@stigmer/runner 3.12.4 → 3.12.6

package/src/shared/__tests__/vertex-seam.test.ts

@@ -4,13 +4,13 @@
  *
  * This is NOT a unit test of our code (there is no production vertex code
  * yet). It pins the exact cross-package behavior production will rely on:
- * the REAL `ChatAnthropic` (@langchain/anthropic, bundling @anthropic-ai/sdk
- * 0.95.x) driving the REAL `AnthropicVertex` client (@anthropic-ai/vertex-sdk,
- * bundling its own nested @anthropic-ai/sdk >=0.115). If a future bump of
+ * the REAL `ChatAnthropic` (@langchain/anthropic) driving the REAL
+ * `AnthropicVertex` client (@anthropic-ai/vertex-sdk), both resolving the
+ * single override-pinned @anthropic-ai/sdk copy. If a future bump of
  * either side changes request shaping, streaming event handling, tool-call
  * assembly, or usage accounting across this seam, this suite fails in CI
- * instead of production. See scripts/check-langchain-deps.sh for why two
- * @anthropic-ai/sdk copies coexist and when they collapse to one.
+ * instead of production. See scripts/check-langchain-deps.sh for the
+ * override rationale and the single-copy invariant it guards.
  *
  * Determinism: zero credentials, zero network. Google auth is bypassed by
  * injecting a fake `authClient` (the SDK's supported constructor option —

package/src/shared/__tests__/worker-shutdown.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, it } from "vitest";
+import {
+  classifyTurnInterruption,
+  getShutdownSignalForQueue,
+  registerWorkerShutdownSignal,
+  signalWorkerShutdown,
+  unregisterWorkerShutdownSignal,
+} from "../worker-shutdown.js";
+
+describe("worker-shutdown signal registry", () => {
+  it("registers a live signal an activity can resolve by queue name", () => {
+    const controller = registerWorkerShutdownSignal("session:reg-1");
+    const signal = getShutdownSignalForQueue("session:reg-1");
+    expect(signal).toBe(controller.signal);
+    expect(signal?.aborted).toBe(false);
+    unregisterWorkerShutdownSignal("session:reg-1");
+  });
+
+  it("aborting via signalWorkerShutdown marks the queue's signal (idempotent, unknown queues are no-ops)", () => {
+    registerWorkerShutdownSignal("session:abort-1");
+    signalWorkerShutdown("session:abort-1");
+    signalWorkerShutdown("session:abort-1");
+    expect(getShutdownSignalForQueue("session:abort-1")?.aborted).toBe(true);
+    expect(() => signalWorkerShutdown("session:never-registered")).not.toThrow();
+    unregisterWorkerShutdownSignal("session:abort-1");
+  });
+
+  it("re-registering a reused queue replaces an aborted signal with a fresh one", () => {
+    // A re-created worker on a reused queue (desktop re-opens a session) must
+    // not observe the previous worker's aborted signal as its own shutdown.
+    const first = registerWorkerShutdownSignal("session:reuse-1");
+    first.abort();
+    const second = registerWorkerShutdownSignal("session:reuse-1");
+    expect(getShutdownSignalForQueue("session:reuse-1")).toBe(second.signal);
+    expect(getShutdownSignalForQueue("session:reuse-1")?.aborted).toBe(false);
+    unregisterWorkerShutdownSignal("session:reuse-1");
+  });
+
+  it("unregistering removes the signal", () => {
+    registerWorkerShutdownSignal("session:gone-1");
+    unregisterWorkerShutdownSignal("session:gone-1");
+    expect(getShutdownSignalForQueue("session:gone-1")).toBeUndefined();
+  });
+});
+
+describe("classifyTurnInterruption", () => {
+  const none = {
+    heartbeatCancelled: false,
+    heartbeatWorkerShutdown: false,
+    cancellationSignalAborted: false,
+    shutdownSignalAborted: false,
+  };
+
+  it("an uninterrupted turn is none", () => {
+    expect(classifyTurnInterruption(none)).toBe("none");
+  });
+
+  it("GRACE-WINDOW GUARD (#776): an aborted shutdown signal alone stays none — a run that completed inside the drain grace window must not be failed", () => {
+    expect(
+      classifyTurnInterruption({ ...none, shutdownSignalAborted: true }),
+    ).toBe("none");
+  });
+
+  it("heartbeat cancellation without a shutdown signal is the orchestrator's pause", () => {
+    expect(
+      classifyTurnInterruption({ ...none, heartbeatCancelled: true }),
+    ).toBe("pause");
+  });
+
+  it("heartbeat cancellation WITH the shutdown signal aborted is a worker shutdown, not a pause (the #776 misclassification)", () => {
+    expect(
+      classifyTurnInterruption({
+        ...none,
+        heartbeatCancelled: true,
+        shutdownSignalAborted: true,
+      }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("the heartbeat's own workerShutdown flag classifies directly", () => {
+    expect(
+      classifyTurnInterruption({ ...none, heartbeatWorkerShutdown: true }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("a delivered cancellation with the shutdown signal aborted is a worker shutdown (signal races the heartbeat tick)", () => {
+    expect(
+      classifyTurnInterruption({
+        ...none,
+        cancellationSignalAborted: true,
+        shutdownSignalAborted: true,
+      }),
+    ).toBe("worker-shutdown");
+  });
+
+  it("a delivered cancellation alone (heartbeat timeout / infra cancel) is neither shutdown nor pause", () => {
+    expect(
+      classifyTurnInterruption({ ...none, cancellationSignalAborted: true }),
+    ).toBe("none");
+  });
+});

package/src/shared/args-preview.ts

@@ -34,11 +34,25 @@ export const MAX_ARGS_PREVIEW_LENGTH = 500;
  * Cursor gate path must instead use {@link buildElidedArgsPreview}, which keeps
  * the JSON valid and preserves the salient identity fields.
  */
-export function sanitizeArgsPreview(args: Record<string, unknown>): string {
-  const sanitized: Record<string, unknown> = {};
+/**
+ * Redact secret-keyed values (see {@link SENSITIVE_ARG_KEYS}), preserving every
+ * other entry verbatim. The shared first step of both preview builders, and the
+ * shape stamped as `args` on interrupt-placeholder tool calls (issue #754's
+ * header fix): full enough for the UI's path/primary-arg extraction, never
+ * carrying a secret value.
+ */
+export function redactSensitiveArgs(
+  args: Record<string, unknown>,
+): Record<string, unknown> {
+  const redacted: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(args)) {
-    sanitized[key] = SENSITIVE_ARG_KEYS.has(key.toLowerCase()) ? "[REDACTED]" : value;
+    redacted[key] = SENSITIVE_ARG_KEYS.has(key.toLowerCase()) ? "[REDACTED]" : value;
   }
+  return redacted;
+}
+
+export function sanitizeArgsPreview(args: Record<string, unknown>): string {
+  const sanitized = redactSensitiveArgs(args);
   try {
     const json = JSON.stringify(sanitized);
     return json.length > MAX_ARGS_PREVIEW_LENGTH

package/src/shared/artifact-storage.ts

@@ -56,7 +56,17 @@ export interface ArtifactStorage {
   exists(key: string): Promise<boolean>;
 }
 
-export type ArtifactStorageType = "local" | "proxy";
+/**
+ * "none" is the explicit no-store posture: capture degrades to the deny-gate
+ * (file writes gated pre-execution, DD-22/DD-26) and offload is disabled —
+ * the same first-class absent-store state a proxy misconfig or unwritable
+ * local path resolves to, but chosen deliberately (ARTIFACT_STORAGE_TYPE=none)
+ * instead of reached by failure. The e2e file-gate stack boots with it, and
+ * an operator can use it to force gate-everything behavior. It is only valid
+ * where an absent store is: claimcheck (fail-hard by contract) refuses it at
+ * construction.
+ */
+export type ArtifactStorageType = "local" | "proxy" | "none";
 
 // ── Local Backend ────────────────────────────────────────────────────
 
@@ -371,6 +381,7 @@ export function loadArtifactStorageConfig(config: Config): ArtifactStorageConfig
   const type: ArtifactStorageType =
     envType === "proxy" ? "proxy" :
     envType === "local" ? "local" :
+    envType === "none" ? "none" :
     config.proxyEndpoint ? "proxy" : "local";
 
   return {
@@ -387,6 +398,14 @@ export function loadArtifactStorageConfig(config: Config): ArtifactStorageConfig
 }
 
 export function createArtifactStorage(cfg: ArtifactStorageConfig): ArtifactStorage {
+  if (cfg.type === "none") {
+    // Deliberate no-store posture. Throwing keeps both consumers honest:
+    // resolveUsableArtifactStorage catches and degrades to the deny-gate
+    // (the intent of "none"), while claimcheck's direct fail-hard call
+    // surfaces the config contradiction at boot instead of silently
+    // dropping Temporal payloads.
+    throw new Error("ARTIFACT_STORAGE_TYPE=none: artifact storage deliberately disabled");
+  }
   if (cfg.type === "proxy") {
     if (!cfg.proxyEndpoint) {
       throw new Error("Proxy artifact storage requires STIGMER_PROXY_ENDPOINT");

package/src/shared/caller-identity.ts

@@ -58,15 +58,18 @@ export const ANONYMOUS_KIND = "anonymous";
 
 /**
  * Audit-actor id that backends stamp when NO caller identity exists —
- * the OSS server writes it on every create (no local auth), and the
- * cloud's AuditActorBuilder falls back to it for caller-less internal
- * writes. It names "nobody in particular": unrelated sessions from
- * unrelated people all carry it, so presenting it as a caller identity
- * would make the one string a grantable value that silently covers ALL
- * such traffic in an MCP server's binding sheet. A creator matching this
+ * the OSS server writes it on every create unless the deployment
+ * configured an operator identity (STIGMER_OPERATOR_EMAIL,
+ * stigmer/stigmer#400; a configured install stamps a real actor whose
+ * email resolves below like any other), and the cloud's
+ * AuditActorBuilder falls back to it for caller-less internal writes.
+ * It names "nobody in particular": unrelated sessions from unrelated
+ * people all carry it, so presenting it as a caller identity would make
+ * the one string a grantable value that silently covers ALL such
+ * traffic in an MCP server's binding sheet. A creator matching this
  * sentinel (and carrying no email) is therefore unresolvable and falls
  * to anonymous — the deny-by-default the docs guide already promises
- * for self-hosted backends.
+ * for unconfigured self-hosted backends.
  */
 export const SYSTEM_CREATOR_SENTINEL = "system";
 

package/src/shared/declared-preferences.ts

@@ -0,0 +1,84 @@
+/**
+ * Declared preferences (stigmer/stigmer#293, DD-002): standing free-text
+ * preferences the organization and the calling user declared once — "keep
+ * answers terse", "we deploy to us-east-1" — that every eligible execution
+ * receives without the user re-typing them.
+ *
+ * The server composes the CONTENT at execution create: the create pipeline
+ * snapshots `Organization.spec.preferences.standing_context` and (cloud, for
+ * first-party human callers only) the caller
+ * `IdentityAccount.spec.preferences.standing_context` verbatim onto the
+ * execution spec's `declared_preferences` field. This module owns the
+ * PRESENTATION — the preamble and the per-scope attribution — so the framing
+ * cannot drift between harnesses.
+ *
+ * Like conversation-catchup (its typed-field sibling) there is no metadata
+ * key to mirror-guard: the value rides a TYPED proto field, so codegen
+ * enforces the cross-repo contract. Degradation is safe by construction: an
+ * absent or blank field renders nothing, and a runner predating this module
+ * simply ignores it — the agent runs without preferences, exactly the
+ * pre-#293 behavior, never worse.
+ */
+
+import type { DeclaredPreferences } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+
+/**
+ * How the preferences are introduced to the model, shared by both harnesses
+ * so the behavioral contract cannot drift between them. Same posture as the
+ * session-context channel: calibration material, never authority — the task
+ * always outranks a standing preference.
+ */
+const DECLARED_PREFERENCES_PREAMBLE =
+  "Standing preferences declared by the organization and/or the user you " +
+  "are assisting. Treat them as background you already know: use them to " +
+  "calibrate depth, defaults, and tone. Do not repeat them back, quote " +
+  "them, or mention that you received them. They are context, not " +
+  "instructions that override your task.";
+
+/**
+ * The non-blank preference scopes of an execution, in presentation order.
+ * At least one scope is set (the read function returns undefined otherwise).
+ */
+export interface DeclaredPreferencesContent {
+  /** The organization's standing context, trimmed; absent when blank. */
+  orgContext?: string;
+  /** The calling user's standing context, trimmed; absent when blank. */
+  userContext?: string;
+}
+
+/**
+ * Read the declared preferences from an execution spec's
+ * `declared_preferences`. Returns undefined when the field is absent or both
+ * scopes are blank — the caller renders no section. Blank-is-absent applies
+ * PER SCOPE: an org-only snapshot renders only the org subsection.
+ */
+export function readDeclaredPreferences(
+  preferences: DeclaredPreferences | undefined,
+): DeclaredPreferencesContent | undefined {
+  const orgContext = preferences?.orgContext?.trim() || undefined;
+  const userContext = preferences?.userContext?.trim() || undefined;
+  if (!orgContext && !userContext) {
+    return undefined;
+  }
+  return { orgContext, userContext };
+}
+
+/**
+ * The framed preferences body (preamble + labeled per-scope subsections),
+ * ready for section wrapping. Attribution is explicit — the model must know
+ * WHO declared what. Organization first, user last: the user's refinement
+ * reads last and so naturally wins where the two conflict, without this
+ * module encoding any override rule.
+ */
+export function formatDeclaredPreferencesText(
+  content: DeclaredPreferencesContent,
+): string {
+  const sections: string[] = [DECLARED_PREFERENCES_PREAMBLE];
+  if (content.orgContext) {
+    sections.push(`Declared by the organization:\n${content.orgContext}`);
+  }
+  if (content.userContext) {
+    sections.push(`Declared by the user:\n${content.userContext}`);
+  }
+  return sections.join("\n\n");
+}

package/src/shared/mcp-enabled-tools.ts

@@ -7,9 +7,8 @@
  * - An empty usage list falls back to the server's default_enabled_tools.
  * - Both empty means NO restriction — every discovered tool is available.
  *
- * Both harnesses import THIS module so they can never drift on these
- * semantics (the mcp-transport-guard precedent for logic shared across the
- * duplicated resolvers — see the header of shared/mcp-resolver.ts):
+ * Resolution is shared (shared/mcp-resolver.ts threads the effective list
+ * onto every ResolvedMcpServer), but ENFORCEMENT is per-harness:
  * - The deep-agent harness filters the discovered toolset before it reaches
  *   the model (shared/mcp-manager.ts connectMcpServers).
  * - The Cursor harness cannot hide tools (the Cursor SDK's McpServerConfig

package/src/shared/mcp-resolver.ts

@@ -2,13 +2,17 @@
  * Resolves Stigmer McpServerUsage references into an intermediate
  * ResolvedMcpServer format.
  *
- * Consumers: the deep-agent harness (execute-deep-agent/setup.ts), the
- * connect backfill (shared/connect-backfill.ts), and the discovery
- * activity (activities/discover-mcp-server.ts, via mcpServerToResolved).
- * NOTE: the Cursor harness does NOT use this module — it has its own
- * near-duplicate resolver at activities/execute-cursor/mcp-resolver.ts.
- * A behavioral change here (like the transport guard) must be mirrored
- * there until the two are consolidated.
+ * THE single resolver for both harnesses (oss#387 retired the Cursor
+ * harness's near-duplicate): the deep-agent harness
+ * (execute-deep-agent/setup.ts), the Cursor harness
+ * (execute-cursor/index.ts), the connect backfill
+ * (shared/connect-backfill.ts), and the discovery activity
+ * (activities/discover-mcp-server.ts, via mcpServerToResolved) all consume
+ * it. Each harness maps the result into its SDK format at the last hop:
+ * toMcpClientConfig (shared/mcp-manager.ts) for LangChain,
+ * toCursorMcpConfig (execute-cursor/cursor-mcp-config.ts) for the Cursor
+ * SDK — so a behavioral change here (like the transport guard) lands in
+ * both execution paths by construction.
  */
 
 import type { McpServerUsage, ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
@@ -51,8 +55,11 @@ export interface ResolvedMcpServer {
    * enabled_tools, falling back to the server's default_enabled_tools when
    * the usage's list is empty (see shared/mcp-enabled-tools.ts). Absent when
    * unrestricted — which keeps synthesized attachment servers (built without
-   * a usage) and the discovery path unfiltered by construction. Enforced at
-   * connect time by connectMcpServers (shared/mcp-manager.ts).
+   * a usage) and the discovery path unfiltered by construction. Enforcement
+   * is per-harness: the deep-agent path filters at connect time
+   * (connectMcpServers, shared/mcp-manager.ts); the Cursor SDK config cannot
+   * hide tools, so that harness denies non-enabled calls in the HITL hook
+   * (see hook-script.ts).
    */
   enabledTools?: string[];
   /**
@@ -61,11 +68,10 @@ export interface ResolvedMcpServer {
    * override to its own server — a flat cross-server list is how an
    * override once leaked onto (or silently un-gated) a same-named tool on
    * another server. Deliberately REQUIRED, not optional: empty means "no
-   * overrides", and every construction site — including the near-duplicate
-   * Cursor resolver and the synthesized attachments, which have no usage
-   * and therefore no layer 3 — must say so explicitly, so a forgotten
-   * mirror cannot compile. Consumed by mergeApprovalPolicies
-   * (shared/approval-policy.ts).
+   * overrides", and every construction site — including the synthesized
+   * attachments, which have no usage and therefore no layer 3 — must say so
+   * explicitly, so a forgotten site cannot compile. Consumed by
+   * mergeApprovalPolicies (shared/approval-policy.ts).
    */
   toolApprovalOverrides: ToolApprovalOverride[];
 }
@@ -202,12 +208,6 @@ export function mcpServerToResolved(
   }
 }
 
-export function extractMcpServerSlugs(usages: McpServerUsage[]): string[] {
-  return usages
-    .map((u) => u.mcpServerRef?.slug)
-    .filter((s): s is string => !!s);
-}
-
 /**
  * Merge MCP server usages from agent (base) and session (overlay).
  *

package/src/shared/placeholder-resolver.ts

@@ -1,8 +1,10 @@
 /**
  * Strict placeholder resolver for ${VAR_NAME} syntax in MCP server configs.
  *
+ * Port of the Python agent-runner's PlaceholderResolver (strict mode only).
  * Always raises on unresolved placeholders — sending literal ${VAR} as an
- * HTTP header value produces cryptic auth failures from the remote server.
+ * HTTP header value (e.g. Authorization: Bearer ${API_KEY}) produces
+ * cryptic auth failures from the remote server.
  */
 
 const PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -41,6 +43,9 @@ export function resolvePlaceholders(
 
 /**
  * Resolve placeholders in all values of a headers map.
+ *
+ * @throws PlaceholderResolutionError if any header value contains an
+ *   unresolvable placeholder.
  */
 export function resolveHeaders(
   headers: Record<string, string>,
@@ -55,7 +60,9 @@ export function resolveHeaders(
 
 /**
  * Filter env vars to only keys declared in the MCP server's spec.env.
- * Prevents secret over-sharing by restricting the environment to
+ *
+ * Mirrors the agent-runner's _filter_env_to_declared_keys: prevents
+ * secret over-sharing by restricting the subprocess/HTTP environment to
  * explicitly declared variables.
  */
 export function filterEnvToDeclaredKeys(

package/src/shared/plan-mode-permissions.ts

@@ -2,26 +2,25 @@
  * The Plan-mode filesystem permission rules — the enforcement twin of
  * `plan-mode-prompt.ts` (which carries the instruction half of the contract).
  *
- * Plan mode is contained BY CONSTRUCTION on the native harness: these rules
- * deny every filesystem write everywhere AND scope reads to the session
- * workspace (issue #528 — owner ruling: the workspace is plan mode's read
- * boundary on cloud and desktop runners alike). Without the read boundary,
- * model-provided absolute paths reached anywhere the process account could
- * read — the pod filesystem (including /proc/self/environ) on cloud runners,
- * the user's whole home directory on desktop — while plan mode still carries
- * exfiltration-capable tools (web_fetch, MCP). Rules are first-match-wins
- * with a permissive default (deepagents' decidePathAccess), so order is
- * load-bearing: the workspace read-allow must precede the read-deny.
+ * Plan mode's policy is: reads anywhere in the workspace, writes nowhere.
+ * Only the write half needs a RULE. The read boundary that issue #528 built
+ * out of rules (workspace read-allow + read-deny, glob-escaped real root) is
+ * now STRUCTURAL: every native-harness backend is virtual-rooted
+ * (`virtualMode: true` — see cas-capture-backend.ts, issue #754), so every
+ * path a tool can express resolves inside the workspace root and traversal
+ * is rejected at resolution. A rule cannot widen that, and no workspace-root
+ * glob is needed to narrow it — which also retires the whole
+ * special-characters-in-the-root hazard (`escapeGlobLiteral` and its
+ * end-to-end matcher suite) that the real-path rules carried.
  *
- * The workspace-root pattern is matched as a STRING against the raw tool-call
- * path (micromatch, dot:true), before the backend touches disk. That is
- * exactly why the legitimate out-of-workspace reads keep working: skills,
- * attachments, and the approved plan live in the platform dir but are
- * addressed through the `{workspace}/.stigmer` symlink (see
- * shared/workspace/stigmer-link.ts), so their path strings are in-root even
- * though the bytes are not. The same holds for multi-workspace local entries
- * (`{workspace}/{name}` symlinks). A realpath-based boundary would break
- * both; do not "harden" this into one.
+ * Paths in these rules are VIRTUAL: "/" is the workspace root, matched by
+ * micromatch against the raw tool-call path (dot:true) after the
+ * path-normalization middleware has canonicalized it (relative → "/"-rooted;
+ * see middleware/path-normalization.ts). The legitimate platform-dir reads
+ * (skills, attachments, the approved plan) keep working exactly as before:
+ * they are addressed through the `{workspace}/.stigmer` symlink
+ * (shared/workspace/stigmer-link.ts), an in-root path string in either
+ * dialect.
  *
  * Applied in execute-deep-agent/setup.ts to the parent graph AND threaded
  * into every compiled sub-agent graph: deepagents' parent-permission
@@ -30,13 +29,6 @@
  * (issue #255). Kept as its own side-effect-free module so tests can pin the
  * production rules without dragging in setup.ts's import graph.
  *
- * Rules travel with a companion: every graph that carries them also installs
- * the path-normalization middleware (middleware/path-normalization.ts,
- * issues #429/#528), because deepagents' rule validation refuses
- * workspace-relative paths outright and its `ls`/`glob`/`grep` schema default
- * of "/" would deny the bare first listing. Both are derived from the same
- * expression at each composition site so they cannot drift apart.
- *
  * Invariant: never combine these rules with a shell-capable (sandbox)
  * backend — deepagents rejects that pairing at graph construction (see the
  * cas-capture-backend.ts header). Plan mode guarantees it by construction:
@@ -44,41 +36,18 @@
  * for shell capability on both the parent and sub-agent backends.
  */
 
-import { resolve } from "node:path";
 import type { FilesystemPermission } from "deepagents";
 
 /**
- * Backslash-escape every character micromatch/picomatch treats as glob
- * syntax, so the result matches the input literally. micromatch exports no
- * escape API of its own, and this is correctness, not caution: an unescaped
- * `(` in a desktop project path would make the workspace read-allow rule
- * silently never match — bricking every plan-mode read for that workspace.
- * Semantics are pinned end-to-end through deepagents' own matcher by the
- * special-character workspace suite in plan-mode-path-normalization.test.ts.
- */
-export function escapeGlobLiteral(literal: string): string {
-  return literal.replace(/[\\*?()[\]{}!+@]/g, "\\$&");
-}
-
-/**
- * Build the plan-mode rule set for a graph whose filesystem backend is
- * rooted at `workspaceRootDir`. The three rules read as the policy:
- * reads allowed in the workspace, reads denied everywhere else, writes
- * denied everywhere.
+ * Build the plan-mode rule set. One rule IS the policy: writes denied
+ * everywhere ("/**" is every virtual path; deepagents evaluates
+ * first-match-wins with a permissive default, so reads stay allowed —
+ * workspace-confined structurally, not by rule).
  *
- * `{root}/**` matches the root itself as well as its subtree (verified
- * against the installed micromatch), so one allow pattern suffices. The
- * root is `path.resolve`d first because enforcement canonicalizes incoming
- * paths (collapsed slashes, no trailing separator) before matching — a
- * trailing slash in the pattern would silently match nothing.
+ * Deliberately parameterless: the pre-#754 signature took the workspace root
+ * to build a real-path read fence; resurrecting a root-derived rule would
+ * silently mismatch the virtual dialect the enforcement now sees.
  */
-export function buildPlanModePermissions(
-  workspaceRootDir: string,
-): FilesystemPermission[] {
-  const canonicalRoot = resolve(workspaceRootDir);
-  return [
-    { operations: ["read"], paths: [`${escapeGlobLiteral(canonicalRoot)}/**`] },
-    { operations: ["read"], paths: ["/**"], mode: "deny" },
-    { operations: ["write"], paths: ["/**"], mode: "deny" },
-  ];
+export function buildPlanModePermissions(): FilesystemPermission[] {
+  return [{ operations: ["write"], paths: ["/**"], mode: "deny" }];
 }