@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/dist/shared/artifact-storage.js

@@ -13,11 +13,17 @@
  * The runner never holds R2/S3 credentials — in cloud mode it calls the proxy
  * to obtain a presigned upload URL, then PUTs content over plain HTTPS.
  *
+ * Every proxy-backend request rides the shared bounded-backoff loop
+ * (http-retry.ts) with a per-request abort timeout, so a momentary
+ * stigmer-service interruption is retried and a hung connection cannot
+ * stall an agent turn unboundedly (stigmer/stigmer#468).
+ *
  * DD-6: No direct R2 backend. Local + Proxy only.
  */
 import { mkdir, writeFile, readFile, access, rm } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
+import { fetchWithRetry } from "./http-retry.js";
 // ── Local Backend ────────────────────────────────────────────────────
 export class LocalArtifactStorage {
     basePath;
@@ -81,13 +87,45 @@ export class LocalArtifactStorage {
         return full;
     }
 }
-// ── Proxy Backend ────────────────────────────────────────────────────
+/**
+ * Default transient-retry policy (stigmer/stigmer#468): the checkpointer's
+ * budget — sized to span a pod-restart reroute, ~7.75 s of delays across
+ * 5 retries. Retrying is safe at every site: the presign POSTs are
+ * idempotent mints, the PUT re-sends identical bytes to the same key (a
+ * keyed overwrite), and the GETs are reads.
+ */
+const DEFAULT_RETRY = {
+    baseDelayMs: 250,
+    backoffFactor: 2,
+    maxRetries: 5,
+    requestTimeoutMs: 30_000,
+    transferTimeoutMs: 120_000,
+};
 export class ProxyArtifactStorage {
     baseUrl;
     authTokenSource;
-    constructor(proxyEndpoint, authToken) {
+    /** Governs the proxy presign calls and the exists probe. */
+    requestPolicy;
+    /** Governs the presigned R2 transfers; same budget, wider timeout. */
+    transferPolicy;
+    constructor(proxyEndpoint, authToken, options = {}) {
         this.baseUrl = `${proxyEndpoint.replace(/\/+$/, "")}/v1/proxy/artifacts`;
         this.authTokenSource = authToken;
+        const shared = {
+            label: "ProxyArtifactStorage",
+            baseDelayMs: options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
+            backoffFactor: options.backoffFactor ?? DEFAULT_RETRY.backoffFactor,
+            maxRetries: options.maxRetries ?? DEFAULT_RETRY.maxRetries,
+            delayFn: options.delayFn,
+        };
+        this.requestPolicy = {
+            ...shared,
+            requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs,
+        };
+        this.transferPolicy = {
+            ...shared,
+            requestTimeoutMs: options.transferTimeoutMs ?? DEFAULT_RETRY.transferTimeoutMs,
+        };
     }
     /**
      * Resolve the credential per call rather than pinning the boot token: a
@@ -102,14 +140,14 @@ export class ProxyArtifactStorage {
     }
     async upload(key, content, contentType) {
         const ct = contentType ?? "application/octet-stream";
-        const presignResp = await fetch(`${this.baseUrl}/presigned-upload-url`, {
+        const presignResp = await fetchWithRetry(`${this.baseUrl}/presigned-upload-url`, {
             method: "POST",
             headers: {
                 "Authorization": `Bearer ${this.authToken}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify({ key, content_type: ct }),
-        });
+        }, this.requestPolicy);
         if (!presignResp.ok) {
             throw new Error(`Failed to get presigned upload URL (HTTP ${presignResp.status}): ` +
                 await presignResp.text());
@@ -138,11 +176,14 @@ export class ProxyArtifactStorage {
         if (!contentTypeSigned) {
             uploadHeaders["Content-Type"] = ct;
         }
-        const putResp = await fetch(data.url, {
+        // Retrying the PUT alone (not the presign+PUT pair) is deliberate: the
+        // retry budget's few seconds of delays sit far inside presign validity,
+        // and re-sending the same Buffer to the same key is a keyed overwrite.
+        const putResp = await fetchWithRetry(data.url, {
             method: "PUT",
             headers: uploadHeaders,
             body: content,
-        });
+        }, this.transferPolicy);
         if (!putResp.ok) {
             throw new Error(`Presigned upload failed (HTTP ${putResp.status}): ` +
                 await putResp.text());
@@ -150,14 +191,14 @@ export class ProxyArtifactStorage {
         return key;
     }
     async getDownloadUrl(key) {
-        const resp = await fetch(`${this.baseUrl}/presigned-download-url`, {
+        const resp = await fetchWithRetry(`${this.baseUrl}/presigned-download-url`, {
             method: "POST",
             headers: {
                 "Authorization": `Bearer ${this.authToken}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify({ key }),
-        });
+        }, this.requestPolicy);
         if (!resp.ok) {
             throw new Error(`Failed to get presigned download URL (HTTP ${resp.status}): ` +
                 await resp.text());
@@ -167,7 +208,7 @@ export class ProxyArtifactStorage {
     }
     async download(key) {
         const url = await this.getDownloadUrl(key);
-        const resp = await fetch(url);
+        const resp = await fetchWithRetry(url, undefined, this.transferPolicy);
         if (!resp.ok) {
             throw new Error(`Artifact download failed (HTTP ${resp.status}) for key '${key}': ` +
                 await resp.text());
@@ -191,7 +232,7 @@ export class ProxyArtifactStorage {
             // addressed CAS blob dedup) then re-uploads, which is idempotent.
             return false;
         }
-        const resp = await fetch(url, { headers: { Range: "bytes=0-0" } });
+        const resp = await fetchWithRetry(url, { headers: { Range: "bytes=0-0" } }, this.requestPolicy);
         await resp.arrayBuffer().catch(() => undefined); // drain the <=1-byte body
         if (resp.status === 404)
             return false;

package/dist/shared/artifact-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAwBlC,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gCAAgC,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI;gBAC/F,6FAA6F;gBAC7F,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,8CAA8C,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAS;IAChB,eAAe,CAAuB;IAEvD,YAAY,aAAqB,EAAE,SAA+B;QAChE,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;IACnC,CAAC;IAED;;;;;OAKG;IACH,IAAY,SAAS;QACnB,OAAO,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACpC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,MAAM,cAAc,GAAG,KAAK;gBACnE,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnF,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,MAAM,cAAc,GAAG,GAAG,CACzE,CAAC;IACJ,CAAC;CACF;AAkBD;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB,EAAE;QACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,cAAc,EAAE,IAAI,KAAK,OAAO;YAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;YACxD,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAe,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAA0B,EAC1B,GAA4B;IAE5B,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0EAA0E;YAC1E,kDAAkD,GAAG,CAAC,WAAW,IAAI;YACrE,QAAQ,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE,CACjC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CACV,4EAA4E;YAC5E,6EAA6E;YAC7E,wBAAwB,GAAG,CAAC,WAAW,UAAU,GAAG,CAAC,SAAS,IAAI;YAClE,mFAAmF;YACnF,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"artifact-storage.js","sourceRoot":"","sources":["../../src/shared/artifact-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAyB,MAAM,iBAAiB,CAAC;AAuBxE,wEAAwE;AAExE,MAAM,OAAO,oBAAoB;IACd,QAAQ,CAAS;IACjB,YAAY,CAAS;IAEtC,YAAY,QAAgB,EAAE,YAAoB;QAChD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,YAAqB;QAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,2EAA2E;QAC3E,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,mEAAmE;YACnE,yEAAyE;YACzE,2EAA2E;YAC3E,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,gCAAgC,IAAI,CAAC,QAAQ,MAAM,MAAM,IAAI;gBAC/F,6FAA6F;gBAC7F,wCAAwC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACK,iBAAiB,CAAC,GAAW;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,8CAA8C,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAiBD;;;;;;GAMG;AACH,MAAM,aAAa,GAAG;IACpB,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;IACb,gBAAgB,EAAE,MAAM;IACxB,iBAAiB,EAAE,OAAO;CAClB,CAAC;AAEX,MAAM,OAAO,oBAAoB;IACd,OAAO,CAAS;IAChB,eAAe,CAAuB;IACvD,4DAA4D;IAC3C,aAAa,CAAmB;IACjD,sEAAsE;IACrD,cAAc,CAAmB;IAElD,YACE,aAAqB,EACrB,SAA+B,EAC/B,UAAuC,EAAE;QAEzC,IAAI,CAAC,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG;YACb,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,aAAa,CAAC,WAAW;YAC7D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC,aAAa;YACnE,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,IAAI,CAAC,aAAa,GAAG;YACnB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC,gBAAgB;SAC7E,CAAC;QACF,IAAI,CAAC,cAAc,GAAG;YACpB,GAAG,MAAM;YACT,gBAAgB,EAAE,OAAO,CAAC,iBAAiB,IAAI,aAAa,CAAC,iBAAiB;SAC/E,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAY,SAAS;QACnB,OAAO,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe;YACtB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,OAAe,EAAE,WAAoB;QAC7D,MAAM,EAAE,GAAG,WAAW,IAAI,0BAA0B,CAAC;QAErD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;SAChD,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4CAA4C,WAAW,CAAC,MAAM,KAAK;gBACnE,MAAM,WAAW,CAAC,IAAI,EAAE,CACzB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuD,CAAC;QAE3F,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,0DAA0D;QAC1D,yEAAyE;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACzC,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,SAAS;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;gBAAE,iBAAiB,GAAG,IAAI,CAAC;YACpE,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,OAAO;SACd,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,MAAM,KAAK;gBACpD,MAAM,OAAO,CAAC,IAAI,EAAE,CACrB,CAAC;QACJ,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,SAAS,EAAE;gBAC3C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,MAAM,KAAK;gBAC9D,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAqB,CAAC;QAClD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,MAAM,cAAc,GAAG,KAAK;gBACnE,MAAM,IAAI,CAAC,IAAI,EAAE,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAC/B,GAAG,EACH,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EACnC,IAAI,CAAC,aAAa,CACnB,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnF,8EAA8E;QAC9E,uEAAuE;QACvE,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,MAAM,cAAc,GAAG,GAAG,CACzE,CAAC;IACJ,CAAC;CACF;AAkBD;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC;QAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,4EAA4E;IAC5E,+EAA+E;IAC/E,wEAAwE;IACxE,0EAA0E;IAC1E,qCAAqC;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,MAAM,IAAI,GACR,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3C,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,wBAAwB,EAAE;QACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,uBAAuB;QAC9E,aAAa,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,sEAAsE;QACtE,yDAAyD;QACzD,cAAc,EAAE,IAAI,KAAK,OAAO;YAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA0B;IAC9D,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ;YACxD,CAAC,CAAC,GAAG,CAAC,cAAc;YACpB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC;QAChC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,cAAe,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,IAAI,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAA0B,EAC1B,GAA4B;IAE5B,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,0EAA0E;YAC1E,kDAAkD,GAAG,CAAC,WAAW,IAAI;YACrE,QAAQ,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE,CACjC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CACV,4EAA4E;YAC5E,6EAA6E;YAC7E,wBAAwB,GAAG,CAAC,WAAW,UAAU,GAAG,CAAC,SAAS,IAAI;YAClE,mFAAmF;YACnF,iEAAiE,CAClE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/shared/attachment-naming.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Naming policy for execution attachments — the single owner of the rule that
+ * resolves duplicate attachment filenames (issue #364).
+ *
+ * Both harnesses materialize attachments into the platform inputs namespace
+ * keyed by filename, so two attachments carrying the same name contend for
+ * one on-disk path. Before this module existed each harness had an accidental
+ * answer: the deep-agent injector failed the whole execution on the collision
+ * and the Cursor resolver silently overwrote the earlier file. The platform
+ * answer is neither — a duplicate is mechanically renamed (`report.pdf`,
+ * `report-2.pdf`, ...) and the rename is disclosed to the agent through the
+ * input-files prompt section, so no execution is ever burned over a
+ * resolvable name and no user file silently vanishes.
+ *
+ * The `stem-2.ext` semantics deliberately mirror the React SDK composer's
+ * client-side rename (sdk/react/src/attachment/attachment-utils.ts,
+ * `uniquifyFilename` — kept in sync by hand, the packages share no
+ * dependency), so a user sees the same rename shape whether the client or the
+ * runner performed it.
+ *
+ * Scope: this module owns NAMES only. What constitutes a collision is the
+ * caller's business — the deep-agent injector keys on full mount paths
+ * (explicit `mountPath` values participate), the Cursor resolver keys on bare
+ * filenames under `inputs/`. Callers that consider a collision a user
+ * contradiction (two attachments explicitly pinning the same mount path)
+ * keep rejecting; only mechanically derived names are renamed.
+ */
+/** The outcome of allocating a unique name for one attachment. */
+export interface AllocatedName {
+    /** The final name — unchanged when it was free, `stem-N.ext` otherwise. */
+    readonly name: string;
+    /**
+     * The original requested name, present only when a rename happened — the
+     * disclosure payload the prompt builders render so the agent can still
+     * connect "the two report.pdfs" in the user's message to distinct files.
+     */
+    readonly renamedFrom?: string;
+}
+/**
+ * Returns `name` unchanged when it is not in `taken`, otherwise the first
+ * free `stem-2.ext`, `stem-3.ext`, … variant.
+ *
+ * Byte-for-byte twin of the React SDK's `uniquifyFilename`
+ * (sdk/react/src/attachment/attachment-utils.ts) so client-side and
+ * runner-side renames are indistinguishable to the user.
+ */
+export declare function uniquifyFilename(name: string, taken: ReadonlySet<string>): string;
+/**
+ * Allocate a unique name against `taken`, claiming the result in the set so
+ * sequential allocations see each other. Returns the disclosure payload
+ * (`renamedFrom`) when the name had to change.
+ */
+export declare function allocateUniqueName(name: string, taken: Set<string>): AllocatedName;

package/dist/shared/attachment-naming.js

@@ -0,0 +1,59 @@
+/**
+ * Naming policy for execution attachments — the single owner of the rule that
+ * resolves duplicate attachment filenames (issue #364).
+ *
+ * Both harnesses materialize attachments into the platform inputs namespace
+ * keyed by filename, so two attachments carrying the same name contend for
+ * one on-disk path. Before this module existed each harness had an accidental
+ * answer: the deep-agent injector failed the whole execution on the collision
+ * and the Cursor resolver silently overwrote the earlier file. The platform
+ * answer is neither — a duplicate is mechanically renamed (`report.pdf`,
+ * `report-2.pdf`, ...) and the rename is disclosed to the agent through the
+ * input-files prompt section, so no execution is ever burned over a
+ * resolvable name and no user file silently vanishes.
+ *
+ * The `stem-2.ext` semantics deliberately mirror the React SDK composer's
+ * client-side rename (sdk/react/src/attachment/attachment-utils.ts,
+ * `uniquifyFilename` — kept in sync by hand, the packages share no
+ * dependency), so a user sees the same rename shape whether the client or the
+ * runner performed it.
+ *
+ * Scope: this module owns NAMES only. What constitutes a collision is the
+ * caller's business — the deep-agent injector keys on full mount paths
+ * (explicit `mountPath` values participate), the Cursor resolver keys on bare
+ * filenames under `inputs/`. Callers that consider a collision a user
+ * contradiction (two attachments explicitly pinning the same mount path)
+ * keep rejecting; only mechanically derived names are renamed.
+ */
+/**
+ * Returns `name` unchanged when it is not in `taken`, otherwise the first
+ * free `stem-2.ext`, `stem-3.ext`, … variant.
+ *
+ * Byte-for-byte twin of the React SDK's `uniquifyFilename`
+ * (sdk/react/src/attachment/attachment-utils.ts) so client-side and
+ * runner-side renames are indistinguishable to the user.
+ */
+export function uniquifyFilename(name, taken) {
+    if (!taken.has(name))
+        return name;
+    const dotIndex = name.lastIndexOf(".");
+    // A leading dot (".env") is a hidden-file prefix, not an extension.
+    const stem = dotIndex > 0 ? name.slice(0, dotIndex) : name;
+    const ext = dotIndex > 0 ? name.slice(dotIndex) : "";
+    for (let n = 2;; n++) {
+        const candidate = `${stem}-${n}${ext}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}
+/**
+ * Allocate a unique name against `taken`, claiming the result in the set so
+ * sequential allocations see each other. Returns the disclosure payload
+ * (`renamedFrom`) when the name had to change.
+ */
+export function allocateUniqueName(name, taken) {
+    const unique = uniquifyFilename(name, taken);
+    taken.add(unique);
+    return unique === name ? { name: unique } : { name: unique, renamedFrom: name };
+}
+//# sourceMappingURL=attachment-naming.js.map

package/dist/shared/attachment-naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-naming.js","sourceRoot":"","sources":["../../src/shared/attachment-naming.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAcH;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,KAA0B;IAE1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,oEAAoE;IACpE,MAAM,IAAI,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAErD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,KAAkB;IAElB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC"}

package/dist/shared/caller-identity.d.ts

@@ -10,8 +10,10 @@
  *   2. The session creator (`stigmer_user`) from the Session resource's
  *      audit actor — console/CLI sessions have no channel sender, but the
  *      platform knows exactly who created the session.
- *   3. The anonymous sentinel — discovery (no session exists) and sessions
- *      with no readable creator. Consumers must treat anonymous as a
+ *   3. The anonymous sentinel — discovery (no session exists), sessions
+ *      with no readable creator, and sessions whose creator is the
+ *      backend's "system" audit placeholder (not a principal — see
+ *      SYSTEM_CREATOR_SENTINEL). Consumers must treat anonymous as a
  *      first-class caller: answer tools/list, refuse tool calls.
  *
  * Injection is opt-in by construction: the values enter the env map used
@@ -46,6 +48,19 @@ export declare const STIGMER_USER_KIND = "stigmer_user";
  * before the server's tools are ever classified.
  */
 export declare const ANONYMOUS_KIND = "anonymous";
+/**
+ * Audit-actor id that backends stamp when NO caller identity exists —
+ * the OSS server writes it on every create (no local auth), and the
+ * cloud's AuditActorBuilder falls back to it for caller-less internal
+ * writes. It names "nobody in particular": unrelated sessions from
+ * unrelated people all carry it, so presenting it as a caller identity
+ * would make the one string a grantable value that silently covers ALL
+ * such traffic in an MCP server's binding sheet. A creator matching this
+ * sentinel (and carrying no email) is therefore unresolvable and falls
+ * to anonymous — the deny-by-default the docs guide already promises
+ * for self-hosted backends.
+ */
+export declare const SYSTEM_CREATOR_SENTINEL = "system";
 /** The resolved caller identity. */
 export interface CallerIdentity {
     kind: string;
@@ -66,6 +81,12 @@ export declare function anonymousCallerIdentity(): CallerIdentity;
  * humans, and the audit actor's `id` field is historically mixed
  * (identity-account id vs email — see the proto's own @internal note).
  * Binding matchers should compare emails case-insensitively.
+ *
+ * A creator with no email whose id is the "system" audit placeholder is
+ * NOT a principal (see SYSTEM_CREATOR_SENTINEL) and resolves to
+ * anonymous. Email-first is deliberate here too: a real account that
+ * merely has "system" somewhere in its id is never demoted, because its
+ * email wins before the sentinel check runs.
  */
 export declare function resolveCallerIdentity(sessionMetadata: Record<string, string> | undefined, creator?: SessionCreatorActor): CallerIdentity;
 /**

package/dist/shared/caller-identity.js

@@ -10,8 +10,10 @@
  *   2. The session creator (`stigmer_user`) from the Session resource's
  *      audit actor — console/CLI sessions have no channel sender, but the
  *      platform knows exactly who created the session.
- *   3. The anonymous sentinel — discovery (no session exists) and sessions
- *      with no readable creator. Consumers must treat anonymous as a
+ *   3. The anonymous sentinel — discovery (no session exists), sessions
+ *      with no readable creator, and sessions whose creator is the
+ *      backend's "system" audit placeholder (not a principal — see
+ *      SYSTEM_CREATOR_SENTINEL). Consumers must treat anonymous as a
  *      first-class caller: answer tools/list, refuse tool calls.
  *
  * Injection is opt-in by construction: the values enter the env map used
@@ -47,6 +49,19 @@ export const STIGMER_USER_KIND = "stigmer_user";
  * before the server's tools are ever classified.
  */
 export const ANONYMOUS_KIND = "anonymous";
+/**
+ * Audit-actor id that backends stamp when NO caller identity exists —
+ * the OSS server writes it on every create (no local auth), and the
+ * cloud's AuditActorBuilder falls back to it for caller-less internal
+ * writes. It names "nobody in particular": unrelated sessions from
+ * unrelated people all carry it, so presenting it as a caller identity
+ * would make the one string a grantable value that silently covers ALL
+ * such traffic in an MCP server's binding sheet. A creator matching this
+ * sentinel (and carrying no email) is therefore unresolvable and falls
+ * to anonymous — the deny-by-default the docs guide already promises
+ * for self-hosted backends.
+ */
+export const SYSTEM_CREATOR_SENTINEL = "system";
 /** The identity injected when no session context exists (discovery). */
 export function anonymousCallerIdentity() {
     return { kind: ANONYMOUS_KIND, value: "" };
@@ -59,6 +74,12 @@ export function anonymousCallerIdentity() {
  * humans, and the audit actor's `id` field is historically mixed
  * (identity-account id vs email — see the proto's own @internal note).
  * Binding matchers should compare emails case-insensitively.
+ *
+ * A creator with no email whose id is the "system" audit placeholder is
+ * NOT a principal (see SYSTEM_CREATOR_SENTINEL) and resolves to
+ * anonymous. Email-first is deliberate here too: a real account that
+ * merely has "system" somewhere in its id is never demoted, because its
+ * email wins before the sentinel check runs.
  */
 export function resolveCallerIdentity(sessionMetadata, creator) {
     const sender = readSenderIdentity(sessionMetadata);
@@ -66,10 +87,20 @@ export function resolveCallerIdentity(sessionMetadata, creator) {
         return { kind: sender.kind, value: sender.value };
     }
     const email = creator?.email?.trim();
+    if (email) {
+        return { kind: STIGMER_USER_KIND, value: email };
+    }
     const id = creator?.id?.trim();
-    const value = email || id;
-    if (value) {
-        return { kind: STIGMER_USER_KIND, value };
+    if (id === SYSTEM_CREATOR_SENTINEL) {
+        // Operator tripwire: identity-gated MCP tools will refuse this
+        // session; the fix is real caller attribution, never a "system" grant.
+        console.info(`Session creator is the "${SYSTEM_CREATOR_SENTINEL}" audit placeholder ` +
+            `(no email) — not a resolvable principal; presenting the anonymous ` +
+            `caller identity to MCP servers`);
+        return anonymousCallerIdentity();
+    }
+    if (id) {
+        return { kind: STIGMER_USER_KIND, value: id };
     }
     return anonymousCallerIdentity();
 }

package/dist/shared/caller-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-identity.js","sourceRoot":"","sources":["../../src/shared/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,mDAAmD;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAc1C,wEAAwE;AACxE,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAmD,EACnD,OAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IAED,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,QAAQ,GAA2B;QACvC,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,IAAI;QAC7C,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,KAAK;QAC/C,CAAC,kBAAkB,CAAC,EAAE,SAAS;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CACV,qBAAqB,GAAG,0CAA0C;gBAClE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CACvD,eAAoC,EACpC,OAA+B;IAE/B,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B;QACxC,CAAC,4BAA4B,CAAC,EAAE,SAAS,CAAC,IAAI;QAC9C,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,KAAK;QAChD,CAAC,kBAAkB,CAAC,EAAE,EAAE;KACzB,CAAC;IAEF,IAAI,MAA0C,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"caller-identity.js","sourceRoot":"","sources":["../../src/shared/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,mDAAmD;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E,8CAA8C;AAC9C,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAE7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAchD,wEAAwE;AACxE,MAAM,UAAU,uBAAuB;IACrC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAmD,EACnD,OAA6B;IAE7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,EAAE,KAAK,uBAAuB,EAAE,CAAC;QACnC,+DAA+D;QAC/D,uEAAuE;QACvE,OAAO,CAAC,IAAI,CACV,2BAA2B,uBAAuB,sBAAsB;YACxE,oEAAoE;YACpE,gCAAgC,CACjC,CAAC;QACF,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,EAAE,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,QAAwB,EACxB,SAAiB;IAEjB,MAAM,QAAQ,GAA2B;QACvC,CAAC,4BAA4B,CAAC,EAAE,QAAQ,CAAC,IAAI;QAC7C,CAAC,6BAA6B,CAAC,EAAE,QAAQ,CAAC,KAAK;QAC/C,CAAC,kBAAkB,CAAC,EAAE,SAAS;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,GAAG,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CACV,qBAAqB,GAAG,0CAA0C;gBAClE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CACvD,eAAoC,EACpC,OAA+B;IAE/B,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;IAC5C,MAAM,SAAS,GAA2B;QACxC,CAAC,4BAA4B,CAAC,EAAE,SAAS,CAAC,IAAI;QAC9C,CAAC,6BAA6B,CAAC,EAAE,SAAS,CAAC,KAAK;QAChD,CAAC,kBAAkB,CAAC,EAAE,EAAE;KACzB,CAAC;IAEF,IAAI,MAA0C,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,IAAI,OAAO,CAAC;AAC3B,CAAC"}

package/dist/shared/channel-attachment.js

@@ -104,6 +104,7 @@ export function synthesizeChannelAttachment(channels, options) {
         slug: CHANNEL_ATTACHMENT_SLUG,
         toolApprovals: [],
         pinnedToolApprovals: [],
+        toolApprovalOverrides: [],
         discoveredCapabilitiesEmpty: false,
     };
     if (options.bridgeEndpoint !== null && options.bridgeEndpoint !== "") {

package/dist/shared/channel-attachment.js.map

@@ -1 +1 @@
-{"version":3,"file":"channel-attachment.js","sourceRoot":"","sources":["../../src/shared/channel-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOzD,OAAO,EAAE,UAAU,EAAqC,MAAM,6BAA6B,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAQvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqB,EACrB,gBAAoC;IAEpC,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+DAA+D;IAC/D,qEAAqE;IACrE,oEAAoE;IACpE,mBAAmB;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;aAChF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,iBAAiB,OAAO,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgC,EAChC,OAAqC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,uBAAuB;QAC7B,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE,EAAE;QACvB,2BAA2B,EAAE,KAAK;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,cAAc;YAChE,OAAO,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE;gBACnD,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,GAAG,EAAE;YACH,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgC;IAC5E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAElC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,iEAAiE;QACjE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,SAAS;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC,iBAAiB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,KAAK,OAAO;gBACvC,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;gBACL,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,QAAQ,IAAI,UAAU,GAAG,MAAM,EAAE;gBACrE,QAAQ,CAAC,CAAC,QAAQ,GAAG;aACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC,IAAI,QAAQ,0BAA0B,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;QAChF,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,+BAA+B;QAC/B,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;QACF,GAAG,aAAa;QAChB,GAAG,MAAM;QACT,gCAAgC;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,GAAY;IACrD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GACZ,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa;QAC9B,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,kBAAkB;QACnC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,IAAI,gCAAgC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,wBAAwB,IAAI,+CAA+C,EAAE,CAAC,OAAO,EAAE,CACxF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"channel-attachment.js","sourceRoot":"","sources":["../../src/shared/channel-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOzD,OAAO,EAAE,UAAU,EAAqC,MAAM,6BAA6B,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAQvC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAqB,EACrB,gBAAoC;IAEpC,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+DAA+D;IAC/D,qEAAqE;IACrE,oEAAoE;IACpE,mBAAmB;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,OAAO;gBACL,OAAO;gBACP,SAAS,EAAE,MAAM,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;aAChF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,iBAAiB,OAAO,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgC,EAChC,OAAqC;IAErC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,uBAAuB;QAC7B,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE,EAAE;QACvB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,KAAK;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,cAAc;YAChE,OAAO,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE;gBACnD,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,GAAG,EAAE;YACH,kBAAkB,EAAE,UAAU;YAC9B,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgC;IAC5E,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAElC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,iEAAiE;QACjE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,SAAS;aACvB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExF,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1C,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,UAAU,GAAG,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC5C,CAAC,CAAC,iBAAiB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,KAAK,OAAO;gBACvC,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,OAAO;gBACL,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,QAAQ,IAAI,UAAU,GAAG,MAAM,EAAE;gBACrE,QAAQ,CAAC,CAAC,QAAQ,GAAG;aACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,GAAG,CAAC;QACzB,CAAC,CAAC,CAAC,IAAI,QAAQ,0BAA0B,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC;QAChF,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,+BAA+B;QAC/B,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,gEAAgE;QAChE,EAAE;QACF,GAAG,aAAa;QAChB,GAAG,MAAM;QACT,gCAAgC;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,GAAY;IACrD,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,QAAQ,GACZ,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa;QAC9B,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,kBAAkB;QACnC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,wBAAwB,IAAI,gCAAgC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CACV,wBAAwB,IAAI,+CAA+C,EAAE,CAAC,OAAO,EAAE,CACxF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/shared/checkpointer/http-saver.d.ts

@@ -13,14 +13,39 @@
  *
  * The Java proxy calls Document.parse(json) which handles $binary
  * natively, and doc.toJson() emits the same format on reads.
+ *
+ * Every request runs through the shared bounded-backoff loop
+ * (http-retry.ts's fetchWithRetry, with this saver's policy: transient
+ * classification + a per-request abort timeout). That loop is the ONLY
+ * retry layer between an agent execution and its checkpoints — the deep
+ * agent activity is deliberately non-retryable at the Temporal level
+ * (maximumAttempts: 1; replaying a whole agent run is not safe), so before
+ * this existed a single dropped request killed the execution
+ * (stigmer/stigmer-cloud#188). Retrying puts is safe by server contract:
+ * CheckpointStore documents putCheckpoint/putWrite as keyed save-or-replace
+ * upserts. Budget exhaustion still fails loudly — checkpoints are not
+ * lossy-tolerable (unlike status updates, see status.ts), and silently
+ * dropping one would corrupt resume state.
  */
 import type { RunnableConfig } from "@langchain/core/runnables";
 import { BaseCheckpointSaver, type Checkpoint, type CheckpointListOptions, type CheckpointTuple, type ChannelVersions } from "@langchain/langgraph-checkpoint";
 import type { CheckpointMetadata, PendingWrite } from "@langchain/langgraph-checkpoint";
+import type { RetryOptions } from "../grpc-retry.js";
+/** Retry policy plus the per-request bound; every field is defaulted. */
+export interface HttpCheckpointSaverOptions extends RetryOptions {
+    /**
+     * Milliseconds before an in-flight request is aborted and the attempt is
+     * classified retryable. Without it a hung connection (the realistic
+     * unplanned-pod-kill symptom) stalls forever and the retry never engages.
+     */
+    readonly requestTimeoutMs?: number;
+}
 export declare class HttpCheckpointSaver extends BaseCheckpointSaver {
     private readonly baseUrl;
     private readonly headers;
-    constructor(proxyEndpoint: string, authToken: string);
+    private readonly retryPolicy;
+    constructor(proxyEndpoint: string, authToken: string, options?: HttpCheckpointSaverOptions);
+    private fetchWithRetry;
     private serializeTyped;
     private deserializeTyped;
     getTuple(config: RunnableConfig): Promise<CheckpointTuple | undefined>;

package/dist/shared/checkpointer/http-saver.js

@@ -13,8 +13,22 @@
  *
  * The Java proxy calls Document.parse(json) which handles $binary
  * natively, and doc.toJson() emits the same format on reads.
+ *
+ * Every request runs through the shared bounded-backoff loop
+ * (http-retry.ts's fetchWithRetry, with this saver's policy: transient
+ * classification + a per-request abort timeout). That loop is the ONLY
+ * retry layer between an agent execution and its checkpoints — the deep
+ * agent activity is deliberately non-retryable at the Temporal level
+ * (maximumAttempts: 1; replaying a whole agent run is not safe), so before
+ * this existed a single dropped request killed the execution
+ * (stigmer/stigmer-cloud#188). Retrying puts is safe by server contract:
+ * CheckpointStore documents putCheckpoint/putWrite as keyed save-or-replace
+ * upserts. Budget exhaustion still fails loudly — checkpoints are not
+ * lossy-tolerable (unlike status updates, see status.ts), and silently
+ * dropping one would corrupt resume state.
  */
 import { BaseCheckpointSaver, } from "@langchain/langgraph-checkpoint";
+import { fetchWithRetry } from "../http-retry.js";
 function encodeB64(data) {
     if (typeof Buffer !== "undefined") {
         return Buffer.from(data).toString("base64");
@@ -54,16 +68,42 @@ function configCheckpointId(config) {
 function configOrg(config) {
     return config.configurable?.org;
 }
+/**
+ * Default transient-retry policy. Wider than status.ts's DEFAULT_PERSIST_RETRY
+ * (3 retries, ~700 ms) on purpose: a dropped status update is lossy-tolerable,
+ * a dropped checkpoint kills the execution, so the budget here is sized to
+ * span a pod-restart reroute (~7.75 s of delays across 5 retries). Worst case
+ * with every attempt hanging — 6 x 30 s + delays, ~3.7 min — stays well inside
+ * the deep-agent activity's 1 h startToCloseTimeout (no heartbeatTimeout).
+ */
+const DEFAULT_RETRY = {
+    baseDelayMs: 250,
+    backoffFactor: 2,
+    maxRetries: 5,
+    requestTimeoutMs: 30_000,
+};
 export class HttpCheckpointSaver extends BaseCheckpointSaver {
     baseUrl;
     headers;
-    constructor(proxyEndpoint, authToken) {
+    retryPolicy;
+    constructor(proxyEndpoint, authToken, options = {}) {
         super();
         this.baseUrl = `${proxyEndpoint.replace(/\/+$/, "")}/v1/proxy/checkpoints`;
         this.headers = {
             Authorization: `Bearer ${authToken}`,
             "Content-Type": "application/json",
         };
+        this.retryPolicy = {
+            label: "HttpCheckpointSaver",
+            baseDelayMs: options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
+            backoffFactor: options.backoffFactor ?? DEFAULT_RETRY.backoffFactor,
+            maxRetries: options.maxRetries ?? DEFAULT_RETRY.maxRetries,
+            requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs,
+            delayFn: options.delayFn,
+        };
+    }
+    fetchWithRetry(url, init) {
+        return fetchWithRetry(url, init, this.retryPolicy);
     }
     async serializeTyped(obj) {
         const [typeTag, payload] = await this.serde.dumpsTyped(obj);
@@ -84,7 +124,7 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
         if (checkpointId) {
             params.set("checkpoint_id", checkpointId);
         }
-        const resp = await fetch(`${this.baseUrl}/checkpoint?${params}`, {
+        const resp = await this.fetchWithRetry(`${this.baseUrl}/checkpoint?${params}`, {
             headers: this.headers,
         });
         if (resp.status === 404)
@@ -108,7 +148,7 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
         if (beforeId) {
             params.set("before", beforeId);
         }
-        const resp = await fetch(`${this.baseUrl}/checkpoints?${params}`, {
+        const resp = await this.fetchWithRetry(`${this.baseUrl}/checkpoints?${params}`, {
             headers: this.headers,
         });
         if (!resp.ok) {
@@ -138,7 +178,7 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
         const orgId = configOrg(config);
         if (orgId)
             doc.org_id = orgId;
-        const resp = await fetch(`${this.baseUrl}/checkpoint`, {
+        const resp = await this.fetchWithRetry(`${this.baseUrl}/checkpoint`, {
             method: "PUT",
             headers: this.headers,
             body: JSON.stringify(doc),
@@ -156,7 +196,7 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
     }
     async deleteThread(threadId) {
         const params = new URLSearchParams({ thread_id: threadId });
-        const resp = await fetch(`${this.baseUrl}/thread?${params}`, {
+        const resp = await this.fetchWithRetry(`${this.baseUrl}/thread?${params}`, {
             method: "DELETE",
             headers: this.headers,
         });
@@ -185,7 +225,7 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
                 doc.org_id = orgId;
             return doc;
         }));
-        const resp = await fetch(`${this.baseUrl}/writes`, {
+        const resp = await this.fetchWithRetry(`${this.baseUrl}/writes`, {
             method: "PUT",
             headers: this.headers,
             body: JSON.stringify({ writes: docs }),
@@ -211,12 +251,18 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
                 },
             };
         }
-        const writesResp = await fetch(`${this.baseUrl}/writes?${new URLSearchParams({
+        const writesResp = await this.fetchWithRetry(`${this.baseUrl}/writes?${new URLSearchParams({
             thread_id: threadId,
             checkpoint_ns: checkpointNs,
             checkpoint_id: doc.checkpoint_id,
         })}`, { headers: this.headers });
-        const pendingWrites = await this.parseWrites(writesResp.ok ? (await writesResp.json()) : {});
+        // Fail loudly, never degrade: this used to map ANY non-ok response to "no
+        // pending writes", which silently stripped resume state on a transient
+        // 500 — a checkpoint would load without the writes recorded against it.
+        if (!writesResp.ok) {
+            throw new Error(`Checkpoint writes GET failed: ${writesResp.status} ${writesResp.statusText}`);
+        }
+        const pendingWrites = await this.parseWrites((await writesResp.json()));
         return {
             config: {
                 configurable: {