@stigmer/runner 3.15.3-dev.20260914121148 → 3.16.0

package/src/shared/workspace/writeback-coordinator.ts

@@ -18,7 +18,7 @@
  * (`harness/run-turn.ts`) — in capture mode on the APPROVED tree after the
  * review decisions reconcile, so speculative mid-turn edits never reach
  * GitHub; on a non-capture git turn on whatever the turn left in the tree.
- * Until S3 M2b (Q-M1-1) an incremental path also existed — `onFileModified`,
+ * Until #1096 an incremental path also existed — `onFileModified`,
  * a commit-and-push per file-modifying tool call on non-capture turns — and
  * was reachable in no supported posture (every git workspace with artifact
  * storage is a capture workspace, `shared/filereview/capture.ts`
@@ -29,18 +29,29 @@
  */
 
 import { create } from "@bufbuild/protobuf";
-import {
-  WorkspaceWriteBackSchema,
-} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/writeback_pb";
 import {
   WorkspaceWriteBackPhase,
+  WorkspaceWriteBackSchema,
+  type WorkspaceWriteBack,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/writeback_pb";
 import { GitWriteBackMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import type { WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import type { WorkspaceBackend, ProvisionResult } from "./types.js";
-import { SourceType } from "./types.js";
 import { gitCommitAsAgent } from "./git-identity.js";
-import type { ExecutionStatusWriter } from "../execution-status-writer.js";
+
+/**
+ * Where a write-back record is registered: the one member of the turn's
+ * transcript builder this coordinator needs (`harness/transcript/builder.ts`
+ * `addWriteBack`, which owns the upsert-by-entry rule — each git-backed
+ * workspace entry carries at most one record, progressing through phases).
+ * Declared here as the narrow view this consumer needs, never the whole
+ * builder, so `shared/` keeps importing nothing from `harness/` (the
+ * `SessionProvisionConfig` rule: a shared helper is handed a narrowed view,
+ * never the other way round).
+ */
+export interface WriteBackSink {
+  addWriteBack(wb: WorkspaceWriteBack): void;
+}
 
 const WRITE_BACK_ENABLED_MODES = new Set([
   GitWriteBackMode.GIT_WRITE_BACK_MODE_UNSPECIFIED,
@@ -68,7 +79,7 @@ interface EligibleEntry {
 }
 
 export class WriteBackCoordinator {
-  private readonly statusWriter: ExecutionStatusWriter;
+  private readonly writeBacks: WriteBackSink;
   private readonly executionId: string;
   private readonly workspaceBackend: WorkspaceBackend;
   private readonly branchName: string;
@@ -85,7 +96,7 @@ export class WriteBackCoordinator {
   private readonly state = new Map<string, EntryState>();
 
   constructor(opts: {
-    statusWriter: ExecutionStatusWriter;
+    writeBacks: WriteBackSink;
     executionId: string;
     /** The owning session's id — the branch/PR are session-scoped. */
     sessionId: string;
@@ -94,7 +105,7 @@ export class WriteBackCoordinator {
     workspaceEntries: readonly WorkspaceEntry[];
     workspaceBackend: WorkspaceBackend;
   }) {
-    this.statusWriter = opts.statusWriter;
+    this.writeBacks = opts.writeBacks;
     this.executionId = opts.executionId;
     this.workspaceBackend = opts.workspaceBackend;
     this.githubToken = opts.githubToken;
@@ -143,7 +154,7 @@ export class WriteBackCoordinator {
     }
 
     for (const pr of provisionResults) {
-      if (pr.sourceType !== SourceType.GIT_REPO) continue;
+      if (pr.sourceType !== "git_repo") continue;
       if (!pr.gitMetadata) continue;
       if (!pr.gitMetadata.gitCredentialsConfigured) continue;
 
@@ -222,7 +233,7 @@ export class WriteBackCoordinator {
         wb.pullRequestUrl = entryState.prUrl;
         wb.pullRequestNumber = entryState.prNumber;
       }
-      this.statusWriter.addWriteBack(wb);
+      this.writeBacks.addWriteBack(wb);
       return;
     }
 
@@ -466,7 +477,7 @@ export class WriteBackCoordinator {
       error: prError,
     });
 
-    this.statusWriter.addWriteBack(wb);
+    this.writeBacks.addWriteBack(wb);
   }
 
 }

package/src/worker.ts

@@ -18,7 +18,12 @@ import { createRequire } from "node:module";
 import { NativeConnection, Worker, type ActivityInterceptorsFactory, type InjectedSinks } from "@temporalio/worker";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
+import {
+  resolveWorkflowSource,
+  runCredentialWorkflowInterceptorModule,
+  OTEL_WORKFLOW_INTERCEPTOR_MODULE,
+} from "./workflow-source.js";
+import { runCredentialActivityInterceptor } from "./interceptors/run-credential-activity.js";
 
 export interface WorkerActivities {
   [key: string]: (...args: any[]) => Promise<unknown>;
@@ -42,9 +47,16 @@ export async function startWorker(opts: StartWorkerOptions): Promise<Worker> {
 
   const workflowSource = resolveWorkflowSource();
 
-  const activityInterceptors: ActivityInterceptorsFactory[] = [];
+  // The run credential's two ends (shared/run-credential.ts): the workflow
+  // side lifts a run's credential onto every activity it schedules, the
+  // activity side enters it for the client to present. Always on; inert
+  // without a credential. Workflow-side modules must live INSIDE the
+  // workflow bundle — a pre-built bundle has it baked in
+  // (scripts/bundle-slim.mjs); only the runtime path registers it here.
+  const activityInterceptors: ActivityInterceptorsFactory[] = [runCredentialActivityInterceptor];
   let sinks: InjectedSinks<any> = { ...createWorkflowMetricsSinks() };
-  const workflowInterceptorModules: string[] = [];
+  const workflowInterceptorModules: string[] =
+    workflowSource.kind === "runtime" ? [runCredentialWorkflowInterceptorModule()] : [];
 
   if (process.env.OTEL_EXPORTER_OTLP_ENDPOINT) {
     const {

package/src/workflow-source.ts

@@ -44,6 +44,21 @@ export type WorkflowSource =
 export const OTEL_WORKFLOW_INTERCEPTOR_MODULE =
   "@temporalio/interceptors-opentelemetry/lib/workflow-interceptors";
 
+/**
+ * Path of the runner's own workflow interceptor — the one that carries a
+ * run's credential from the workflow input to every activity it schedules
+ * (`workflows/interceptors/run-credential.ts`). Always registered, unlike
+ * the OTel module: it is inert without a credential and load-bearing with
+ * one. Resolved beside this module so the tsc dist and the slim artifact
+ * both find their own compiled copy; the build script names the source
+ * file itself.
+ */
+export function runCredentialWorkflowInterceptorModule(): string {
+  return fileURLToPath(
+    new URL("./workflows/interceptors/run-credential.js", import.meta.url),
+  );
+}
+
 export function resolveWorkflowSource(): WorkflowSource {
   const explicit = process.env.STIGMER_WORKFLOW_BUNDLE;
   if (explicit) {

package/src/workflows/__tests__/run-credential-interceptor.test.ts

@@ -0,0 +1,178 @@
+/**
+ * The workflow side of the run credential (`interceptors/run-credential.ts`):
+ * the stamp on both activity kinds, the gate by workflow type, the
+ * credential-less pass-through, and the fence that every gated type is a
+ * real export alias of the workflow barrel.
+ *
+ * `workflowInfo()` is the only sandbox API the interceptor reads; it is
+ * replaced here so the factory can run outside an isolate. Everything else
+ * from `@temporalio/workflow` is the real module, imported once for the
+ * barrel fence.
+ */
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defaultPayloadConverter } from "@temporalio/common";
+import type {
+  ActivityInput,
+  LocalActivityInput,
+  WorkflowExecuteInput,
+} from "@temporalio/workflow";
+
+let workflowType = "";
+
+vi.mock("@temporalio/workflow", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("@temporalio/workflow")>();
+  return { ...original, workflowInfo: () => ({ workflowType }) };
+});
+
+import {
+  RUN_WORKFLOW_TYPES,
+  interceptors,
+} from "../interceptors/run-credential.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../execute-from-execution.js";
+import {
+  RUN_CREDENTIAL_HEADER,
+  RUN_CREDENTIAL_INPUT_KEY,
+} from "../../shared/run-credential.js";
+import * as barrel from "../index.js";
+
+/** Drive one workflow run through the factory: its inbound execute, then one schedule of each kind. */
+async function run(type: string, workflowArg: unknown) {
+  workflowType = type;
+  const { inbound, outbound } = interceptors();
+  const executeInput: WorkflowExecuteInput = {
+    args: [workflowArg],
+    headers: {},
+  };
+  await inbound![0]!.execute!(executeInput, async () => undefined);
+
+  const seen: { activity?: ActivityInput; local?: LocalActivityInput } = {};
+  const activityInput = {
+    activityType: "EmitWorkflowEvents",
+    args: ["wex_1"],
+    headers: {},
+    options: {},
+    seq: 1,
+  } as unknown as ActivityInput;
+  const localInput = {
+    activityType: "PromoteTaskOutput",
+    args: ["out", "wex_1"],
+    headers: {},
+    options: {},
+    seq: 2,
+  } as unknown as LocalActivityInput;
+  await outbound![0]!.scheduleActivity!(activityInput, async (input) => {
+    seen.activity = input;
+    return undefined;
+  });
+  await outbound![0]!.scheduleLocalActivity!(localInput, async (input) => {
+    seen.local = input;
+    return undefined;
+  });
+  return seen;
+}
+
+function credentialIn(headers: ActivityInput["headers"] | undefined): unknown {
+  const payload = headers?.[RUN_CREDENTIAL_HEADER];
+  return payload === undefined
+    ? undefined
+    : defaultPayloadConverter.fromPayload(payload);
+}
+
+describe("run-credential workflow interceptors", () => {
+  beforeEach(() => {
+    workflowType = "";
+  });
+
+  it("stamps the run workflow's credential onto a remote activity and a local activity alike", async () => {
+    const seen = await run(EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE, {
+      execution_id: "wex_1",
+      [RUN_CREDENTIAL_INPUT_KEY]: "cred-run",
+    });
+    expect(credentialIn(seen.activity?.headers)).toBe("cred-run");
+    expect(credentialIn(seen.local?.headers)).toBe("cred-run");
+  });
+
+  it("keeps the other headers a schedule already carries", async () => {
+    workflowType = EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE;
+    const { inbound, outbound } = interceptors();
+    await inbound![0]!.execute!(
+      { args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-run" }], headers: {} },
+      async () => undefined,
+    );
+    const other = defaultPayloadConverter.toPayload("trace");
+    let stamped: ActivityInput | undefined;
+    await outbound![0]!.scheduleActivity!(
+      {
+        activityType: "X",
+        args: [],
+        headers: { "_tracer-data": other },
+        options: {},
+        seq: 1,
+      } as unknown as ActivityInput,
+      async (input) => {
+        stamped = input;
+        return undefined;
+      },
+    );
+    expect(stamped?.headers["_tracer-data"]).toBe(other);
+    expect(credentialIn(stamped?.headers)).toBe("cred-run");
+  });
+
+  it("stamps nothing when the run workflow's input carries no credential — an older server's dispatch replays byte for byte", async () => {
+    const seen = await run(EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE, {
+      execution_id: "wex_1",
+    });
+    expect(seen.activity?.headers).toEqual({});
+    expect(seen.local?.headers).toEqual({});
+  });
+
+  it("stamps nothing for the connect workflow even though its input carries the same key — that token is not a run credential", async () => {
+    const seen = await run("stigmer/mcp-server/connect", {
+      mcp_server_id: "mcp_1",
+      [RUN_CREDENTIAL_INPUT_KEY]: "connect-token",
+    });
+    expect(seen.activity?.headers).toEqual({});
+    expect(seen.local?.headers).toEqual({});
+  });
+
+  it("keeps each workflow run's credential on its own factory instance", async () => {
+    workflowType = EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE;
+    const first = interceptors();
+    const second = interceptors();
+    await first.inbound![0]!.execute!(
+      { args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-1" }], headers: {} },
+      async () => undefined,
+    );
+    await second.inbound![0]!.execute!(
+      { args: [{ execution_id: "wex_2" }], headers: {} },
+      async () => undefined,
+    );
+    let fromSecond: ActivityInput | undefined;
+    await second.outbound![0]!.scheduleActivity!(
+      {
+        activityType: "X",
+        args: [],
+        headers: {},
+        options: {},
+        seq: 1,
+      } as unknown as ActivityInput,
+      async (input) => {
+        fromSecond = input;
+        return undefined;
+      },
+    );
+    expect(fromSecond?.headers).toEqual({});
+  });
+
+  it("gates on workflow types that are export aliases of the barrel — the list cannot name a type that does not exist", () => {
+    expect(RUN_WORKFLOW_TYPES).toEqual([EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE]);
+    for (const type of RUN_WORKFLOW_TYPES) {
+      expect(
+        Object.keys(barrel),
+        `"${type}" must be exported by workflows/index.ts`,
+      ).toContain(type);
+    }
+  });
+});

package/src/workflows/execute-from-execution.ts

@@ -47,6 +47,16 @@ const hydrateProxy = proxyActivities<HydrateActivities>({
 // Workflow Input Type (Temporal wire contract with Java/Go orchestrators)
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * The Temporal workflow type this function is exported as in `index.ts` — the
+ * server's `CHILD_WORKFLOW_TYPE`, byte-pinned on both sides. Named here so
+ * the run-credential interceptor can gate on it without a second literal; a
+ * test pins it to the barrel's export alias (an ES2022 export alias must be a
+ * literal, so the barrel cannot import this).
+ */
+export const EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE =
+  "stigmer/workflow/execute-from-execution";
+
 export interface ExecuteFromExecutionInput {
   execution_id: string;
   workflow_instance_id: string;
@@ -55,6 +65,13 @@ export interface ExecuteFromExecutionInput {
   callback_token?: Uint8Array | null;
   invoker_identity_account_id?: string;
   recovery_mode?: boolean;
+  /**
+   * The run credential the server minted for this execution at dispatch —
+   * absent from an older server's dispatch. This workflow never reads it: the
+   * interceptor in `interceptors/run-credential.ts` lifts it onto every
+   * activity this workflow schedules, as a header (`shared/run-credential.ts`).
+   */
+  execution_context_token?: string;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/workflows/index.ts

@@ -13,9 +13,11 @@
  * us map TypeScript function names to the slash-delimited Temporal
  * workflow type names that the backend expects.
  *
- * OTel workflow interceptors are registered at bundle time — not
- * imported here. Pre-built bundles (scripts/bundle-slim.mjs) bake them
- * in; the runtime-bundling fallback passes them to the bundler (see
+ * Workflow interceptors are registered at bundle time — not imported
+ * here: the runner's own run-credential interceptor
+ * (./interceptors/run-credential.ts, always) and OTel's (when the host
+ * configures the sink). Pre-built bundles (scripts/bundle-slim.mjs) bake
+ * them in; the runtime-bundling fallback passes them to the bundler (see
  * src/workflow-source.ts).
  */
 

package/src/workflows/interceptors/run-credential.ts

@@ -0,0 +1,101 @@
+/**
+ * Workflow-side interceptors that carry a run's credential from the workflow
+ * input to every activity the workflow schedules — as a Temporal activity
+ * header, the SDK's channel for context that crosses the isolate boundary
+ * without being anybody's argument (`shared/run-credential.ts` has the
+ * whole story; `interceptors/run-credential-activity.ts` is the other end).
+ *
+ * Gated by WORKFLOW TYPE, not by input shape. The connect workflow's input
+ * carries the same key for a different token — a clocked decrypt-lane token
+ * bound to a synthetic id that no verifier admits as a run — and stamping it
+ * onto that lane's activities would present it where it does not belong.
+ * The gate is the positive list below: the workflow types whose input
+ * carries a RUN credential. One entry today; a test pins each entry to an
+ * export of `workflows/index.ts`, so the list cannot name a type that does
+ * not exist.
+ *
+ * Per-run state lives on this factory's closure: the SDK instantiates the
+ * factory once per workflow run, which is the documented contract. The
+ * header is a pure function of the input, so replay recomputes exactly what
+ * was recorded, and a credential-less input stamps nothing — an in-flight
+ * run from before the credential existed replays byte for byte.
+ *
+ * TEMPORAL SANDBOX: this file is bundled into the workflow isolate. No Node
+ * built-ins. It is baked into the pre-built bundle by
+ * `scripts/bundle-slim.mjs` and passed to the runtime bundler by both worker
+ * roots (`src/workflow-source.ts` names it beside the OTel module).
+ */
+
+import { workflowInfo } from "@temporalio/workflow";
+import type {
+  ActivityInput,
+  LocalActivityInput,
+  Next,
+  WorkflowExecuteInput,
+  WorkflowInboundCallsInterceptor,
+  WorkflowInterceptorsFactory,
+  WorkflowOutboundCallsInterceptor,
+} from "@temporalio/workflow";
+import { defaultPayloadConverter } from "@temporalio/common";
+
+import {
+  RUN_CREDENTIAL_HEADER,
+  readRunCredentialFromInput,
+} from "../../shared/run-credential.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../execute-from-execution.js";
+
+/**
+ * The workflow types whose input carries a run credential. Byte-pinned wire
+ * names; each must be an export alias of `workflows/index.ts`.
+ */
+export const RUN_WORKFLOW_TYPES: readonly string[] = [
+  EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE,
+];
+
+export const interceptors: WorkflowInterceptorsFactory = () => {
+  let credential: string | undefined;
+
+  const inbound: WorkflowInboundCallsInterceptor = {
+    async execute(
+      input: WorkflowExecuteInput,
+      next: Next<WorkflowInboundCallsInterceptor, "execute">,
+    ) {
+      if (RUN_WORKFLOW_TYPES.includes(workflowInfo().workflowType)) {
+        credential = readRunCredentialFromInput(input.args[0]);
+      }
+      return next(input);
+    },
+  };
+
+  const outbound: WorkflowOutboundCallsInterceptor = {
+    async scheduleActivity(
+      input: ActivityInput,
+      next: Next<WorkflowOutboundCallsInterceptor, "scheduleActivity">,
+    ) {
+      return next(stamped(input));
+    },
+    async scheduleLocalActivity(
+      input: LocalActivityInput,
+      next: Next<WorkflowOutboundCallsInterceptor, "scheduleLocalActivity">,
+    ) {
+      return next(stamped(input));
+    },
+  };
+
+  function stamped<T extends { readonly headers: ActivityInput["headers"] }>(
+    input: T,
+  ): T {
+    if (credential === undefined) {
+      return input;
+    }
+    return {
+      ...input,
+      headers: {
+        ...input.headers,
+        [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(credential),
+      },
+    };
+  }
+
+  return { inbound: [inbound], outbound: [outbound] };
+};

package/dist/activities/execute-cursor/delta-enricher.d.ts

@@ -1,87 +0,0 @@
-/**
- * DeltaEnricher processes Cursor SDK InteractionUpdate events to provide
- * real-time enrichments that the stream channel alone cannot deliver.
- *
- * The Cursor SDK provides two concurrent event channels:
- *   - run.stream() (SDKMessage) — coarse-grained, post-hoc events
- *   - onDelta (InteractionUpdate) — fine-grained, real-time deltas
- *
- * The stream channel remains the source of truth for message construction.
- * The delta channel provides supplementary real-time signals:
- *   - shell-output-delta: live stdout/stderr from running shell commands
- *   - tool-call-started/completed: precise lifecycle timestamps
- *   - thinking-completed: accurate thinking duration from the SDK
- *
- * Concurrency model: Node.js is single-threaded. The onDelta callback fires
- * between iterations of the for-await stream loop (during event loop yields).
- * The enricher buffers data internally; the stream loop calls
- * applyEnrichments() on each iteration to flush buffered state onto the
- * message array. No locks needed — access is always sequential.
- *
- * Design invariant: The enricher never creates messages or tool calls.
- * It only mutates existing ones that the MessageAccumulator has created.
- * If a delta arrives before its corresponding stream event (e.g.,
- * shell-output-delta before tool_call running), the data is buffered
- * and applied retroactively on the next applyEnrichments() call that
- * finds the matching ToolCall.
- */
-import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import type { InteractionUpdate } from "@cursor/sdk";
-export declare class DeltaEnricher {
-    private shellOutputByCallId;
-    private timingByCallId;
-    private thinkingDurationMs;
-    private _isDirty;
-    private lastPersistTime;
-    private lastShellCallId;
-    /**
-     * Minimum interval between persist-triggering dirty flags (milliseconds).
-     * Prevents excessive backend writes during rapid shell output bursts.
-     * Matches the Python agent-runner's update_scheduler interval.
-     */
-    static readonly PERSIST_DEBOUNCE_MS = 500;
-    /**
-     * Process a single InteractionUpdate from the onDelta callback.
-     * Buffers enrichment data for later application by applyEnrichments().
-     *
-     * Called from the onDelta callback (between stream loop iterations).
-     */
-    processDelta(update: InteractionUpdate): void;
-    /**
-     * Apply all buffered enrichments to the current message array.
-     * Called from the stream loop after each processEvent() iteration.
-     *
-     * Returns true if any enrichments were applied (messages were mutated).
-     */
-    applyEnrichments(messages: AgentMessage[]): boolean;
-    /**
-     * Whether the enricher has pending data that warrants an immediate persist.
-     * Only returns true when meaningful UI-visible data has arrived AND the
-     * debounce interval has elapsed since the last persist.
-     */
-    get isDirty(): boolean;
-    /**
-     * Acknowledge that a persist has occurred. Resets the dirty flag and
-     * records the persist timestamp for debounce calculations.
-     */
-    markPersisted(): void;
-    /**
-     * Finalize streaming state and reconcile tool call statuses.
-     *
-     * Called after the stream loop ends (alongside accumulator.finalize()).
-     * Two passes:
-     *   1. Clear `isStreaming` on all tool calls (existing behavior).
-     *   2. Reconciliation sweep: any tool call still RUNNING with evidence
-     *      of completion (completedAt set or result non-empty) is promoted
-     *      to COMPLETED. This is the catch-all safety net — when the stream
-     *      ends, no tool call should remain in a non-terminal status.
-     */
-    finalize(messages: AgentMessage[]): void;
-    private handleShellOutputDelta;
-    private handleToolCallStarted;
-    private handleToolCallCompleted;
-    private getOrCreateTiming;
-    private applyShellOutput;
-    private applyTiming;
-    private applyThinkingDuration;
-}