@stigmer/runner 3.12.4 → 3.12.6

package/src/middleware/path-normalization.ts

@@ -1,55 +1,49 @@
 /**
- * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issues #429, #528).
+ * Canonical virtual-path normalization for the native harness's built-in
+ * filesystem tools (issues #429, #528, #754).
  *
- * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
- * rule or backend runs, and its validation refuses non-absolute paths — on
- * EVERY filesystem tool call once a graph carries any permission rules, reads
- * included. Plan mode is the only rule-bearing production configuration
- * (shared/plan-mode-permissions.ts), so there a workspace-relative path —
- * the shape the multi-workspace prompt explicitly mandates, and one models
- * routinely choose in single-workspace sessions — fails with
- * `path must be absolute` instead of just working, burning tool rounds until
- * the model adapts by switching to absolute paths.
+ * The native harness speaks ONE path dialect end to end: the VIRTUAL ROOT,
+ * where "/" denotes the workspace root (backends are constructed with
+ * `virtualMode: true` — see execute-deep-agent/cas-capture-backend.ts). This
+ * middleware is the dialect-repair seam at the model boundary. It rewrites,
+ * on the deepagents built-in filesystem tools only:
  *
- * This middleware repairs the contract at our own seam: it rewrites
- * workspace-relative paths on the deepagents built-in filesystem tools to
- * workspace-absolute before the tool (and therefore enforcement) runs. The
- * write-deny rule then fires as designed and reads succeed on the first try.
- * Rule-less (act-mode) graphs never install it — the legacy backend already
- * resolves relative paths under the workspace root, so act mode keeps a
- * byte-zero delta.
+ *  - workspace-relative paths ("src/x.py", "./notes.md") to their virtual
+ *    absolute form ("/src/x.py") — deepagents' permission validation refuses
+ *    non-absolute shapes on rule-bearing graphs (plan mode), and the prompt
+ *    explicitly mandates entry-relative paths, so without this seam a
+ *    prompt-compliant call would die with `path must be absolute`;
+ *  - REAL-absolute paths under the workspace root ("{root}/src/x.py") to
+ *    their virtual form ("/src/x.py") — the compatibility mapping for the
+ *    pre-#754 dialect, where tool results and transcripts surfaced real
+ *    filesystem paths that a model may still echo back;
+ *  - interior `..` segments that stay inside the root ("src/../notes.md" →
+ *    "/notes.md") — the virtual resolver rejects `..` outright, so a safe
+ *    interior collapse is repaired here rather than burning a tool round.
  *
- * It also supplies the workspace root when `ls`/`glob`/`grep` are called
- * with NO path argument (issue #528). Those tools' schema default is "/" —
- * the OS ROOT under the legacy backend — and the default is applied inside
- * the tool, after this seam, so under the workspace read boundary a bare
- * first `ls` would otherwise die with `permission denied for read on /`
- * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
- * deliberately NOT rewritten: the model asked for the OS root, and the
- * honest answer under plan mode's read boundary is the rules' denial —
- * silently substituting workspace contents would be an answer to a
- * different question.
+ * Nothing becomes newly reachable: escaping relatives ("../x") and
+ * `~`-carrying paths are left raw so the upstream refusal keeps speaking,
+ * and every rewritten path is workspace-confined by the virtual resolver
+ * regardless. The middleware converts false errors into correct behavior —
+ * never a refusal into an allowance.
  *
- * Invariant — nothing becomes newly reachable: only paths whose resolution
- * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
- * and `~`-carrying paths are left raw so today's validation refusal keeps
- * speaking (a naive join would resolve `..` away and smuggle an out-of-root
- * read past validation), and absolute paths pass through byte-untouched.
- * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide. (The absent-path
- * injection honors the same line: it narrows the tool's own OS-root default
- * to the workspace, granting nothing the rules would refuse.)
+ * Installed on EVERY native graph (parent and sub-agent, act and plan mode)
+ * so all downstream consumers — the approval gate's capturability checks,
+ * the CAS observer, otel spans — observe one canonical dialect. The pre-#754
+ * version was installed only beside permission rules and also injected the
+ * workspace root when `ls`/`glob`/`grep` omitted their path (the tools'
+ * schema default "/" was the OS ROOT under the legacy backend); under the
+ * virtual root that default already MEANS the workspace root, so the
+ * injection is retired.
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
  * rewrite touches only the tool's path-bearing argument, never glob/grep
  * patterns. Install FIRST in the stack so every downstream middleware
- * (approval gate, error hints, otel spans) observes canonical paths.
+ * observes canonical paths.
  */
 
-import { isAbsolute, relative } from "node:path";
-import { resolveWorkspacePath } from "../shared/file-change.js";
+import { isAbsolute, relative, posix } from "node:path";
 import type { StigmerMiddleware } from "./types.js";
 
 /**
@@ -66,55 +60,65 @@ const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["edit_file", "file_path"],
 ]);
 
-/**
- * The tools whose path argument is optional with an OS-root ("/") schema
- * default. When the model omits it, this middleware supplies the workspace
- * root instead (issue #528). The file tools are deliberately excluded: an
- * absent `file_path` is a genuine model error, and the tool's own input
- * validation gives the better message.
- */
-const DIR_DEFAULTING_TOOLS: ReadonlySet<string> = new Set(["ls", "glob", "grep"]);
-
 export interface PathNormalizationConfig {
-  /** The workspace root the graph's filesystem backend resolves against. */
+  /**
+   * The REAL workspace root the graph's backend is rooted at — used only for
+   * the legacy-dialect compatibility mapping (real-absolute in-root paths →
+   * virtual). The virtual rewrite itself needs no root.
+   */
   readonly rootDir: string;
 }
 
 /**
- * Rewrite `raw` to its workspace-absolute form, or return undefined when the
- * value must be left untouched (absolute already, `~`-carrying, or escaping
- * the workspace root). Exported for direct unit testing of the mapping table.
+ * Rewrite `raw` to its canonical virtual-absolute form, or return undefined
+ * when the value must be left untouched. Exported for direct unit testing of
+ * the mapping table.
+ *
+ * Left raw (undefined): empty strings, `~`-carrying paths (refused upstream
+ * in every mode), escaping relatives ("../x" — the refusal is the honest
+ * answer), real-absolute paths OUTSIDE the root (virtual dialect: they name
+ * an in-workspace path that simply does not exist — resolution answers
+ * honestly), and paths already in canonical virtual form.
  */
 export function normalizeWorkspacePathArg(
   raw: string,
   rootDir: string,
 ): string | undefined {
-  if (raw.length === 0 || isAbsolute(raw)) return undefined;
-  // Upstream validation refuses `~` segments even in absolute paths, so a
-  // rewrite could not make such a call succeed — leave the raw shape (and
-  // therefore the honest refusal) intact.
+  if (raw.length === 0) return undefined;
+  // Upstream validation refuses `~` segments in every position, and a rewrite
+  // could not make such a call succeed — leave the honest refusal intact.
   if (raw.split("/").includes("~")) return undefined;
 
-  const { absolutePath } = resolveWorkspacePath(raw, rootDir, false);
-
-  // No-new-reachability guard: `join` inside the resolver normalizes `..`
-  // segments away, so an escaping relative would otherwise pass upstream
-  // validation as a clean out-of-root absolute path. Today that shape is
-  // refused; keep it that way.
-  const rel = relative(rootDir, absolutePath);
-  if (rel.startsWith("..") || isAbsolute(rel)) return undefined;
-
-  return absolutePath;
+  // Legacy-dialect compatibility: a REAL absolute path under the workspace
+  // root maps to its virtual form. Any other absolute path is already a
+  // virtual-dialect name — reduced to relative form for canonicalization.
+  let candidate: string;
+  if (isAbsolute(raw)) {
+    const rel = relative(rootDir, raw);
+    if (rel === "") return "/";
+    candidate =
+      rel && !rel.startsWith("..") && !isAbsolute(rel)
+        ? rel
+        : raw.replace(/^\/+/, "");
+  } else {
+    candidate = raw;
+  }
+
+  // Canonicalize in RELATIVE form first: posix.normalize keeps a leading
+  // ".." on relative paths but silently swallows it on absolute ones, and a
+  // swallowed escape would rewrite the call onto a DIFFERENT in-root path —
+  // a refusal converted into an allowance. Detect the escape while it is
+  // still visible, and leave it raw for the upstream refusal.
+  const normalizedRel = posix.normalize(candidate);
+  if (normalizedRel === ".." || normalizedRel.startsWith("../")) return undefined;
+
+  const virtual = normalizedRel === "." ? "/" : `/${normalizedRel}`;
+  return virtual === raw ? undefined : virtual;
 }
 
 /**
- * Create middleware that normalizes workspace-relative paths on the built-in
- * filesystem tools before permission enforcement sees them.
- *
- * Installed only on graphs that carry filesystem permission rules — derive
- * the install condition from the same expression that supplies the rules
- * (setup.ts / compileSubagents) so the rules and their normalization shim
- * cannot drift apart.
+ * Create the dialect-repair middleware (see module header). Stateless per
+ * request; safe on every graph.
  */
 export function createPathNormalizationMiddleware(
   config: PathNormalizationConfig,
@@ -129,22 +133,6 @@ export function createPathNormalizationMiddleware(
       if (!argKey) return handler(request);
 
       const raw = request.toolCall.args[argKey];
-
-      // Absent base directory on ls/glob/grep: the middleware sees the
-      // model's raw args, BEFORE the tool's zod parse applies the "/"
-      // (OS root) schema default — so the omission must be filled here,
-      // where the workspace root is known. An explicit "/" is not this
-      // case and flows through to an honest rule denial (header doctrine).
-      if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
-        return handler({
-          ...request,
-          toolCall: {
-            ...request.toolCall,
-            args: { ...request.toolCall.args, [argKey]: rootDir },
-          },
-        });
-      }
-
       if (typeof raw !== "string") return handler(request);
 
       const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/src/middleware/types.ts

@@ -117,9 +117,9 @@ export interface MiddlewareStackConfig {
   readonly otelSpans?: Partial<OtelSpansConfig>;
   readonly approvalGate?: ApprovalGateConfig | null;
   /**
-   * Workspace-relative path normalization (issue #429). Set iff the graph
-   * carries filesystem permission rules — derive from the same expression
-   * that supplies the rules so the two cannot drift apart.
+   * Virtual-dialect path normalization (issues #429/#754). Set on every
+   * native graph: the backends are virtual-rooted, so every graph carries
+   * the repair seam that keeps model-supplied paths canonical.
    */
   readonly pathNormalization?: PathNormalizationConfig | null;
 }

package/src/runner-manager.ts

@@ -49,6 +49,10 @@ import {
   setQueueDrainCallback,
   forgetQueue,
 } from "./in-flight.js";
+import {
+  registerWorkerShutdownSignal,
+  unregisterWorkerShutdownSignal,
+} from "./shared/worker-shutdown.js";
 
 const SESSION_QUEUE_PREFIX = "session:";
 const WFEXEC_QUEUE_PREFIX = "wfexec:";
@@ -57,16 +61,10 @@ const WFEXEC_QUEUE_PREFIX = "wfexec:";
 // Mirrors SessionDispatchService's convention: lowercase kind, colon, id.
 const POOL_CONTROL_QUEUE_PREFIX = "sandbox:";
 
-/**
- * Module-level registry of shutdown signals per task queue.
- * Activities running in the same process can read this to determine
- * whether their worker is being shut down (vs orchestrator pause).
- */
-const _shutdownSignalRegistry = new Map<string, AbortSignal>();
-
-export function getShutdownSignalForQueue(taskQueue: string): AbortSignal | undefined {
-  return _shutdownSignalRegistry.get(taskQueue);
-}
+// Re-export for existing importers; the registry itself lives in
+// shared/worker-shutdown.ts so the static runner (runner.ts) and the
+// activities can share it without importing this manager module.
+export { getShutdownSignalForQueue } from "./shared/worker-shutdown.js";
 
 export interface RunnerManagerOptions {
   /**
@@ -411,15 +409,12 @@ export async function createStigmerRunnerManager(
 
   const sessions = new Map<string, ManagedSession>();
   const workflowExecutions = new Map<string, ManagedSession>();
-  const shutdownSignals = new Map<string, AbortController>();
   // At most one per process: a pool member IS its control worker's identity.
   let poolControl: { taskQueue: string; managed: ManagedSession } | null = null;
   let shuttingDown = false;
 
   async function createWorkerOnQueue(taskQueue: string): Promise<ManagedSession> {
-    const shutdownController = new AbortController();
-    shutdownSignals.set(taskQueue, shutdownController);
-    _shutdownSignalRegistry.set(taskQueue, shutdownController.signal);
+    const shutdownController = registerWorkerShutdownSignal(taskQueue);
 
     const worker = await Worker.create({
       connection,
@@ -481,8 +476,7 @@ export async function createStigmerRunnerManager(
     managed.worker.shutdown();
     await managed.runPromise;
     registry.delete(id);
-    shutdownSignals.delete(taskQueue);
-    _shutdownSignalRegistry.delete(taskQueue);
+    unregisterWorkerShutdownSignal(taskQueue);
     forgetQueue(taskQueue);
     console.log(`[runner-manager] Removed ${kind} ${id} (active=${registry.size})`);
   }
@@ -620,6 +614,22 @@ export async function createStigmerRunnerManager(
         `[runner-manager] Shutting down ${totalWorkers} workers (${sessions.size} sessions, ${workflowExecutions.size} workflow executions)...`,
       );
 
+      // Mark every queue's shutdown signal BEFORE draining, so an in-flight
+      // activity cancelled by the drain classifies it as a worker shutdown
+      // rather than a user pause (issue #776 — a SIGTERM'd pool member used
+      // to persist EXECUTION_PAUSED and let raw Temporal drain text reach
+      // status.error). Aborting is classification-only: it stops nothing;
+      // worker.shutdown() below still owns the drain. This is deliberately
+      // NOT done in teardownManaged — single-worker teardowns only run once
+      // the queue is idle, and aborting there is the old view-close bug.
+      for (const session of sessions.values()) {
+        session.shutdownController.abort();
+      }
+      for (const execution of workflowExecutions.values()) {
+        execution.shutdownController.abort();
+      }
+      poolControl?.managed.shutdownController.abort();
+
       const shutdownPromises = [
         ...Array.from(sessions.entries()).map(
           async ([id, session]) => {

package/src/runner.ts

@@ -324,6 +324,16 @@ export async function createStigmerRunner(
   // unaffected — their env-injected platform key wins inside the loader.
   const payloadCodecs = await createPayloadCodecs(config, coordinates.payloadEncryption);
 
+  // Register the queue's shutdown signal BEFORE the worker can poll, so an
+  // activity interrupted by shutdown() below classifies the cancellation as a
+  // worker shutdown, not a user pause (issue #776). Static mode historically
+  // never registered one, leaving CLI daemons with the same misclassification
+  // the desktop manager had.
+  const { registerWorkerShutdownSignal } = await import(
+    "./shared/worker-shutdown.js"
+  );
+  const shutdownController = registerWorkerShutdownSignal(config.taskQueue);
+
   const { startWorker } = await import("./worker.js");
   const worker = await startWorker({ config, activities, payloadCodecs });
   markBoot("worker_created");
@@ -349,6 +359,10 @@ export async function createStigmerRunner(
     },
     shutdown() {
       tokenRenewal?.stop();
+      // Classification first, drain second: an in-flight activity cancelled
+      // by the drain must observe the signal already aborted (see
+      // shared/worker-shutdown.ts for the ownership contract).
+      shutdownController.abort();
       worker.shutdown();
     },
   };

package/src/shared/__tests__/artifact-storage.test.ts

@@ -618,6 +618,22 @@ describe("createArtifactStorage", () => {
     };
     expect(() => createArtifactStorage(cfg)).toThrow("STIGMER_TOKEN");
   });
+
+  it("throws for the deliberate 'none' posture — resolveUsable degrades it, claimcheck fail-hards", async () => {
+    const cfg: ArtifactStorageConfig = {
+      type: "none",
+      localPath: "/tmp/artifacts",
+      localServeUrl: "http://localhost:7235",
+      proxyEndpoint: null,
+      proxyAuthToken: null,
+    };
+    expect(() => createArtifactStorage(cfg)).toThrow(/deliberately disabled/i);
+    // The capture/offload resolver treats it as the first-class absent store:
+    // deny-gate mode, not a crash.
+    await expect(
+      resolveUsableArtifactStorage(cfg, { executionId: "exec-none" }),
+    ).resolves.toBeUndefined();
+  });
 });
 
 describe("loadArtifactStorageConfig", () => {
@@ -680,6 +696,18 @@ describe("loadArtifactStorageConfig", () => {
     expect(cfg.proxyAuthToken).toBe("tok");
   });
 
+  it("honors ARTIFACT_STORAGE_TYPE=none even when a proxy endpoint is configured", () => {
+    // "none" is a deliberate operator/e2e posture — it must beat the
+    // storage-follows-transport default exactly like the other overrides.
+    process.env.ARTIFACT_STORAGE_TYPE = "none";
+    const cfg = loadArtifactStorageConfig({
+      ...baseConfig,
+      proxyEndpoint: "https://proxy.example.com",
+      stigmerToken: "tok",
+    });
+    expect(cfg.type).toBe("none");
+  });
+
   it("respects ARTIFACT_STORAGE_TYPE override", () => {
     process.env.ARTIFACT_STORAGE_TYPE = "proxy";
     const cfg = loadArtifactStorageConfig({

package/src/shared/__tests__/bedrock-seam.test.ts

@@ -2,11 +2,11 @@
  * Characterization test for the ChatAnthropic `createClient` ->
  * AnthropicBedrock seam — the integration the T04 bedrock backend adapter
  * is built on. Sibling of vertex-seam.test.ts; same rules: this pins REAL
- * cross-package behavior (`@langchain/anthropic` bundling @anthropic-ai/sdk
- * 0.95.x driving `@anthropic-ai/bedrock-sdk` bundling its own nested
- * >=0.115 copy), so a future bump of either side fails here in CI instead
- * of in production. See scripts/check-langchain-deps.sh for why the two
- * @anthropic-ai/sdk versions coexist and when they collapse to one.
+ * cross-package behavior (`@langchain/anthropic` driving
+ * `@anthropic-ai/bedrock-sdk`, both resolving the single override-pinned
+ * @anthropic-ai/sdk copy), so a future bump of either side fails here in
+ * CI instead of in production. See scripts/check-langchain-deps.sh for
+ * the override rationale and the single-copy invariant it guards.
  *
  * Determinism: zero live credentials, zero network. SigV4 signing runs for
  * real — it is pure HMAC over static test keys passed through the SDK's

package/src/shared/__tests__/declared-preferences.test.ts

@@ -0,0 +1,109 @@
+/**
+ * Unit tests for the declared-preferences module (stigmer/stigmer#293,
+ * DD-002). Like conversation-catchup there is no string key to mirror-guard —
+ * the value rides the typed `AgentExecutionSpec.declared_preferences` proto
+ * field, so codegen enforces the cross-repo contract. What IS pinned here:
+ * the per-scope blank-is-absent read semantics (the server stamps the field
+ * on EVERY eligible create, usually with blank scopes), the per-scope
+ * attribution, and the framing's behavioral contract.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { DeclaredPreferencesSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+
+import {
+  formatDeclaredPreferencesText,
+  readDeclaredPreferences,
+} from "../declared-preferences.js";
+
+const ORG_CONTEXT = "We deploy to us-east-1. All costs in USD.";
+const USER_CONTEXT = "Keep answers terse. Prefer Go examples.";
+
+describe("readDeclaredPreferences", () => {
+  it("reads both scopes when both are set", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+  });
+
+  it("answers undefined when the field is absent (pre-#293 executions)", () => {
+    expect(readDeclaredPreferences(undefined)).toBeUndefined();
+  });
+
+  it("answers undefined when both scopes are blank — the server stamps the field on every eligible create", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: "  ",
+      userContext: "",
+    });
+    expect(readDeclaredPreferences(preferences)).toBeUndefined();
+  });
+
+  it("blank-is-absent applies per scope: an org-only snapshot carries no user scope", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: ORG_CONTEXT,
+      userContext: "   ",
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: ORG_CONTEXT,
+      userContext: undefined,
+    });
+  });
+
+  it("trims surrounding whitespace from each scope", () => {
+    const preferences = create(DeclaredPreferencesSchema, {
+      orgContext: "  org facts  ",
+      userContext: "\nuser facts\n",
+    });
+    expect(readDeclaredPreferences(preferences)).toEqual({
+      orgContext: "org facts",
+      userContext: "user facts",
+    });
+  });
+});
+
+describe("formatDeclaredPreferencesText", () => {
+  it("frames the preferences as already-known, non-announced background", () => {
+    const framed = formatDeclaredPreferencesText({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+
+    expect(framed).toContain("Standing preferences declared by");
+    expect(framed).toContain("Do not repeat them back");
+    expect(framed).toContain("not instructions that override your task");
+  });
+
+  it("attributes each scope explicitly, organization first, user last", () => {
+    const framed = formatDeclaredPreferencesText({
+      orgContext: ORG_CONTEXT,
+      userContext: USER_CONTEXT,
+    });
+
+    const org = framed.indexOf("Declared by the organization:");
+    const user = framed.indexOf("Declared by the user:");
+    expect(org).toBeGreaterThan(-1);
+    expect(user).toBeGreaterThan(org);
+    expect(framed).toContain(ORG_CONTEXT);
+    expect(framed.endsWith(USER_CONTEXT)).toBe(true);
+  });
+
+  it("renders only the org subsection for an org-only snapshot", () => {
+    const framed = formatDeclaredPreferencesText({ orgContext: ORG_CONTEXT });
+
+    expect(framed).toContain("Declared by the organization:");
+    expect(framed).not.toContain("Declared by the user:");
+  });
+
+  it("renders only the user subsection for a user-only snapshot", () => {
+    const framed = formatDeclaredPreferencesText({ userContext: USER_CONTEXT });
+
+    expect(framed).not.toContain("Declared by the organization:");
+    expect(framed).toContain("Declared by the user:");
+  });
+});

package/src/shared/__tests__/foundry-seam.test.ts

@@ -3,11 +3,11 @@
  * AnthropicFoundry seam — the integration the T05 foundry backend adapter
  * is built on. Sibling of vertex-seam.test.ts and bedrock-seam.test.ts;
  * same rules: this pins REAL cross-package behavior (`@langchain/anthropic`
- * bundling @anthropic-ai/sdk 0.95.x driving `@anthropic-ai/foundry-sdk`
- * bundling its own nested >=0.115 copy), so a future bump of either side
- * fails here in CI instead of in production. See
- * scripts/check-langchain-deps.sh for why the two @anthropic-ai/sdk
- * versions coexist and when they collapse to one.
+ * driving `@anthropic-ai/foundry-sdk`, both resolving the single
+ * override-pinned @anthropic-ai/sdk copy), so a future bump of either
+ * side fails here in CI instead of in production. See
+ * scripts/check-langchain-deps.sh for the override rationale and the
+ * single-copy invariant it guards.
  *
  * Determinism: zero live credentials, zero network. API-key auth is a
  * static test key; Entra ID auth is a fake `azureADTokenProvider` (the

package/src/shared/__tests__/plan-mode-permissions.test.ts

@@ -1,58 +1,29 @@
 /**
- * Unit pins for the plan-mode rule builder (issue #528).
+ * Unit pins for the plan-mode rule builder.
  *
- * The rule ORDER and SHAPE are the security boundary: deepagents evaluates
- * first-match-wins with a permissive default, so the workspace read-allow
- * must precede the read-deny, and the deny patterns must be the match-all
- * "/**". These tests pin the built value; the boundary's end-to-end
- * behavior (including matcher semantics for escaped roots and symlinked
- * platform paths) is pinned against the real deepagents runtime in
+ * Since issue #754 the rules carry ONLY plan mode's write-deny: the read
+ * boundary is structural (virtual-rooted backends confine every path to the
+ * workspace), so there is no workspace-root glob, no escaping, and no rule
+ * ordering left to protect. The single rule's SHAPE is still the security
+ * boundary for writes — "/**" must stay the match-all virtual pattern and
+ * the operation class must stay `write` (deepagents evaluates
+ * first-match-wins with a permissive default, so reads flow by omission).
+ * End-to-end behavior is pinned against the real deepagents runtime in
  * execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts.
  */
 
 import { describe, it, expect } from "vitest";
-import {
-  buildPlanModePermissions,
-  escapeGlobLiteral,
-} from "../plan-mode-permissions.js";
+import { buildPlanModePermissions } from "../plan-mode-permissions.js";
 
 describe("buildPlanModePermissions", () => {
-  it("builds the policy in enforcement order: workspace read-allow, then read-deny, then write-deny", () => {
-    expect(buildPlanModePermissions("/ws/session-1/repo")).toEqual([
-      { operations: ["read"], paths: ["/ws/session-1/repo/**"] },
-      { operations: ["read"], paths: ["/**"], mode: "deny" },
+  it("builds exactly the write-deny policy in the virtual dialect", () => {
+    expect(buildPlanModePermissions()).toEqual([
       { operations: ["write"], paths: ["/**"], mode: "deny" },
     ]);
   });
 
-  it("canonicalizes the root before building the pattern", () => {
-    // Enforcement canonicalizes incoming paths (no trailing separator,
-    // collapsed slashes) before matching — a pattern built from a raw
-    // trailing-slash root would silently match nothing.
-    const [allow] = buildPlanModePermissions("/ws//session-1/repo/");
-    expect(allow.paths).toEqual(["/ws/session-1/repo/**"]);
-  });
-
-  it("glob-escapes the root so special characters match literally", () => {
-    const [allow] = buildPlanModePermissions("/Users/x/My (work) [v2]");
-    expect(allow.paths).toEqual(["/Users/x/My \\(work\\) \\[v2\\]/**"]);
-  });
-});
-
-describe("escapeGlobLiteral", () => {
-  it("escapes every micromatch metacharacter", () => {
-    expect(escapeGlobLiteral("a*b?c(d)e[f]g{h}i!j+k@l")).toBe(
-      "a\\*b\\?c\\(d\\)e\\[f\\]g\\{h\\}i\\!j\\+k\\@l",
-    );
-  });
-
-  it("escapes backslashes themselves", () => {
-    expect(escapeGlobLiteral("a\\b")).toBe("a\\\\b");
-  });
-
-  it("leaves plain path characters alone", () => {
-    expect(escapeGlobLiteral("/ws/session-1/repo.dir")).toBe(
-      "/ws/session-1/repo.dir",
-    );
+  it("carries no read rules — the read boundary is structural, not policy", () => {
+    const operations = buildPlanModePermissions().flatMap((rule) => rule.operations);
+    expect(operations).not.toContain("read");
   });
 });