is byte-identical to the Cursor harness's
+ * worker-shutdown branch so every downstream status.error consumer (the Go and
+ * Java workflow fallbacks, the cloud channel decision table) keys on ONE shape.
+ */
+function buildWorkerShutdownStatus(): AgentExecutionStatus {
+  return create(AgentExecutionStatusSchema, {
+    phase: ExecutionPhase.EXECUTION_FAILED,
+    error: "Execution interrupted: runner worker was shut down. Retry or resume.",
+    completedAt: utcTimestamp(),
+    messages: [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_SYSTEM,
+        content: "Execution interrupted: the runner worker was shut down while the agent was still running. You can retry or resume.",
+        timestamp: utcTimestamp(),
+      }),
+    ],
+  });
+}
+
 /**
  * Best-effort provider inference for error-message wording. inferProvider
  * throws on unrecognized names; an error path must never throw over a label.
@@ -115,6 +138,11 @@ export function createDeepAgentActivities(config: Config) {
     ): Promise<unknown> => {
       const { executionId, threadId, turnSeq } = normalizeActivityInput(arg0, arg1);
       activityStarted();
+      // Worker-shutdown classification channel (#776): the pause paths below
+      // consult this signal to distinguish "my worker is draining" (SIGTERM,
+      // desktop quit) from "the orchestrator cancelled me" (a real user
+      // pause). See shared/worker-shutdown.ts for the ownership contract.
+      const shutdownSignal = getShutdownSignalForQueue(Context.current().info.taskQueue);
       let setup: SetupResult | null = null;
       // Exclusive turn lock on the workspace working tree — held across the
       // entire tree-mutating window (decision reconcile, agent writes,
@@ -567,6 +595,13 @@ export function createDeepAgentActivities(config: Config) {
 
         if (result.terminalStatus) {
           if (initialStatus.phase === ExecutionPhase.EXECUTION_PAUSED) {
+            // The stream loop marks PAUSED for ANY platform cancellation; a
+            // worker shutdown is not a pause and must not persist as one (#776).
+            if (shutdownSignal?.aborted) {
+              console.log(`[ExecuteDeepAgent] Cancelled (worker shutdown) for execution ${executionId}: events=${result.eventsProcessed}`);
+              await persistStatus(client, executionId, buildWorkerShutdownStatus(), { offload: statusOffload }).catch(() => {});
+              throw new CancelledFailure("Activity cancelled (worker shutdown, not user pause)");
+            }
             await persistStatus(client, executionId, initialStatus, { offload: statusOffload });
             console.log(`[ExecuteDeepAgent] Paused for execution ${executionId}: events=${result.eventsProcessed}`);
             throw new CancelledFailure("Activity paused by orchestrator");
@@ -617,15 +652,20 @@ export function createDeepAgentActivities(config: Config) {
                 policyEngineVersion: intr.policySource ? POLICY_ENGINE_VERSION : "",
               });
 
-              // Capture a sanitized args preview while the graph is paused, so the
-              // approval UI renders the proposed change before the tool runs. Args
-              // are correlated from the AI-message tool call in graph state (the
-              // single source of truth).
-              const { argsPreview } = captureApprovalArtifacts({
+              // Capture a sanitized args preview AND the redacted args object
+              // while the graph is paused, so the approval UI renders the
+              // proposed change before the tool runs — and the row header can
+              // extract its filename-first path from `args` like every other
+              // row (issue #754: a placeholder without args rendered a
+              // pathless "Write" header). Args are correlated from the
+              // AI-message tool call in graph state (the single source of
+              // truth).
+              const { argsPreview, args } = captureApprovalArtifacts({
                 toolCallId: intr.toolCallId,
                 messages: aiMessages,
               });
               if (argsPreview) toolCall.argsPreview = argsPreview;
+              if (args) toolCall.args = args as typeof toolCall.args;
 
               aiMsg.toolCalls.push(toolCall);
             }
@@ -749,6 +789,13 @@ export function createDeepAgentActivities(config: Config) {
 
       } catch (err: unknown) {
         if (err instanceof CancelledFailure) {
+          // Worker shutdown is infrastructure failure, not pause — the caught
+          // CancelledFailure is itself the interruption evidence (#776).
+          if (shutdownSignal?.aborted) {
+            console.log(`[ExecuteDeepAgent] Cancelled (worker shutdown) for execution ${executionId}`);
+            await persistStatus(client, executionId, buildWorkerShutdownStatus()).catch(() => {});
+            throw err;
+          }
           console.log(`[ExecuteDeepAgent] Cancelled (pause) for execution ${executionId}`);
           const pausedStatus = create(AgentExecutionStatusSchema, {
             phase: ExecutionPhase.EXECUTION_PAUSED,
@@ -758,6 +805,11 @@ export function createDeepAgentActivities(config: Config) {
         }
 
         if (Context.current().cancellationSignal.aborted) {
+          if (shutdownSignal?.aborted) {
+            console.log(`[ExecuteDeepAgent] Error during worker-shutdown cancellation for ${executionId}: ${err}`);
+            await persistStatus(client, executionId, buildWorkerShutdownStatus()).catch(() => {});
+            throw new CancelledFailure("Activity cancelled (worker shutdown, not user pause)");
+          }
           console.log(`[ExecuteDeepAgent] Error during cancellation for ${executionId}, treating as pause: ${err}`);
           const pausedStatus = create(AgentExecutionStatusSchema, {
             phase: ExecutionPhase.EXECUTION_PAUSED,

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -17,6 +17,10 @@ import {
   type SenderIdentity,
 } from "../../shared/sender-identity.js";
 import { formatSessionContextText } from "../../shared/session-context.js";
+import {
+  formatDeclaredPreferencesText,
+  type DeclaredPreferencesContent,
+} from "../../shared/declared-preferences.js";
 import {
   visionDisclosureLines,
   type NotViewableEntry,
@@ -166,6 +170,14 @@ export interface PromptBuilderInput {
    * context is standing session state, like skills.
    */
   sessionContext?: string;
+  /**
+   * Platform-declared standing preferences (stigmer/stigmer#293): the org's
+   * and user's standing context, server-snapshotted onto the execution
+   * spec's `declared_preferences` at create. Injected on EVERY turn like
+   * the bridge — the native system prompt is rebuilt per invocation, so an
+   * edited preference reaches the very next turn.
+   */
+  declaredPreferences?: DeclaredPreferencesContent;
 }
 
 // The prompt renders the injector's own result type — a local structural twin
@@ -229,6 +241,16 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
       formatSenderIdentityText(input.senderIdentity);
   }
 
+  // Platform-declared standing facts precede embedder-supplied context
+  // (DD-002 D3): both are standing background, but the declared preferences
+  // are platform-authored while session context is the embedder's overlay —
+  // the more specific overlay reads later and naturally refines.
+  if (input.declaredPreferences) {
+    prompt +=
+      "\n\n## Declared preferences\n\n" +
+      formatDeclaredPreferencesText(input.declaredPreferences);
+  }
+
   // Standing facts about the user (session context) come before the
   // carried conversation (bridge): the bridge may refer back to them.
   if (input.sessionContext) {

package/src/activities/execute-deep-agent/setup.ts

@@ -32,6 +32,7 @@ import {
   resolveCallerIdentity,
 } from "../../shared/caller-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
+import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
@@ -88,12 +89,9 @@ import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
 import {
   mergeSkillRefs,
   fetchSkillsByRefs,
-  writeSkills,
-  computeSkillPaths,
-  checkSkillIntegrity,
+  mountSkills,
   generatePromptSection,
   generateAlsoAvailableSection,
-  fetchSkillArtifacts,
 } from "../../shared/skill-writer.js";
 import { filterSkills, SKILL_COUNT_THRESHOLD } from "../../shared/skill-relevance.js";
 import { injectAttachments } from "./attachment-injector.js";
@@ -478,8 +476,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       const skills = await fetchSkillsByRefs(client, skillRefs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(client, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // platformDir is an invariant of this path: provisionWorkspace below
+        // threads ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          client, skills, workspaceBackend.platformDir!,
+        );
 
         const userMessage = execution.spec!.message || "";
         const skillNames = skills.map(s => s.spec?.name || s.metadata?.slug || "unknown");
@@ -573,6 +574,9 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       contextBridge: readContextBridge(session.spec!.metadata),
       senderIdentity: readSenderIdentity(session.spec!.metadata),
       sessionContext: readSessionContext(session.spec!.metadata),
+      declaredPreferences: readDeclaredPreferences(
+        execution.spec!.declaredPreferences,
+      ),
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -606,16 +610,13 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     const execConfig = execution.spec!.executionConfig;
     const isPlanMode = execConfig?.interactionMode === InteractionMode.PLAN;
     const shellEnv = isPlanMode ? undefined : buildShellEnv(envResult.mergedEnvVars);
-    // Plan mode's filesystem permission rules, hoisted once: the parent graph,
-    // every sub-agent graph, AND the path-normalization middleware (issue #429)
-    // all derive from this single value, so a rule-bearing graph can never miss
-    // the shim that keeps prompt-compliant relative paths from dying in rule
-    // validation (`path must be absolute`). Built from the same rootDir the
-    // backends and the shim resolve against, so the workspace read boundary
-    // (issue #528) and the paths it must admit agree by construction.
-    const planModePermissions = isPlanMode
-      ? buildPlanModePermissions(workspaceBackend.rootDir)
-      : undefined;
+    // Plan mode's filesystem permission rules, hoisted once: the parent graph
+    // and every sub-agent graph carry this single value. The rules are the
+    // write-deny half of plan mode only — the read boundary is structural
+    // (virtual-rooted backends, issue #754), and the path-normalization shim
+    // is no longer tied to the rules: every native graph installs it (see
+    // buildMiddlewareStack below) so the whole harness speaks one dialect.
+    const planModePermissions = isPlanMode ? buildPlanModePermissions() : undefined;
 
     const toolServerMap = new Map<string, string>();
     if (mcpConnection) {
@@ -729,9 +730,10 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       } : null,
       otelSpans: { toolServerMap },
       approvalGate: approvalGateConfig,
-      pathNormalization: planModePermissions
-        ? { rootDir: workspaceBackend.rootDir }
-        : null,
+      // Every graph, every mode (issue #754): the dialect-repair seam that
+      // keeps model-supplied paths canonical for the virtual-rooted backend
+      // and every downstream consumer (gate, capture, spans).
+      pathNormalization: { rootDir: workspaceBackend.rootDir },
     });
     timing.mark("build_middleware");
 

package/src/activities/execute-deep-agent/subagent-transformer.ts

@@ -42,8 +42,7 @@ import { SubAgentGate } from "../../shared/subagent-gate.js";
 import { isModelRegistered } from "../../shared/model-registry.js";
 import {
   fetchSkillsByRefs,
-  fetchSkillArtifacts,
-  writeSkills,
+  mountSkills,
   generatePromptSection,
 } from "../../shared/skill-writer.js";
 
@@ -493,6 +492,10 @@ export function resolveSubagentSkillPrompt(
  *   (approval-gated by the sub-agent's own middleware). Absent (plan mode),
  *   the backend is filesystem-only — read-only by construction, matching the
  *   parent.
+ *
+ * Every variant is virtual-rooted (`virtualMode: true`) like the parent's —
+ * see the cas-capture-backend.ts header (issue #754): workspace confinement
+ * is structural on every graph, sub-agents included.
  */
 async function buildSubagentBackend(opts: {
   readonly workspaceRootDir: string;
@@ -508,11 +511,12 @@ async function buildSubagentBackend(opts: {
   }
 
   if (opts.shellEnv === undefined) {
-    return new FilesystemBackend({ rootDir: opts.workspaceRootDir });
+    return new FilesystemBackend({ rootDir: opts.workspaceRootDir, virtualMode: true });
   }
 
   const shellBackend = new LocalShellBackend({
     rootDir: opts.workspaceRootDir,
+    virtualMode: true,
     env: opts.shellEnv,
   });
   await shellBackend.initialize();
@@ -554,17 +558,14 @@ export async function compileSubagents(
       // Structural coupling (DD-19): a sub-agent gate flows gitignored writes into
       // CAS iff a CAS observer backs that sub-agent's filesystem backend. Deriving
       // both from the same `casObserver` makes "unobserved unreviewable bytes"
-      // impossible by construction. Same idiom for path normalization
-      // (issue #429): derived from the same `permissions` baked into the graph
-      // below, so a rule-bearing graph always carries the shim that keeps
-      // prompt-compliant relative paths from dying in rule validation.
+      // impossible by construction. Path normalization is unconditional
+      // (issue #754): every graph speaks the virtual dialect, so every graph
+      // carries the repair seam — matching the parent's composition.
       const middleware = buildSubAgentMiddleware({
         costCap: opts.costCap,
         approvalGate: opts.approvalGate,
         captureIgnored: !!opts.casObserver,
-        ...(opts.permissions?.length
-          ? { pathNormalization: { rootDir: opts.workspaceRootDir } }
-          : {}),
+        pathNormalization: { rootDir: opts.workspaceRootDir },
       });
 
       const modelName = spec.model ?? opts.parentModelName;
@@ -679,8 +680,14 @@ export async function transformAndCompileSubagents(
       const skills = await fetchSkillsByRefs(skillClient, refs);
 
       if (skills.length > 0) {
-        const artifacts = await fetchSkillArtifacts(skillClient, skills);
-        const { paths: skillPaths } = await writeSkills(skills, workspaceBackend, artifacts);
+        // Runs after the parent's setup step 7b mounted its skills, so any
+        // skill shared by parent and sub-agent is a cache hit here — the
+        // hash-keyed marker turns the old double download into a no-op.
+        // platformDir is an invariant: provisionWorkspace threads
+        // ensurePlatformDir into every backend it constructs.
+        const { paths: skillPaths } = await mountSkills(
+          skillClient, skills, workspaceBackend.platformDir!,
+        );
 
         for (const skill of skills) {
           const slug = (skill as { metadata?: { slug?: string } }).metadata?.slug;

package/src/activities/execute-deep-agent/subagent-wiring.ts

@@ -75,9 +75,9 @@ export interface SubAgentMiddlewareOptions {
    */
   readonly captureIgnored?: boolean;
   /**
-   * Workspace-relative path normalization (issue #429). Present iff this
-   * sub-agent's graph carries filesystem permission rules — the caller
-   * derives it from the same `permissions` value it bakes into the graph.
+   * Virtual-dialect path normalization (issues #429/#754). Present on every
+   * sub-agent graph — the backends are virtual-rooted, so every graph
+   * carries the repair seam, matching the parent composition.
    */
   readonly pathNormalization?: PathNormalizationConfig;
 }

package/src/index.ts

@@ -14,7 +14,7 @@
  * import { createStigmerRunner } from '@stigmer/runner';
  *
  * const runner = await createStigmerRunner({
- *   taskQueue: 'agent_execution_runner',
+ *   taskQueue: 'stigmer_runner',
  *   temporalAddress: 'localhost:7233',
  *   stigmerEndpoint: 'http://localhost:7234',
  * });

package/src/middleware/__tests__/path-normalization.test.ts

@@ -35,36 +35,47 @@ async function argsSeenByHandler(
 }
 
 describe("normalizeWorkspacePathArg", () => {
-  it("maps a workspace-relative path to its rootDir-joined absolute form", () => {
-    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe(`${ROOT}/src/main.py`);
+  it("maps a workspace-relative path to its virtual-absolute form", () => {
+    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe("/src/main.py");
   });
 
-  it("strips a leading ./ before joining", () => {
-    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+  it("strips a leading ./ before rooting", () => {
+    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe("/notes.md");
   });
 
   it("handles multi-workspace entry-relative paths", () => {
     expect(normalizeWorkspacePathArg("entry-1/src/main.py", ROOT)).toBe(
-      `${ROOT}/entry-1/src/main.py`,
+      "/entry-1/src/main.py",
     );
   });
 
   it("resolves interior .. segments that stay inside the root", () => {
-    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe("/notes.md");
+    // Same repair on an already-virtual path: the virtual resolver rejects
+    // `..` outright, so the safe interior collapse happens at this seam.
+    expect(normalizeWorkspacePathArg("/src/../notes.md", ROOT)).toBe("/notes.md");
   });
 
-  it("leaves absolute paths untouched", () => {
+  it("maps a REAL-absolute in-root path to its virtual form (legacy-dialect compatibility)", () => {
+    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBe("/src/main.py");
+    // The root itself is the virtual root.
+    expect(normalizeWorkspacePathArg(ROOT, ROOT)).toBe("/");
+  });
+
+  it("leaves canonical virtual-absolute paths untouched", () => {
+    // In the virtual dialect these are already canonical names — "/etc/hosts"
+    // means the WORKSPACE's etc/hosts, not the host file.
     expect(normalizeWorkspacePathArg("/etc/hosts", ROOT)).toBeUndefined();
-    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("/", ROOT)).toBeUndefined();
   });
 
   it("refuses to rewrite relatives that escape the workspace root", () => {
-    // A naive join would resolve `..` away and hand upstream validation a
-    // clean out-of-root absolute path — an out-of-root read that today's
-    // validation refuses. The guard keeps the refusal.
+    // posix.normalize would silently swallow a leading ".." on an absolute
+    // path — rewriting the call onto a DIFFERENT in-root file. The escape is
+    // detected in relative form and left raw for the upstream refusal.
     expect(normalizeWorkspacePathArg("../sibling/secret.txt", ROOT)).toBeUndefined();
     expect(normalizeWorkspacePathArg("src/../../escape.txt", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("/src/../../escape.txt", ROOT)).toBeUndefined();
   });
 
   it("leaves ~-carrying paths untouched (upstream refuses them either way)", () => {
@@ -84,7 +95,7 @@ describe("createPathNormalizationMiddleware", () => {
         file_path: "src/main.py",
         content: "x",
       });
-      expect(args.file_path).toBe(`${ROOT}/src/main.py`);
+      expect(args.file_path).toBe("/src/main.py");
       // Sibling args ride along untouched.
       expect(args.content).toBe("x");
     }
@@ -93,27 +104,26 @@ describe("createPathNormalizationMiddleware", () => {
   it("rewrites the base path on ls/glob/grep", async () => {
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { path: "src", pattern: "**/*.py" });
-      expect(args.path).toBe(`${ROOT}/src`);
+      expect(args.path).toBe("/src");
       // The pattern is never a path — byte-untouched.
       expect(args.pattern).toBe("**/*.py");
     }
   });
 
-  it("passes absolute paths through byte-untouched", async () => {
+  it("passes canonical virtual paths through byte-untouched", async () => {
     const args = await argsSeenByHandler("read_file", { file_path: "/etc/hosts" });
     expect(args.file_path).toBe("/etc/hosts");
   });
 
-  it("supplies the workspace root when the base path is omitted on ls/glob/grep", async () => {
-    // Deliberate reversal of the original #429 pin ("leaves an omitted base
-    // path alone"): the tools' schema default is "/" — the OS ROOT under the
-    // legacy backend — applied inside the tool AFTER this seam, so under the
-    // #528 workspace read boundary an untouched omission would deny the bare
-    // first listing. The middleware fills the omission with the root it
-    // already knows.
+  it("leaves an omitted base path alone — the tools' '/' default IS the workspace root now", async () => {
+    // Deliberate reversal of the #528 injection: under the legacy backend the
+    // schema default "/" meant the OS ROOT, so the middleware had to fill the
+    // omission. Under the virtual root (issue #754) the default already means
+    // the workspace root — filling it would just duplicate the tool's own
+    // behavior.
     for (const tool of ["ls", "glob", "grep"]) {
       const args = await argsSeenByHandler(tool, { pattern: "TOKEN" });
-      expect(args.path).toBe(ROOT);
+      expect(args.path).toBeUndefined();
       expect(args.pattern).toBe("TOKEN");
     }
   });
@@ -125,16 +135,6 @@ describe("createPathNormalizationMiddleware", () => {
     expect(args.file_path).toBeUndefined();
   });
 
-  it("leaves an explicit '/' untouched on the dir tools — the rules answer it honestly", async () => {
-    // The model asked for the OS root; under plan mode's read boundary the
-    // honest answer is the rules' denial, not silently substituted workspace
-    // contents (the #429 never-convert-a-refusal-into-an-allowance doctrine).
-    for (const tool of ["ls", "glob", "grep"]) {
-      const args = await argsSeenByHandler(tool, { path: "/" });
-      expect(args.path).toBe("/");
-    }
-  });
-
   it("never touches tools outside the built-in filesystem set", async () => {
     // An MCP tool could plausibly carry a same-named arg with different
     // semantics; only the six built-in names are rewritten.