@stigmer/runner 3.29.0 → 3.30.0

package/src/__tests__/history-encryption-e2e.test.ts

@@ -26,7 +26,7 @@ import { fileURLToPath } from "node:url";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
 import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
 import { EncryptionPayloadCodec } from "@stigmer/temporal-codecs";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/execute-serverless-workflow.js";
+import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const WORKFLOWS_PATH = join(__dirname, "../workflows/index.ts");

package/src/activities/__tests__/call-eval.test.ts

@@ -0,0 +1,115 @@
+// Unit arms for the eval task's verdict schema: the structured-output shape
+// the judge is bound to, per scoring mode (stigmer#1293).
+//
+// Pinned: each mode declares exactly the fields its parser reads, all
+// required, and a multi-criteria `name` is limited to the configured
+// criteria's names; the schema reaches the LLM call in place of the empty
+// object it replaced; converted the way the LLM call converts it, the schema
+// accepts a well-formed verdict and refuses a nameless criterion, an
+// unconfigured name and a missing field, the shapes a real judge returned
+// when the schema declared no fields; a structured multi-criteria verdict
+// comes back as named criteria with their weighted score.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
+
+const callLlmAction = vi.fn();
+vi.mock("../call-llm.js", () => ({ callLlmAction: (...args: unknown[]) => callLlmAction(...args) }));
+
+const { callEvalAction, verdictSchema } = await import("../call-eval.js");
+
+const CRITERIA = [
+  { name: "accurate", description: "matches the source", weight: 3 },
+  { name: "concise", description: "short", weight: 1 },
+];
+
+beforeEach(() => {
+  callLlmAction.mockReset();
+});
+
+describe("verdictSchema", () => {
+  it("declares the fields each mode's parser reads, all required", () => {
+    expect(verdictSchema("EVAL_PASS_FAIL")).toEqual({
+      type: "object",
+      properties: { pass: { type: "boolean" }, reasoning: { type: "string" } },
+      required: ["pass", "reasoning"],
+    });
+    expect(verdictSchema("EVAL_NUMERIC_SCORE")).toEqual({
+      type: "object",
+      properties: { score: { type: "number" }, reasoning: { type: "string" } },
+      required: ["score", "reasoning"],
+    });
+    expect(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA)).toEqual({
+      type: "object",
+      properties: {
+        criteria: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: { type: "string", enum: ["accurate", "concise"] },
+              score: { type: "number" },
+              reasoning: { type: "string" },
+            },
+            required: ["name", "score", "reasoning"],
+          },
+        },
+      },
+      required: ["criteria"],
+    });
+  });
+
+  it("refuses an unknown scoring mode", () => {
+    expect(() => verdictSchema("EVAL_VIBES")).toThrow("Unknown scoring_mode 'EVAL_VIBES'");
+  });
+
+  it("converted as the LLM call converts it, binds the multi-criteria verdict's shape", () => {
+    const schema = jsonSchemaToZod(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA));
+    const good = {
+      criteria: [
+        { name: "accurate", score: 1, reasoning: "right" },
+        { name: "concise", score: 0.5, reasoning: "long" },
+      ],
+    };
+    expect(schema.safeParse(good).success).toBe(true);
+    expect(schema.safeParse({}).success, "no criteria at all").toBe(false);
+    expect(schema.safeParse({ criteria: [{ criterion: "accurate", score: 1, reasoning: "r" }] }).success, "a nameless criterion").toBe(false);
+    expect(schema.safeParse({ criteria: [{ name: "style", score: 1, reasoning: "r" }] }).success, "an unconfigured name").toBe(false);
+    expect(schema.safeParse({ criteria: [{ name: "accurate", reasoning: "r" }] }).success, "a missing score").toBe(false);
+  });
+});
+
+describe("callEvalAction", () => {
+  function reply(result: unknown): { result: unknown; model: string; input_tokens: number; output_tokens: number } {
+    return { result, model: "claude-sonnet-4-6", input_tokens: 100, output_tokens: 20 };
+  }
+
+  it("binds the judge to its mode's verdict schema, never an empty object", async () => {
+    for (const [mode, result] of [
+      ["EVAL_PASS_FAIL", { pass: true, reasoning: "ok" }],
+      ["EVAL_NUMERIC_SCORE", { score: 0.5, reasoning: "ok" }],
+    ] as const) {
+      callLlmAction.mockResolvedValueOnce(reply(result));
+      await callEvalAction({ model: "claude-sonnet-4-6", subject: "s", rubric: "r", scoring_mode: mode }, {}, "exec-1");
+      expect(callLlmAction.mock.lastCall?.[0].response_schema).toEqual(verdictSchema(mode));
+    }
+  });
+
+  it("reads a structured multi-criteria verdict as named criteria with their weighted score", async () => {
+    callLlmAction.mockResolvedValueOnce(
+      reply({
+        criteria: [
+          { name: "accurate", score: 1, reasoning: "right" },
+          { name: "concise", score: 0.5, reasoning: "long" },
+        ],
+      }),
+    );
+    const result = await callEvalAction(
+      { model: "claude-sonnet-4-6", subject: "s", rubric: "r", scoring_mode: "EVAL_MULTI_CRITERIA", criteria: CRITERIA, threshold: 0 },
+      {},
+      "exec-2",
+    );
+    expect(callLlmAction.mock.lastCall?.[0].response_schema).toEqual(verdictSchema("EVAL_MULTI_CRITERIA", CRITERIA));
+    expect(result.criteria?.map((c) => c.name)).toEqual(["accurate", "concise"]);
+    expect(result.score).toBeCloseTo(0.875, 5);
+  });
+});

package/src/activities/call-eval.ts

@@ -11,6 +11,16 @@
  *
  * Uses callLlmAction for the underlying LLM call, keeping proxy/auth
  * handling in one place.
+ *
+ * The judge answers through structured output, and the schema it is given is
+ * the verdict's own shape for its scoring mode (verdictSchema): the forced
+ * `extract` tool a provider binds describes exactly the fields the parsers
+ * below read, with a multi-criteria `name` limited to the configured
+ * criteria. An object schema with no fields left the model to guess the
+ * shape from the prompt's prose alone, and on a real judge the multi-criteria
+ * mode came back with no criteria or with nameless ones, read as a score of
+ * 0 or an average over "unknown" (stigmer#1293). The prompts still spell the
+ * format out; the schema is what binds it.
  */
 
 import { ApplicationFailure } from "@temporalio/activity";
@@ -54,6 +64,54 @@ export interface EvalResult {
   output_tokens: number;
 }
 
+// ─── Verdict Schemas ─────────────────────────────────────────────────────
+
+/**
+ * The structured-output schema of a judge's verdict, per scoring mode: the
+ * fields the mode's parser reads, all required. For EVAL_MULTI_CRITERIA each
+ * returned criterion's `name` is one of the configured criteria's names.
+ */
+export function verdictSchema(scoringMode: string, criteria: readonly EvalCriterion[] = []): Record<string, unknown> {
+  switch (scoringMode) {
+    case "EVAL_PASS_FAIL":
+      return {
+        type: "object",
+        properties: { pass: { type: "boolean" }, reasoning: { type: "string" } },
+        required: ["pass", "reasoning"],
+      };
+    case "EVAL_NUMERIC_SCORE":
+      return {
+        type: "object",
+        properties: { score: { type: "number" }, reasoning: { type: "string" } },
+        required: ["score", "reasoning"],
+      };
+    case "EVAL_MULTI_CRITERIA":
+      return {
+        type: "object",
+        properties: {
+          criteria: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: {
+                name: { type: "string", enum: criteria.map((c) => c.name) },
+                score: { type: "number" },
+                reasoning: { type: "string" },
+              },
+              required: ["name", "score", "reasoning"],
+            },
+          },
+        },
+        required: ["criteria"],
+      };
+    default:
+      throw ApplicationFailure.nonRetryable(
+        `Unknown scoring_mode '${scoringMode}'. Supported: EVAL_PASS_FAIL, EVAL_NUMERIC_SCORE, EVAL_MULTI_CRITERIA`,
+        "EVAL_UNKNOWN_SCORING_MODE",
+      );
+  }
+}
+
 // ─── Judge Prompt Builders ───────────────────────────────────────────────
 
 function buildPassFailPrompt(rubric: string, subject: string): string {
@@ -272,7 +330,7 @@ export async function callEvalAction(
       model: config.model,
       prompt,
       system_prompt: config.system_prompt,
-      response_schema: { type: "object" },
+      response_schema: verdictSchema(scoringMode, config.criteria),
     },
     runtimeEnv,
     executionId,

package/src/activities/hydrate-workflow-execution.ts

@@ -19,7 +19,7 @@ import { StigmerClient } from "../client/stigmer-client.js";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
 import { ValidationState } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/serverless/validation_pb";
 import type { Config } from "../config.js";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/execute-serverless-workflow.js";
+import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
 
 export interface HydrateInput {
   readonly execution_id: string;

package/src/activities/workflow-event-activities.ts

@@ -167,8 +167,8 @@ function nextSequence(): bigint {
  * failed run) returns the highest persisted sequence_number, so new
  * events continue from N+1.
  *
- * When executionId is empty (direct executeServerlessWorkflow without a
- * persisted execution), returns 0 as a safe fallback.
+ * When executionId is empty (an engine run with no persisted execution,
+ * as the test harness's inline entry makes), returns 0 as a safe fallback.
  *
  * Returns a plain number — the value crosses back into the workflow
  * through Temporal's JSON payload converter, which cannot carry BigInt.

package/src/harness/transcript/__tests__/builder.test.ts

@@ -174,7 +174,7 @@ describe("TranscriptBuilder — tool_finished and tool_error are upserts", () =>
   });
 });
 
-describe("TranscriptBuilder — every row with args carries an elided, redacted argsPreview", () => {
+describe("TranscriptBuilder — every row with args carries them redacted, and an elided, redacted argsPreview", () => {
   it("an ungated row's preview is its args, secret keys redacted", () => {
     const { status } = feed(builder(), [
       { kind: "tool_started", callId: "c-1", name: "connect", input: { host: "localhost", password: "super-secret" }, mcpServerSlug: "db" },
@@ -182,6 +182,61 @@ describe("TranscriptBuilder — every row with args carries an elided, redacted
     expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual({ host: "localhost", password: "[REDACTED]" });
   });
 
+  // stigmer#1119: the row's own args were stored raw, so a settled row's
+  // detail view showed what the waiting row's preview hid. Every path that
+  // writes a row's args redacts them; every other key stays verbatim.
+  describe("the row's args never carry a secret-keyed value, on every path that writes them", () => {
+    const input = { host: "localhost", password: "super-secret" };
+    const redacted = { host: "localhost", password: "[REDACTED]" };
+
+    it("a started call", () => {
+      const { status } = feed(builder(), [{ kind: "tool_started", callId: "c-1", name: "connect", input, mcpServerSlug: "db" }]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+
+    it("a re-emitted start filling the args the row lacked", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_started", callId: "c-1", name: "connect", input, mcpServerSlug: "db" },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+      expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual(redacted);
+    });
+
+    it("arguments streamed in chunks, once they parse", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '{"host":"localhost",' },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '"password":"super-secret"}' },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+
+    it("streamed arguments that parse to something other than an object are not args", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: {}, mcpServerSlug: "db" },
+        { kind: "tool_arg_delta", callId: "c-1", argsChunk: '"super-secret"' },
+      ]);
+      expect(rowOf(status, "c-1").args).toBeUndefined();
+    });
+
+    it("an approval that reopens a streamed row with the proposal's args", () => {
+      const { status } = feed(builder(), [
+        { kind: "tool_started", callId: "c-1", name: "connect", input: { host: "localhost" }, mcpServerSlug: "db" },
+        { kind: "approval_proposed", callId: "c-1", name: "connect", mcpServerSlug: "db", message: "Connect?", args: input },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+      expect(JSON.parse(rowOf(status, "c-1").argsPreview)).toEqual(redacted);
+    });
+
+    it("an approval for a call the stream never showed", () => {
+      const { status } = feed(builder(), [
+        { kind: "approval_proposed", callId: "c-1", name: "connect", mcpServerSlug: "db", message: "Connect?", args: input },
+      ]);
+      expect(rowOf(status, "c-1").args).toEqual(redacted);
+    });
+  });
+
   it("a long non-salient value is left out of the preview; a salient one (the command) survives verbatim", () => {
     const command = "echo " + "x".repeat(400);
     const { status } = feed(builder(), [

package/src/harness/transcript/builder.ts

@@ -39,8 +39,9 @@
  *     RUNNING (a WAITING row on native's durable-checkpoint resume; an
  *     INTERRUPTED row on a recovery replay, the enum's supersede rule) and
  *     takes the args and preview it lacked — never duplicated. Every row
- *     with args carries `argsPreview`, elided and redacted, salient fields
- *     verbatim. A finish or an error is an upsert: status
+ *     with args carries them with secret-keyed values redacted
+ *     (stigmer#1119), and an `argsPreview` elided and redacted, salient
+ *     fields verbatim. A finish or an error is an upsert: status
  *     monotonic, `completedAt` once, a non-empty result or message
  *     overwrites, an empty one never clears; a re-emit that
  *     changes nothing forces no persist; a fact the harness
@@ -124,7 +125,7 @@ import {
   ToolKind,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { POLICY_ENGINE_VERSION, toProtoPolicySource } from "../../shared/approval-policy.js";
-import { SALIENT_ARG_FIELDS, buildElidedArgsPreview } from "../../shared/args-preview.js";
+import { SALIENT_ARG_FIELDS, buildElidedArgsPreview, redactSensitiveArgs } from "../../shared/args-preview.js";
 import { classifyTool } from "../../shared/tool-kind.js";
 import { applyTodoUpdate } from "../../shared/todos.js";
 import { utcTimestamp } from "../../shared/status.js";
@@ -453,7 +454,7 @@ export class TranscriptBuilder {
         existing.status = ToolCallStatus.TOOL_CALL_RUNNING;
       }
       if (Object.keys(input).length > 0) {
-        if (!existing.args) existing.args = input as JsonObject;
+        if (!existing.args) existing.args = rowArgs(input);
         if (!existing.argsPreview) stampArgsPreview(existing, input);
       }
       this._dirty = true;
@@ -479,7 +480,7 @@ export class TranscriptBuilder {
     });
 
     if (Object.keys(input).length > 0) {
-      tc.args = input as JsonObject;
+      tc.args = rowArgs(input);
       stampArgsPreview(tc, input);
     }
 
@@ -596,10 +597,16 @@ export class TranscriptBuilder {
     const buffer = (scope.argBuffers.get(callId) ?? "") + argsChunk;
     scope.argBuffers.set(callId, buffer);
 
+    let parsed: unknown;
     try {
-      tc.args = JSON.parse(buffer) as JsonObject;
+      parsed = JSON.parse(buffer);
     } catch {
       // Partial JSON — will parse on next chunk or tool-finished
+      return;
+    }
+    // A tool's arguments are an object (a proto Struct); anything else is not args.
+    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+      tc.args = rowArgs(parsed as Record<string, unknown>);
     }
   }
 
@@ -641,7 +648,7 @@ export class TranscriptBuilder {
       // and they re-derive the preview. Absent, the row
       // keeps what it had.
       if (event.args && Object.keys(event.args).length > 0) {
-        existing.args = event.args as JsonObject;
+        existing.args = rowArgs(event.args);
         stampArgsPreview(existing, event.args);
       }
       if (event.contentDigest) existing.approvalContentDigest = event.contentDigest;
@@ -671,7 +678,7 @@ export class TranscriptBuilder {
       tc.policyEngineVersion = POLICY_ENGINE_VERSION;
     }
     if (event.args && Object.keys(event.args).length > 0) {
-      tc.args = event.args as JsonObject;
+      tc.args = rowArgs(event.args);
       stampArgsPreview(tc, event.args);
     }
     if (event.contentDigest) tc.approvalContentDigest = event.contentDigest;
@@ -754,6 +761,20 @@ function finalizeStreaming(transcript: Transcript): void {
   }
 }
 
+/**
+ * The row's `args`, on every row with args: the call's arguments with every
+ * secret-keyed value redacted (`redactSensitiveArgs`, the preview's own
+ * first step). Until stigmer#1119 the row stored them raw and only the
+ * preview was redacted, so a settled row's detail view showed a token the
+ * waiting row had hidden. Nothing that reads a row's args back needs a
+ * secret: exact-apply, the approval identity and the content digest read
+ * path, content, edit and command fields, which
+ * `shared/__tests__/args-preview.test.ts` pins disjoint from the secret keys.
+ */
+function rowArgs(args: Record<string, unknown>): JsonObject {
+  return redactSensitiveArgs(args) as JsonObject;
+}
+
 /**
  * The row's `args_preview`, on EVERY row with args (since #1097):
  * `message.proto` promises it sanitized, redacted, at creation, for inline

package/src/shared/__tests__/approval-policy.test.ts

@@ -418,6 +418,16 @@ describe("resolveApprovalMessage", () => {
     )).toBe("Set 42");
   });
 
+  // stigmer#1119: the message is stored on the row and shown on the approval
+  // card, so a secret-keyed placeholder never resolves to the secret.
+  it("redacts a secret-keyed placeholder, whatever the key's case, and keeps the rest", () => {
+    expect(resolveApprovalMessage(
+      "Push to {{args.repo}} with {{args.token}} ({{args.Api_Key}})?",
+      "push",
+      { repo: "acme/x", token: "s3cret", Api_Key: "sk-123" },
+    )).toBe("Push to acme/x with [REDACTED] ([REDACTED])?");
+  });
+
   it("handles null arg values", () => {
     expect(resolveApprovalMessage(
       "Value: {{args.val}}",

package/src/shared/__tests__/args-preview.test.ts

@@ -12,8 +12,25 @@
  * caller left.)
  */
 
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, it, expect } from "vitest";
-import { buildElidedArgsPreview, redactSensitiveArgs, SALIENT_ARG_FIELDS } from "../args-preview.js";
+import { buildElidedArgsPreview, redactSensitiveArgs, SALIENT_ARG_FIELDS, SENSITIVE_ARG_KEYS } from "../args-preview.js";
+import { EDIT_NEW_FIELDS, EDIT_OLD_FIELDS, WRITE_CONTENT_FIELDS, extractFilePath } from "../file-tools.js";
+
+interface SecretArgsFixture {
+  keys: string[];
+  marker: string;
+  cases: { name: string; args: Record<string, unknown>; redacted: Record<string, unknown> }[];
+}
+
+// The cross-surface contract the @stigmer/sdk reader asserts too
+// (sdk/typescript/src/execution/__tests__/tool-view.fixtures.test.ts).
+const here = dirname(fileURLToPath(import.meta.url));
+const secretArgs = JSON.parse(
+  readFileSync(resolve(here, "../../../../../../test/fixtures/tool-view/secret-args.json"), "utf8"),
+) as SecretArgsFixture;
 
 describe("SALIENT_ARG_FIELDS", () => {
   it("spans both harnesses' shapes for a file and a shell command, in priority order", () => {
@@ -27,6 +44,38 @@ describe("redactSensitiveArgs", () => {
   });
 });
 
+describe("the secret-args wire contract (test/fixtures/tool-view/secret-args.json)", () => {
+  it("SENSITIVE_ARG_KEYS is the fixture's key set, the one the SDK reader mirrors", () => {
+    expect([...SENSITIVE_ARG_KEYS].sort()).toEqual([...secretArgs.keys].sort());
+  });
+
+  for (const c of secretArgs.cases) {
+    it(`redacts ${c.name}`, () => {
+      expect(redactSensitiveArgs(c.args)).toEqual(c.redacted);
+    });
+  }
+});
+
+// A row's args are redacted at creation (stigmer#1119), and three readers act
+// on them afterwards: exact-apply writes an approved file from the path and
+// content, the Cursor approval identity keys on the salient field, and the
+// content digest hashes the write or edit content. Widening the secret set into
+// one of those fields would make an approved write land as the marker on disk.
+describe("secret keys never overlap the fields a row's args are acted on by", () => {
+  const actedOn = [...SALIENT_ARG_FIELDS, ...WRITE_CONTENT_FIELDS, ...EDIT_OLD_FIELDS, ...EDIT_NEW_FIELDS];
+
+  it("no salient, write-content or edit field is a secret key", () => {
+    const overlap = actedOn.filter((field) => SENSITIVE_ARG_KEYS.has(field.toLowerCase()));
+    expect(overlap).toEqual([]);
+  });
+
+  it("no secret-keyed argument resolves as a file path", () => {
+    for (const key of SENSITIVE_ARG_KEYS) {
+      expect(extractFilePath({ [key]: "/w/a.txt" })).toBeNull();
+    }
+  });
+});
+
 describe("buildElidedArgsPreview", () => {
   const SALIENT = SALIENT_ARG_FIELDS;
 

package/src/shared/approval-policy.ts

@@ -18,6 +18,7 @@
 import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ApprovalAction, ApprovalMode, ApprovalPolicySource } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { SENSITIVE_ARG_KEYS } from "./args-preview.js";
 import { toolApprovalCategory, type ToolApprovalCategory } from "./tool-kind.js";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
 
@@ -451,6 +452,11 @@ export function lookupMcpToolPolicy(
  * - {{args.field_name}} — replaced with the argument value
  * - {{tool_name}} — replaced with the tool name
  * - Missing fields are replaced with "<unknown>"
+ * - A secret-keyed field ({@link SENSITIVE_ARG_KEYS}) is replaced with
+ *   "[REDACTED]" (stigmer#1119): the message is stored on the row and shown on
+ *   the approval card, which must carry no more than the redacted preview.
+ *   Every approval message in the runner, native and Cursor alike, resolves
+ *   here, so this is the one place the rule applies to it.
  */
 export function resolveApprovalMessage(
   template: string,
@@ -460,6 +466,7 @@ export function resolveApprovalMessage(
   return template
     .replace(/\{\{tool_name\}\}/g, toolName)
     .replace(/\{\{args\.(\w+)\}\}/g, (_match, field: string) => {
+      if (SENSITIVE_ARG_KEYS.has(field.toLowerCase())) return "[REDACTED]";
       const value = args[field];
       if (value === undefined || value === null) return "<unknown>";
       if (typeof value === "string") return value;

package/src/shared/args-preview.ts

@@ -34,8 +34,13 @@
  */
 
 /**
- * Argument keys whose values are secrets and must never appear in a preview.
- * Matched case-insensitively against the top-level key name.
+ * Argument keys whose values are secrets and must never appear in a preview,
+ * on a row's `args`, or in an approval message (stigmer#1119). Matched
+ * case-insensitively against the top-level key name. Clients mirror this set
+ * to hide the values on rows persisted before the runner redacted `args`
+ * (`@stigmer/sdk`'s `isSecretArgKey`); the shared, machine-checked contract is
+ * `test/fixtures/tool-view/secret-args.json` — keep this set and that fixture
+ * in lockstep.
  */
 export const SENSITIVE_ARG_KEYS: ReadonlySet<string> = new Set([
   "password", "token", "secret", "api_key", "apikey",
@@ -60,9 +65,11 @@ export const SALIENT_ARG_FIELDS = ["file_path", "path", "target_notebook", "comm
 /**
  * Redact secret-keyed values (see {@link SENSITIVE_ARG_KEYS}), preserving every
  * other entry verbatim. The first step of the preview builder, and the shape
- * stamped as `args` on a proposed row the harness recovered from its engine's
- * state (issue #754's header fix): full enough for the UI's path/primary-arg
- * extraction, never carrying a secret value.
+ * stamped as `args` on every row: by the transcript builder on every row with
+ * args (since stigmer#1119), and on a proposed row the harness recovered from
+ * its engine's state (issue #754's header fix). Full enough for the UI's
+ * path/primary-arg extraction and for exact-apply, never carrying a secret
+ * value.
  */
 export function redactSensitiveArgs(
   args: Record<string, unknown>,

package/src/worker.ts

@@ -3,10 +3,8 @@
  *
  * Registers both activities and workflows on a single queue.
  *
- * Workflows:
- * - "stigmer/mcp-server/connect" — ConnectMcpServerWorkflow (discover + classify)
- * - "stigmer/mcp-server/discover" — Legacy discover-only workflow
- * - "stigmer/workflow/execute" — CNCF Serverless Workflow execution
+ * Workflows: exactly the types in `workflows/index.ts`, each started by
+ * the server with ids (that file's header is the list and the rule).
  *
  * Architecture:
  * - Java backend starts connect workflows on the runner's task queue

package/src/workflow-engine/__tests__/tasks/run.test.ts

@@ -79,6 +79,31 @@ describe("RunTaskBuilder", () => {
       const builder = new RunTaskBuilder("task", taskDef);
       expect(() => builder.build()).toThrow("workflow.name is required");
     });
+
+    it.each([
+      "stigmer/workflow/execute",
+      "stigmer/workflow/execute-from-execution",
+      "stigmer/mcp-server/connect",
+      "stigmer/mcp-server/discover",
+      "stigmer/agent-execution/invoke",
+    ])("refuses the platform workflow type %s", (name) => {
+      const taskDef: RunTaskDef = {
+        kind: "run",
+        run: { workflow: { name, namespace: "default", version: "1.0.0" } },
+      };
+      const builder = new RunTaskBuilder("reachIn", taskDef);
+      expect(() => builder.build()).toThrow(
+        `Run task 'reachIn': '${name}' is a platform workflow type, and a workflow cannot start one`,
+      );
+    });
+
+    it("admits a name that only mentions the platform outside the prefix", () => {
+      const taskDef: RunTaskDef = {
+        kind: "run",
+        run: { workflow: { name: "my-stigmer/child", namespace: "default", version: "1.0.0" } },
+      };
+      expect(() => new RunTaskBuilder("child", taskDef).build()).not.toThrow();
+    });
   });
 
   describe("script execution", () => {

package/src/workflow-engine/tasks/run.ts

@@ -7,7 +7,9 @@
  * - `run.workflow`: Child Temporal workflow (await or fire-and-forget)
  *
  * The kernel validates configuration and delegates to `ctx.runCommand`
- * (for script/shell) or `ctx.runWorkflow` (for child workflows).
+ * (for script/shell) or `ctx.runWorkflow` (for child workflows). A child
+ * workflow's name may not be a platform workflow type
+ * ({@link PLATFORM_WORKFLOW_TYPE_PREFIX} says why).
  *
  * YAML shapes:
  *   - runScript:
@@ -42,6 +44,17 @@ import type {
 
 const SUPPORTED_LANGUAGES = ["js", "python"];
 
+/**
+ * The namespace of the platform's own Temporal workflow types: every type a
+ * runner registers (`workflows/index.ts`) and every type the server starts.
+ * A child started by `run.workflow` runs on the parent's task queue, so a
+ * name in this namespace would reach the runner's own types directly: work
+ * the server never dispatched, outside the run it belongs to. A workflow
+ * therefore cannot name one. `workflows/__tests__/barrel.test.ts` pins that
+ * every registered type carries this prefix, so the refusal covers each.
+ */
+export const PLATFORM_WORKFLOW_TYPE_PREFIX = "stigmer/";
+
 export class RunTaskBuilder implements TaskBuilder {
   readonly taskName: string;
   readonly taskDef: TaskDef;
@@ -138,5 +151,10 @@ function validateRunConfig(config: RunConfig, taskName: string): void {
     if (!config.workflow.name) {
       throw new Error(`Run task '${taskName}': workflow.name is required`);
     }
+    if (config.workflow.name.startsWith(PLATFORM_WORKFLOW_TYPE_PREFIX)) {
+      throw new Error(
+        `Run task '${taskName}': '${config.workflow.name}' is a platform workflow type, and a workflow cannot start one`,
+      );
+    }
   }
 }