@stigmer/runner 3.1.2 → 3.1.4

package/src/activities/execute-deep-agent/__tests__/status-builder.test.ts

@@ -10,6 +10,8 @@ import {
   ExecutionPhase,
   MessageType,
   ToolCallStatus,
+  ToolKind,
+  TodoStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { StatusBuilder, type StreamEvent, type ApprovalPolicyProvider } from "../status-builder.js";
 import type { MergedToolPolicy } from "../../../shared/approval-policy.js";
@@ -1852,4 +1854,80 @@ describe("StatusBuilder", () => {
       expect(status.phase).not.toBe(ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL);
     });
   });
+
+  // ── Todo extraction (write_todos → status.todos) ─────────────────
+  //
+  // v2 parity with V3StatusBuilder: a completed write_todos projects into
+  // status.todos through the same shared mapper; a failed one does not.
+
+  describe("todo extraction", () => {
+    it("projects a completed write_todos into status.todos", () => {
+      const sb = makeBuilder();
+      sb.processEvent(
+        toolStartEvent("run-1", "write_todos", {
+          todos: [
+            { content: "Step one", status: "in_progress" },
+            { content: "Step two", status: "pending" },
+          ],
+        }),
+      );
+      sb.processEvent(toolEndEvent("run-1", "Todos updated"));
+
+      const todos = sb.currentStatus.todos;
+      expect(Object.keys(todos)).toEqual(["todo-0", "todo-1"]);
+      expect(todos["todo-0"].content).toBe("Step one");
+      expect(todos["todo-0"].status).toBe(TodoStatus.TODO_IN_PROGRESS);
+      expect(todos["todo-1"].status).toBe(TodoStatus.TODO_PENDING);
+    });
+
+    it("keeps the write_todos ToolCall in messages stamped ToolKind.TODO", () => {
+      const sb = makeBuilder();
+      sb.processEvent(
+        toolStartEvent("run-1", "write_todos", {
+          todos: [{ content: "A", status: "pending" }],
+        }),
+      );
+      sb.processEvent(toolEndEvent("run-1", "ok"));
+
+      const tc = sb.currentStatus.messages
+        .flatMap((m) => m.toolCalls)
+        .find((t) => t.name === "write_todos");
+      expect(tc).toBeDefined();
+      expect(tc!.toolKind).toBe(ToolKind.TODO);
+    });
+
+    it("does not project on a failed write_todos (Command never ran)", () => {
+      const sb = makeBuilder();
+      sb.processEvent(
+        toolStartEvent("run-1", "write_todos", {
+          todos: [{ content: "A", status: "pending" }],
+        }),
+      );
+      sb.processEvent(toolEndEvent("run-1", { error: "boom" }));
+      expect(Object.keys(sb.currentStatus.todos)).toHaveLength(0);
+    });
+
+    it("full-replaces the map on a subsequent write_todos", () => {
+      const sb = makeBuilder();
+      sb.processEvent(
+        toolStartEvent("run-1", "write_todos", {
+          todos: [
+            { content: "one", status: "completed" },
+            { content: "two", status: "in_progress" },
+          ],
+        }),
+      );
+      sb.processEvent(toolEndEvent("run-1", "ok"));
+      sb.processEvent(
+        toolStartEvent("run-2", "write_todos", {
+          todos: [{ content: "two", status: "completed" }],
+        }),
+      );
+      sb.processEvent(toolEndEvent("run-2", "ok"));
+
+      const todos = sb.currentStatus.todos;
+      expect(Object.keys(todos)).toEqual(["todo-0"]);
+      expect(todos["todo-0"].status).toBe(TodoStatus.TODO_COMPLETED);
+    });
+  });
 });

package/src/activities/execute-deep-agent/__tests__/v3-status-builder.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeEach } from "vitest";
 import { create } from "@bufbuild/protobuf";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ExecutionPhase, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ExecutionPhase, MessageType, ToolCallStatus, ToolKind, TodoStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { V3StatusBuilder } from "../v3-status-builder.js";
 import { normalize } from "../v3-protocol-normalizer.js";
 import type { ApprovalPolicyProvider } from "../status-builder.js";
@@ -504,4 +504,108 @@ describe("V3StatusBuilder", () => {
       expect(sb.currentStatus.messages).toHaveLength(0);
     });
   });
+
+  // ── Todo extraction (write_todos → status.todos) ─────────────────
+  //
+  // The native harness emits write_todos; projecting it into status.todos is
+  // what lights up the client TodoCard at parity with the Cursor harness.
+
+  describe("todo extraction", () => {
+    it("projects a completed write_todos into status.todos", () => {
+      const sb = makeBuilder();
+      feedAll(sb, [
+        makeMessageStart("run-1"),
+        makeTextDelta("run-1", "Planning the build."),
+        makeMessageFinish("run-1", { usage: { input_tokens: 10, output_tokens: 5 } }),
+        makeToolStarted("todo-1", "write_todos", {
+          todos: [
+            { content: "Step one", status: "in_progress" },
+            { content: "Step two", status: "pending" },
+          ],
+        }),
+        makeToolFinished("todo-1", "Todos updated"),
+      ]);
+
+      const todos = sb.currentStatus.todos;
+      expect(Object.keys(todos)).toEqual(["todo-0", "todo-1"]);
+      expect(todos["todo-0"].content).toBe("Step one");
+      expect(todos["todo-0"].status).toBe(TodoStatus.TODO_IN_PROGRESS);
+      expect(todos["todo-1"].content).toBe("Step two");
+      expect(todos["todo-1"].status).toBe(TodoStatus.TODO_PENDING);
+      expect(sb.forceNextUpdate).toBe(true);
+    });
+
+    it("keeps the write_todos ToolCall in messages stamped ToolKind.TODO", () => {
+      const sb = makeBuilder();
+      feedAll(sb, [
+        makeToolStarted("todo-1", "write_todos", {
+          todos: [{ content: "Step one", status: "pending" }],
+        }),
+        makeToolFinished("todo-1", "Todos updated"),
+      ]);
+
+      const toolCalls = sb.currentStatus.messages.flatMap((m) => m.toolCalls);
+      const tc = toolCalls.find((t) => t.name === "write_todos");
+      expect(tc).toBeDefined();
+      expect(tc!.toolKind).toBe(ToolKind.TODO);
+    });
+
+    it("does not project until the call completes", () => {
+      const sb = makeBuilder();
+      feedAll(sb, [
+        makeToolStarted("todo-1", "write_todos", {
+          todos: [{ content: "Step one", status: "pending" }],
+        }),
+      ]);
+      // Tool started but not finished — the state Command has not run yet.
+      expect(Object.keys(sb.currentStatus.todos)).toHaveLength(0);
+
+      feedAll(sb, [makeToolFinished("todo-1", "Todos updated")]);
+      expect(Object.keys(sb.currentStatus.todos)).toHaveLength(1);
+    });
+
+    it("full-replaces the map on a subsequent write_todos", () => {
+      const sb = makeBuilder();
+      feedAll(sb, [
+        makeToolStarted("todo-1", "write_todos", {
+          todos: [
+            { content: "Step one", status: "completed" },
+            { content: "Step two", status: "in_progress" },
+          ],
+        }),
+        makeToolFinished("todo-1", "ok"),
+        makeToolStarted("todo-2", "write_todos", {
+          todos: [{ content: "Step two", status: "completed" }],
+        }),
+        makeToolFinished("todo-2", "ok"),
+      ]);
+
+      const todos = sb.currentStatus.todos;
+      expect(Object.keys(todos)).toEqual(["todo-0"]);
+      expect(todos["todo-0"].content).toBe("Step two");
+      expect(todos["todo-0"].status).toBe(TodoStatus.TODO_COMPLETED);
+    });
+
+    it("does not project a sub-agent's write_todos into parent status.todos", () => {
+      const sb = makeBuilder();
+      const subNs = ["tools:task-1", "tools:sub-todo"];
+      feedAll(sb, [
+        // Register a sub-agent so its namespace routes to the SubAgentTracker.
+        makeToolStarted("task-1", "task", {
+          subagent_type: "worker",
+          description: "delegate",
+        }),
+        // The sub-agent writes todos — must not leak into the parent map.
+        makeToolStarted(
+          "sub-todo",
+          "write_todos",
+          { todos: [{ content: "sub step", status: "pending" }] },
+          { namespace: subNs },
+        ),
+        makeToolFinished("sub-todo", "ok", { namespace: subNs }),
+      ]);
+
+      expect(Object.keys(sb.currentStatus.todos)).toHaveLength(0);
+    });
+  });
 });

package/src/activities/execute-deep-agent/command-provenance.ts

@@ -0,0 +1,102 @@
+/**
+ * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
+ * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
+ *
+ * The deep-agent's consent model differs from Cursor's in exactly two ways, and
+ * this adapter is precisely those two differences:
+ *
+ * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
+ *    index its stream started at. The deep-agent cannot: an approved command
+ *    executes IN PLACE at its seeded transcript position (it was proposed in a
+ *    prior segment, seeded into this segment, and updated to COMPLETED by
+ *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
+ *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
+ *    snapshot, and "executed" is a COMPLETED status.
+ *
+ * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
+ *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
+ *    same row, and the row keeps its id + `approval_action` when it executes on
+ *    resume. So the executed command IS its own consent row — cite its own id.
+ *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
+ *    across the status write regardless of its new status, so the backend's
+ *    verification finds it.)
+ *
+ * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
+ * sub-agents"). A sub-agent's writes fold into the parent turn's change set
+ * (DD-19) but are not attributable to a consented top-level command. The
+ * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
+ * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
+ * the (currently-impossible under the replace-per-turn model) case of a sub-agent
+ * that mutates across a turn boundary without a fresh top-level `task` row.
+ *
+ * (Trust boundary + fail-closed contract: see the shared module.)
+ */
+
+import {
+  ApprovalAction,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
+import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
+import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
+
+export interface DeepAgentCommandProvenanceInputs {
+  /** The status at capture time — top-level messages + sub-agent executions. */
+  readonly status: AgentExecutionStatus;
+  /**
+   * The top-level tool-call ids that had already SETTLED before this turn's
+   * stream (from {@link collectSettledToolCallIds}). A top-level call whose id is
+   * absent is this-turn's; the shared rule then keeps only the COMPLETED ones.
+   */
+  readonly priorSettledToolCallIds: ReadonlySet<string>;
+  /**
+   * The sub-agent tool-call ids that existed before this turn's stream (from
+   * {@link collectSubAgentToolCallIds}). Any growth means a sub-agent acted this
+   * turn → fail closed.
+   */
+  readonly priorSubAgentToolCallIds: ReadonlySet<string>;
+  /** True when the pre-armed spec.auto_approve_all bypassed the gate. */
+  readonly globalBypass: boolean;
+}
+
+/**
+ * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
+ * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
+ * resolves consent from the row's own server-authored `approval_action`, fails
+ * closed on any sub-agent activity, and delegates the DD-28 rule to
+ * {@link qualifyTurnCommandProvenance}.
+ */
+export function deriveTurnCommandProvenance(
+  inputs: DeepAgentCommandProvenanceInputs,
+): TurnCommandProvenance | undefined {
+  const { status, priorSettledToolCallIds, priorSubAgentToolCallIds, globalBypass } = inputs;
+
+  // DD-28 D1 cond 2: any sub-agent activity this turn disqualifies. A sub-agent
+  // that ran this turn contributes at least one tool-call id absent from the
+  // pre-stream snapshot.
+  for (const id of collectSubAgentToolCallIds(status.subAgentExecutions)) {
+    if (!priorSubAgentToolCallIds.has(id)) return undefined;
+  }
+
+  const messages = status.messages;
+  // This turn's top-level calls: those not already settled before the stream.
+  const turnToolCalls = messages
+    .flatMap((m) => m.toolCalls)
+    .filter((tc) => !priorSettledToolCallIds.has(tc.id));
+
+  return qualifyTurnCommandProvenance({
+    turnToolCalls,
+    messages,
+    // A deep-agent command executed iff its row reached COMPLETED this turn.
+    isExecutedCommand: (tc) => tc.status === ToolCallStatus.TOOL_CALL_COMPLETED,
+    // The gated command carries its own server-authored approval_action, written
+    // in place by SubmitApproval and preserved when the row executes on resume.
+    resolveDirectConsent: (tc) =>
+      tc.approvalAction === ApprovalAction.APPROVE ||
+      tc.approvalAction === ApprovalAction.APPROVE_ALL
+        ? tc.id
+        : undefined,
+    globalBypass,
+  });
+}

package/src/activities/execute-deep-agent/index.ts

@@ -50,12 +50,28 @@ import {
   captureBaselineToLedger,
   captureCandidateToLedger,
 } from "../../shared/filereview/capture.js";
+import {
+  captureFileChangeProgress,
+  createGitProgressSubstrate,
+  createHybridProgressSubstrate,
+  newProgressCaptureState,
+  type ProgressSubstrate,
+} from "../../shared/filereview/progress.js";
+import {
+  createCasProgressSubstrate,
+  type CasTouchedSnapshot,
+} from "../../shared/filereview/cas-progress.js";
 import { hasCandidateCaptured } from "../../shared/filereview/events.js";
 import { casBlobReader, type CasPathCapture } from "../../shared/filereview/cas-substrate.js";
 import { partitionIgnoredPathsBySecret } from "../../shared/filereview/secret-paths.js";
 import type { CasCaptureObserver } from "./cas-capture-observer.js";
-import { collectSubAgentToolCallIds, withholdSecretContentFromMessages } from "../../shared/tool-row.js";
+import {
+  collectSettledToolCallIds,
+  collectSubAgentToolCallIds,
+  withholdSecretContentFromMessages,
+} from "../../shared/tool-row.js";
 import { stampFlowedFileEditRows, stampFlowedSubAgentFileEditRows } from "./stamp-flowed-rows.js";
+import { deriveTurnCommandProvenance } from "./command-provenance.js";
 
 /** The harness id stamped on the deep-agent's file-review ledger events. */
 const DEEP_AGENT_HARNESS_ID = "deep-agent";
@@ -308,6 +324,12 @@ export function createDeepAgentActivities(config: Config) {
         // seeds prior sub-agents — but computed, not assumed, so it stays correct
         // if that ever changes; see collectSubAgentToolCallIds).
         const priorSubAgentToolCallIds = collectSubAgentToolCallIds(initialStatus.subAgentExecutions);
+        // Snapshot the top-level tool-call ids already SETTLED before this turn's
+        // stream, so the approved-command provenance (DD-28) scopes itself to THIS
+        // turn's executed commands by identity. The deep-agent's approved shell
+        // executes in place at its seeded position, so the Cursor positional scope
+        // would miss it — see execute-deep-agent/command-provenance.ts.
+        const priorSettledToolCallIds = collectSettledToolCallIds(initialStatus.messages);
         if (setup.captureMode) {
           captureBaselineTree = await captureBaselineToLedger({
             status: initialStatus,
@@ -319,6 +341,35 @@ export function createDeepAgentActivities(config: Config) {
           });
         }
 
+        // Per-turn state + substrate for mid-run live capture (DD-32 / DD-33). The
+        // floor lives in progressState; the substrate is chosen for this turn's
+        // workspace shape and owns its own short-circuit cache. An atomic snapshot
+        // of the shared observer feeds the CAS/HYBRID substrates — copied
+        // synchronously so a concurrent sub-agent write cannot mutate it mid-read.
+        const progressState = newProgressCaptureState();
+        const casObserver = setup.casObserver;
+        const readObserverTouched = (): CasTouchedSnapshot => ({
+          before: new Map(casObserver.before),
+          blockedSecretPaths: new Set(casObserver.blockedSecretPaths),
+        });
+        // Git tree -> hybrid (numstat for tracked + observer for gitignored);
+        // non-git -> cas over the observer (no baseline tree needed). Undefined
+        // outside capture mode (writes are deny-gated, nothing is captured).
+        const progressSubstrate: ProgressSubstrate | undefined = !setup.captureMode
+          ? undefined
+          : setup.gitWorkspace
+            ? captureBaselineTree
+              ? createHybridProgressSubstrate(
+                  createGitProgressSubstrate({
+                    workspaceRoot: gitRoot,
+                    executionId,
+                    baselineTree: captureBaselineTree,
+                  }),
+                  createCasProgressSubstrate({ workspaceRoot: gitRoot, read: readObserverTouched }),
+                )
+              : undefined
+            : createCasProgressSubstrate({ workspaceRoot: gitRoot, read: readObserverTouched });
+
         const cancellationSignal = Context.current().cancellationSignal;
 
         const result: StreamResult = await streamExecution({
@@ -344,6 +395,21 @@ export function createDeepAgentActivities(config: Config) {
             globalBypass: setup.globalBypass,
           },
           streamVersion: setup.streamVersion,
+          // Mid-run live capture (DD-32 / DD-33): attach file_change_progress
+          // before each scheduled persist, throttled by the floor inside
+          // captureFileChangeProgress. The substrate (git / non-git CAS / hybrid)
+          // was chosen for this turn above; deep-agent writes no runner-owned gate
+          // files into the tree, so the git slice needs no excludePaths — matching
+          // its turn-boundary candidate capture.
+          beforePersist: async (status) => {
+            if (!progressSubstrate) return;
+            await captureFileChangeProgress({
+              status,
+              changeSetId,
+              substrate: progressSubstrate,
+              state: progressState,
+            });
+          },
         });
 
         await processPostStream({
@@ -399,6 +465,25 @@ export function createDeepAgentActivities(config: Config) {
             gitRoot,
             casCaptureClass,
           );
+          // Approved-command turn facts (DD-28): when every mutation-capable call
+          // this turn was a consented shell command, attach the provenance so the
+          // backend can verify the cited consent rows and auto-keep the set
+          // instead of arming a second review gate. Fail-closed: any non-qualifying
+          // turn attaches nothing and reviews manually exactly as before. Attached
+          // only when captureCandidateToLedger actually authors a CANDIDATE.
+          const commandProvenance = deriveTurnCommandProvenance({
+            status: initialStatus,
+            priorSettledToolCallIds,
+            priorSubAgentToolCallIds,
+            globalBypass: setup.globalBypass,
+          });
+          if (commandProvenance) {
+            console.log(
+              `[ExecuteDeepAgent] capture: turn qualifies for approved-command auto-keep ` +
+              `(consent rows: ${commandProvenance.consentToolCallIds.join(",") || "(auto_approve_all)"}); ` +
+              `attaching provenance to candidate (execution=${executionId})`,
+            );
+          }
           await captureCandidateToLedger({
             status: initialStatus,
             gitRoot,
@@ -411,6 +496,7 @@ export function createDeepAgentActivities(config: Config) {
             unreviewablePaths,
             unreviewableCaptureClass: casCaptureClass,
             gitWorkspace: setup.gitWorkspace,
+            commandProvenance,
           });
           // Review is pending iff a CANDIDATE was actually authored (the seam
           // drops no-op captures), so a turn that only touched-then-unchanged an
@@ -556,9 +642,10 @@ export function createDeepAgentActivities(config: Config) {
         }
 
         // Plan mode: the agent's final message is the plan. Publish it as a
-        // first-class plan.md artifact so the UI can render a reviewable Plan
-        // card and a follow-up Implement run can reference it. Read-only mode
-        // produces no file to auto-publish, so this is the only artifact path.
+        // first-class plan artifact (named from the plan's title) so the UI can
+        // render a reviewable Plan card and a follow-up Implement run can
+        // reference it. Read-only mode produces no file to auto-publish, so
+        // this is the only artifact path.
         // Requires artifact storage; with none (proxy misconfig) the plan text
         // still lives in the final message — only the reviewable artifact is
         // skipped (mirrors Cursor's storage-guarded plan publish).

package/src/activities/execute-deep-agent/status-builder.ts

@@ -24,9 +24,11 @@ import {
   ExecutionPhase,
   MessageType,
   ToolCallStatus,
+  ToolKind,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { resolveApprovalMessage as resolveApprovalMsg } from "../../shared/approval-policy.js";
 import { classifyTool } from "../../shared/tool-kind.js";
+import { applyTodoUpdate } from "../../shared/todos.js";
 import { ExecutionState } from "./execution-state.js";
 import { utcTimestamp } from "../../shared/status.js";
 import type { ExecutionStatusWriter } from "./execution-status-writer.js";
@@ -348,6 +350,13 @@ export class StatusBuilder {
       // (see v3 builder note). Truncating here would corrupt image base64.
       tc.status = ToolCallStatus.TOOL_CALL_COMPLETED;
       tc.result = extractToolResult(event.data);
+
+      // Project a completed to-do write into status.todos — success branch only,
+      // since a failed write_todos never ran its state-mutating Command. Shares
+      // the mapper and rationale documented in V3StatusBuilder.handleToolFinished.
+      if (tc.toolKind === ToolKind.TODO) {
+        applyTodoUpdate(this.state.proto.todos, tc.args?.todos, { merge: false });
+      }
     }
 
     tc.completedAt = utcTimestamp();

package/src/activities/execute-deep-agent/streaming-v3.ts

@@ -118,10 +118,15 @@ export async function streamExecutionV3(
         }
 
         statusBuilder.syncSubAgentExecutions();
+        // Mid-run live capture (DD-32): attach file_change_progress to the live
+        // status before it is persisted. Injected so this loop stays ignorant of
+        // file-review specifics; a no-op when the hook is absent or nothing changed.
+        const statusToPersist = statusBuilder.currentStatus;
+        await deps.beforePersist?.(statusToPersist);
         const signal = await persistStatus(
           client,
           executionId,
-          statusBuilder.currentStatus,
+          statusToPersist,
           { offload, retry: retryOptions },
         );
         scheduler.markUpdateSent(eventsProcessed);

package/src/activities/execute-deep-agent/streaming.ts

@@ -83,6 +83,13 @@ export interface StreamDependencies {
   readonly approvalProvider?: ApprovalPolicyProvider;
   /** Streaming protocol version. Defaults to "v2" if unset. */
   readonly streamVersion?: "v2" | "v3";
+  /**
+   * Optional hook invoked with the live status just before each scheduled
+   * persist. Used by mid-run live capture (DD-32) to attach file_change_progress.
+   * Kept as an injected callback (closing over the turn's baseline tree / change
+   * set id in index.ts) so this loop stays ignorant of file-review specifics.
+   */
+  readonly beforePersist?: (status: AgentExecutionStatus) => Promise<void>;
 }
 
 export interface StreamResult {
@@ -189,10 +196,14 @@ async function streamExecutionV2(
           statusBuilder.clearForceFlag();
         }
 
+        // Mid-run live capture (DD-32): attach file_change_progress to the live
+        // status before persisting (see streaming-v3.ts for the rationale).
+        const statusToPersist = statusBuilder.currentStatus;
+        await deps.beforePersist?.(statusToPersist);
         const signal = await persistStatus(
           client,
           executionId,
-          statusBuilder.currentStatus,
+          statusToPersist,
           { offload, retry: retryOptions },
         );
         scheduler.markUpdateSent(eventsProcessed);

package/src/activities/execute-deep-agent/v3-status-builder.ts

@@ -23,9 +23,11 @@ import {
   ExecutionPhase,
   MessageType,
   ToolCallStatus,
+  ToolKind,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { resolveApprovalMessage as resolveApprovalMsg } from "../../shared/approval-policy.js";
 import { classifyTool } from "../../shared/tool-kind.js";
+import { applyTodoUpdate } from "../../shared/todos.js";
 import { ExecutionState } from "./execution-state.js";
 import { utcTimestamp } from "../../shared/status.js";
 import type { ExecutionStatusWriter } from "./execution-status-writer.js";
@@ -340,6 +342,17 @@ export class V3StatusBuilder implements ExecutionStatusWriter {
     this.state.toolStartTimes.delete(callId);
     this.toolArgBuffers.delete(callId);
 
+    // Project a completed to-do write into status.todos. deepagents' write_todos
+    // runs its state-mutating Command when the tool node COMPLETES, so we mirror
+    // it here (not at tool-start) — a call cancelled before finishing correctly
+    // projects nothing. Keyed on the harness-agnostic ToolKind.TODO (stamped at
+    // tool-start) and fed by the same shared mapper the Cursor tracker uses;
+    // deepagents always full-replaces (no merge field). The tool call itself
+    // stays in messages (the client filters ToolKind.TODO from the thread).
+    if (tc.toolKind === ToolKind.TODO) {
+      applyTodoUpdate(this.state.proto.todos, tc.args?.todos, { merge: false });
+    }
+
     this._forceNextUpdate = true;
   }
 

package/src/otel.ts

@@ -125,12 +125,20 @@ export async function startCursorTurnSpan(attrs: {
         [ATTR_SESSION_ID]: attrs.sessionId,
       },
     });
+    // Guard against a double end / a late setTokens: the turn span is ended from
+    // the activity's finally (finishTurnTelemetry), and OTel warns when a span is
+    // ended twice or mutated after end. Making this a no-op keeps the caller free
+    // to end idempotently on every exit path.
+    let ended = false;
     return {
       setTokens(input: number, output: number) {
+        if (ended) return;
         if (input) span.setAttribute(ATTR_LLM_INPUT_TOKENS, input);
         if (output) span.setAttribute(ATTR_LLM_OUTPUT_TOKENS, output);
       },
       end() {
+        if (ended) return;
+        ended = true;
         span.end();
       },
     };

package/src/shared/__tests__/implement-plan-prompt.test.ts

@@ -5,7 +5,7 @@ import {
 } from "../implement-plan-prompt.js";
 
 describe("findApprovedPlanPath", () => {
-  it("finds the plan by its canonical filename among attachment paths", () => {
+  it("finds the plan by the legacy filename among attachment paths", () => {
     expect(
       findApprovedPlanPath([
         ".stigmer/inputs/data.csv",
@@ -14,15 +14,28 @@ describe("findApprovedPlanPath", () => {
     ).toBe(".stigmer/inputs/plan.md");
   });
 
+  it("finds a title-named <slug>_<id>.plan.md plan", () => {
+    expect(
+      findApprovedPlanPath([
+        ".stigmer/inputs/data.csv",
+        ".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md",
+      ]),
+    ).toBe(".stigmer/inputs/plan-card-ux-cleanup_a1b2c3d4.plan.md");
+  });
+
   it("returns undefined when no plan attachment resolved", () => {
     expect(findApprovedPlanPath([".stigmer/inputs/data.csv"])).toBeUndefined();
     expect(findApprovedPlanPath([])).toBeUndefined();
   });
 
-  it("matches the basename exactly — a plan-adjacent filename is not the plan", () => {
+  it("matches the plan convention only — a plan-adjacent filename is not the plan", () => {
     expect(
       findApprovedPlanPath([".stigmer/inputs/my-plan.md.bak"]),
     ).toBeUndefined();
+    // A file merely containing "plan" is not a plan artifact.
+    expect(
+      findApprovedPlanPath([".stigmer/inputs/myplan.md"]),
+    ).toBeUndefined();
   });
 });
 
@@ -45,4 +58,29 @@ describe("buildImplementPlanDirective", () => {
     expect(directive).toContain("conversation above");
     expect(directive).not.toContain("plan.md");
   });
+
+  // Tier 3 (plan-driven build progress): both variants instruct the agent to
+  // derive its to-do list from the plan and keep it current — the agent's todo
+  // tool is the single writer of status.todos, so this instruction is the
+  // entire plan→progress linkage.
+  it("instructs plan-derived progress tracking in the attached variant", () => {
+    const directive = buildImplementPlanDirective(".stigmer/inputs/plan.md");
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+  });
+
+  it("instructs plan-derived progress tracking in the conversation-only variant", () => {
+    const directive = buildImplementPlanDirective(undefined);
+
+    expect(directive).toContain("to-do list");
+    expect(directive).toContain("break the plan into");
+    expect(directive).toContain("in progress");
+    expect(directive).toContain("completed");
+    // The progress block must never name the file — this variant exists
+    // because no plan file materialized.
+    expect(directive).not.toContain("plan.md");
+  });
 });