@stigmer/runner 3.10.0 → 3.11.1-dev.20260812192248

package/src/activities/execute-cursor/prompt-builder.ts

@@ -36,6 +36,7 @@ import {
   visionDisclosureLines,
   type NotViewableEntry,
 } from "../../shared/attachment-vision.js";
+import { formatTurnRecoveryText } from "./turn-recovery.js";
 import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
 import {
   buildImplementPlanDirective,
@@ -71,6 +72,18 @@ export interface VisionPromptInfo {
   notViewable: NotViewableEntry[];
 }
 
+/**
+ * One resolved attachment as the `<input_files>` section renders it —
+ * the final workspace-relative path plus the duplicate-rename disclosure
+ * (attachment-resolver.ts / shared/attachment-naming.ts).
+ */
+export interface AttachmentPromptEntry {
+  /** Workspace-relative path the agent reads (`.stigmer/inputs/{filename}`). */
+  path: string;
+  /** Original filename, present only when a duplicate name was renamed. */
+  renamedFrom?: string;
+}
+
 export interface EnhancedPromptOptions {
   instructions: string;
   userMessage: string;
@@ -78,7 +91,10 @@ export interface EnhancedPromptOptions {
   /**
    * Datastores attached via `datastore_usages` — rendered as the
    * `<available_datastores>` section (DD-005 SD-5, skills precedent)
-   * pointing the model at the synthesized record tools.
+   * pointing the model at the synthesized record tools. Always the healthy
+   * rendering here: the Cursor SDK connects MCP itself, so this harness can
+   * never observe the live roster — the section's standing
+   * failure-disclosure instruction is its whole coverage (issue #325).
    */
   datastoreUsages?: DatastoreUsage[];
   /**
@@ -90,7 +106,7 @@ export interface EnhancedPromptOptions {
   subAgents: SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
-  attachmentPaths: string[];
+  attachments: AttachmentPromptEntry[];
   /** Inline/degraded image facts for the input-files section (T04 vision). */
   vision?: VisionPromptInfo;
   interactionMode?: InteractionMode;
@@ -153,7 +169,7 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
 
   const implementPlan = formatImplementPlanSection(
     options.buildFromPlan,
-    options.attachmentPaths,
+    options.attachments,
   );
   if (implementPlan) {
     sections.push(implementPlan);
@@ -195,8 +211,8 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatWorkspaceContext(safeDirs));
   }
 
-  if (options.attachmentPaths.length > 0) {
-    sections.push(formatInputFiles(options.attachmentPaths, options.vision));
+  if (options.attachments.length > 0) {
+    sections.push(formatInputFiles(options.attachments, options.vision));
   }
 
   if (options.workspaceFileRefs.length > 0) {
@@ -323,6 +339,56 @@ export function buildReinvocationPrompt(
   return parts.join("\n\n");
 }
 
+/**
+ * Build the prompt for a fresh agent that replaced a lost one MID-HITL —
+ * the stored handle failed to resume when the approval landed, or the
+ * resumed handle proved poisoned mid-send (issue #366, both crossings).
+ *
+ * A resumed agent gets {@link buildReinvocationPrompt} alone because its
+ * native conversation carries everything else. A replacement agent's
+ * conversation is EMPTY, so the bare decisions prompt would strand it with
+ * instructions and no story — and, because recovery repoints the session at
+ * the new agent, every later turn would inherit that amnesia. This prompt
+ * rebuilds the whole story in chronological-narrative order:
+ *
+ * 1. the full enhanced prompt (blueprint, standing context, protocol, and
+ *    the turn's ORIGINAL user message as `<user_request>`),
+ * 2. `<turn_recovery>` — the state-loss disclosure plus the recorded
+ *    transcript of the turn so far (turn-recovery.ts; rendered even with no
+ *    transcript, since without the disclosure the decisions below would read
+ *    as reactions to proposals this agent never made),
+ * 3. the reinvocation decisions verbatim — already-applied / approved /
+ *    skipped semantics byte-identical to the resumed path, ending on its
+ *    "continue the task" directive.
+ *
+ * Appending past `<user_request>` is the chronology speaking (request →
+ * work done → decisions → continue), the same shape as the activity-level
+ * structured-output suffix.
+ */
+export function buildHitlRecoveryPrompt(
+  options: EnhancedPromptOptions,
+  recovery: {
+    turnDigest: string | undefined;
+    pendingApprovals: PendingApproval[];
+    approvalDecisions: Map<string, ApprovalAction>;
+    appliedToolCallIds?: ReadonlySet<string>;
+  },
+): string {
+  return [
+    buildEnhancedPrompt(options),
+    formatTurnRecoverySection(recovery.turnDigest),
+    buildReinvocationPrompt(
+      recovery.pendingApprovals,
+      recovery.approvalDecisions,
+      recovery.appliedToolCallIds,
+    ),
+  ].join("\n\n---\n\n");
+}
+
+export function formatTurnRecoverySection(digest: string | undefined): string {
+  return `<turn_recovery>\n${formatTurnRecoveryText(digest)}\n</turn_recovery>`;
+}
+
 /**
  * Render a pending approval as a short human-readable action description for the
  * reinvocation prompt. Prefers the already-resolved approval message; falls back
@@ -479,8 +545,18 @@ export function formatWorkspaceContext(dirs: string[]): string {
   ].join("\n");
 }
 
-export function formatInputFiles(paths: string[], vision?: VisionPromptInfo): string {
-  const entries = paths.map((p) => `- \`${p}\``);
+export function formatInputFiles(
+  attachments: readonly AttachmentPromptEntry[],
+  vision?: VisionPromptInfo,
+): string {
+  // A duplicate-renamed file (attachment-naming.ts) discloses its original
+  // name so the agent can connect "the two report.pdfs" in the user's
+  // message to distinct files on disk.
+  const entries = attachments.map((a) =>
+    a.renamedFrom !== undefined
+      ? `- \`${a.path}\` (renamed from duplicate '${a.renamedFrom}')`
+      : `- \`${a.path}\``,
+  );
   // The vision lines (shared wording, attachment-vision.ts) tell the model
   // which of these files it can already SEE inline versus which degraded to
   // path-only — without them an agent silently ignores a photo the user
@@ -541,14 +617,14 @@ export function formatInteractionModePrefix(
  */
 export function formatImplementPlanSection(
   buildFromPlan: boolean | undefined,
-  attachmentPaths: string[],
+  attachments: readonly AttachmentPromptEntry[],
 ): string | undefined {
   if (!buildFromPlan) {
     return undefined;
   }
 
   const directive = buildImplementPlanDirective(
-    findApprovedPlanPath(attachmentPaths),
+    findApprovedPlanPath(attachments.map((a) => a.path)),
   );
   return ["<implement_plan>", directive, "</implement_plan>"].join("\n");
 }

package/src/activities/execute-cursor/turn-recovery.ts

@@ -0,0 +1,208 @@
+/**
+ * Turn-recovery digest: the platform's recorded transcript of the current
+ * turn, rendered as prompt context for a fresh agent that replaced one whose
+ * conversation state was lost mid-turn (issue #366).
+ *
+ * A HITL-paused turn can lose its agent two ways — the stored handle fails
+ * to resume when the approval lands, or the resumed handle turns out to be
+ * poisoned mid-send. Either way the replacement agent starts with an EMPTY
+ * conversation, so the approval decisions alone read as instructions with no
+ * story: the agent no longer knows what it was doing. This module rebuilds
+ * that story from `status.messages` — the persisted execution transcript
+ * seeded on every re-invocation — which is the platform's durable record of
+ * the turn AND exactly what the user watched happen (introspecting the dead
+ * agent's own conversation is best-effort at most; the handle is the thing
+ * that failed).
+ *
+ * Doctrine (mirrors `ChannelRolloverBridgeComposer`, cloud DD-013 — the
+ * platform's reference for conversation digests):
+ * - Content here, presentation framing separate: {@link composeTurnRecoveryDigest}
+ *   emits bare `Assistant:` / `Tool:` / `System:` lines;
+ *   {@link formatTurnRecoveryText} adds the behavioral preamble; the prompt
+ *   builder wraps the section tag (the context-bridge / conversation-catchup
+ *   split).
+ * - Oldest-first reading order; over budget, the OLDEST lines drop first
+ *   (recency wins) and the drop is disclosed.
+ * - Best-effort by contract: composition never throws — a failed digest
+ *   degrades to recovery-without-transcript, never a failed recovery.
+ *
+ * Scope: the CURRENT turn only. Prior turns live in other execution records
+ * and are not recoverable runner-side (that is the rollover bridge's domain,
+ * composed cloud-side); the enhanced prompt's standing-context sections carry
+ * whatever the session already had.
+ */
+
+import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/** Per-line text budget; longer texts are cut with an ellipsis (DD-013 twin). */
+const MAX_LINE_CHARS = 400;
+
+/**
+ * Args-preview budget inside a tool line — the `describeApproval` precedent
+ * (prompt-builder.ts), so tool renderings are bounded the same way on both
+ * surfaces that describe them.
+ */
+const MAX_ARGS_CHARS = 200;
+
+/**
+ * Whole-digest budget (DD-013 twin). Enforced by dropping the OLDEST lines
+ * first — recency wins, matching how a human skims their own recent work
+ * before continuing it.
+ */
+const MAX_DIGEST_CHARS = 4000;
+
+const ELLIPSIS = "\u2026";
+
+/** Disclosed in place of the dropped prefix so the record never lies by omission. */
+const OMISSION_NOTICE = `[${ELLIPSIS} earlier activity in this turn omitted for length]`;
+
+/**
+ * How the transcript is introduced to the model. Establishes the three facts
+ * the replacement agent must hold: the work below is its OWN (continue, don't
+ * restart), completed actions are DONE (don't redo them), and the workspace —
+ * not this summary — is the source of truth for exact current state.
+ */
+const TURN_RECOVERY_PREAMBLE =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it. " +
+  "Below is the platform's recorded transcript of your progress in this " +
+  "turn, oldest first. Treat it as work YOU already did: do not start the " +
+  "task over, do not redo actions shown as completed, and check the " +
+  "workspace's current state where exact details matter.";
+
+/**
+ * Fallback framing when the turn produced no renderable transcript (or
+ * composition failed): the state-loss disclosure still matters — without it,
+ * the appended approval decisions read as reactions to proposals this agent
+ * never made.
+ */
+const TURN_RECOVERY_NO_TRANSCRIPT =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it " +
+  "and no transcript of your progress is available. Check the workspace's " +
+  "current state to see what you already did before continuing.";
+
+/**
+ * Render the turn's persisted transcript as bare digest lines, or undefined
+ * when there is nothing worth carrying. Never throws.
+ *
+ * Human messages are skipped — the turn's user message is already rendered
+ * in the enhanced prompt's `<user_request>`, and duplicating it here would
+ * dilute the budget. Thinking content is skipped as model-internal (the
+ * replacement agent forms its own). System notices are kept: platform
+ * messages like budget warnings or degradation notices are turn context the
+ * agent acted under.
+ */
+export function composeTurnRecoveryDigest(
+  messages: readonly AgentMessage[],
+): string | undefined {
+  try {
+    const lines: string[] = [];
+    for (const message of messages) {
+      lines.push(...messageLines(message));
+    }
+    if (lines.length === 0) return undefined;
+
+    // Oldest-first; drop from the FRONT when over budget so the newest work
+    // always survives, and disclose the drop (DD-013 enforcement shape). The
+    // notice participates in the budget so the result never overshoots.
+    let first = 0;
+    while (first < lines.length && totalLength(lines, first) > MAX_DIGEST_CHARS) {
+      first++;
+    }
+    if (first >= lines.length) {
+      // Degenerate case: even the newest line alone busts the budget (it is
+      // already line-truncated, so this would take a pathological budget/line
+      // ratio) — keep that one line rather than rendering nothing.
+      first = lines.length - 1;
+    }
+    const kept = lines.slice(first);
+    if (first > 0) kept.unshift(OMISSION_NOTICE);
+    return kept.join("\n");
+  } catch (err) {
+    console.warn("Turn-recovery digest composition failed — recovering without a transcript:", err);
+    return undefined;
+  }
+}
+
+/**
+ * The framed recovery body (preamble + digest), ready for section wrapping.
+ * Accepts an absent digest: the state-loss disclosure is load-bearing even
+ * when there is no transcript to show (see {@link TURN_RECOVERY_NO_TRANSCRIPT}).
+ */
+export function formatTurnRecoveryText(digest: string | undefined): string {
+  if (digest === undefined || digest.trim() === "") {
+    return TURN_RECOVERY_NO_TRANSCRIPT;
+  }
+  return `${TURN_RECOVERY_PREAMBLE}\n\n${digest.trim()}`;
+}
+
+/** The digest lines one transcript message contributes (possibly none). */
+function messageLines(message: AgentMessage): string[] {
+  const lines: string[] = [];
+  const text = message.content.trim();
+  switch (message.type) {
+    case MessageType.MESSAGE_AI:
+      if (text) lines.push(`Assistant: ${truncate(text, MAX_LINE_CHARS)}`);
+      // Tool calls ride AI messages (message.proto contract); render them
+      // even when the surrounding text is blank.
+      for (const toolCall of message.toolCalls) {
+        lines.push(toolCallLine(toolCall));
+      }
+      return lines;
+    case MessageType.MESSAGE_SYSTEM:
+      if (text) lines.push(`System: ${truncate(text, MAX_LINE_CHARS)}`);
+      return lines;
+    default:
+      // Human (already in <user_request>), thinking (model-internal), tool
+      // results (each ToolCall line already carries its outcome), unknown.
+      return lines;
+  }
+}
+
+/**
+ * One bounded line per tool call: what was attempted and how it ended.
+ * Prefers the resolved approval message where one exists — the same
+ * human-meaningful description the user approved against
+ * (the `describeApproval` convention).
+ */
+function toolCallLine(toolCall: ToolCall): string {
+  const action = toolCall.approvalMessage
+    ? toolCall.approvalMessage
+    : toolCall.argsPreview
+      ? `${toolCall.name}(${truncate(toolCall.argsPreview, MAX_ARGS_CHARS)})`
+      : toolCall.name;
+  return `Tool: ${truncate(action, MAX_LINE_CHARS)} — ${outcome(toolCall)}`;
+}
+
+function outcome(toolCall: ToolCall): string {
+  switch (toolCall.status) {
+    case ToolCallStatus.TOOL_CALL_COMPLETED:
+      return "completed";
+    case ToolCallStatus.TOOL_CALL_FAILED:
+      return toolCall.error
+        ? `failed: ${truncate(toolCall.error, MAX_ARGS_CHARS)}`
+        : "failed";
+    case ToolCallStatus.TOOL_CALL_WAITING_APPROVAL:
+      return "paused for user approval";
+    case ToolCallStatus.TOOL_CALL_SKIPPED:
+      return "skipped";
+    default:
+      // PENDING / RUNNING / unknown: in flight when the session was lost.
+      return "interrupted before it finished";
+  }
+}
+
+function truncate(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max)}${ELLIPSIS}`;
+}
+
+/** Joined length of lines[first..] plus the omission notice when one would render. */
+function totalLength(lines: readonly string[], first: number): number {
+  let total = first > 0 ? OMISSION_NOTICE.length + 1 : 0;
+  for (let i = first; i < lines.length; i++) {
+    total += lines[i].length + 1;
+  }
+  return total;
+}

package/src/activities/execute-cursor/turn-stream.ts

@@ -387,8 +387,11 @@ export async function consumeCursorTurnStream(
         console.log(
           `ExecuteCursor stream status: execution=${executionId}, status=${JSON.stringify(event)}`,
         );
-        const statusEvent = event as { status?: string; message?: string };
-        if (statusEvent.status === "ERROR" && statusEvent.message) {
+        const statusEvent = event as { status?: string; message?: unknown };
+        // The cast is a claim, not a guarantee: message is untyped at runtime
+        // (the oss#299 class of bug). A structured value here would crash
+        // classification downstream, so only capture actual text.
+        if (statusEvent.status === "ERROR" && typeof statusEvent.message === "string" && statusEvent.message.length > 0) {
           state.streamErrorMessage = statusEvent.message;
         }
       }

package/src/activities/execute-deep-agent/__tests__/attachment-injector.test.ts

@@ -600,24 +600,97 @@ describe("injectAttachments", () => {
     expect(Buffer.compare(writtenBuffer, binaryContent)).toBe(0);
   });
 
-  it("detects mount path collision before any downloads", async () => {
+  it("uniquifies duplicate default-derived filenames instead of failing (issue #364)", async () => {
+    const contentA = Buffer.from("first");
+    const contentB = Buffer.from("second");
+    const storage = makeMockStorage();
+    await storage.upload("attachments/a/data.csv", contentA);
+    await storage.upload("attachments/b/data.csv", contentB);
+
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [
+        makeAttachment({ filename: "data.csv", storageKey: "attachments/a/data.csv" }),
+        makeAttachment({ filename: "data.csv", storageKey: "attachments/b/data.csv" }),
+      ],
+      storage,
+      isLocalMode: false,
+    });
+
+    // Both files land, both downloads run — the execution is never burned
+    // over a mechanically resolvable name.
+    expect(result).toHaveLength(2);
+    expect(result[0]).toMatchObject({
+      filename: "data.csv",
+      path: ".stigmer/inputs/data.csv",
+    });
+    expect(result[0].renamedFrom).toBeUndefined();
+    // The rename follows the platform's stem-2.ext semantics and carries the
+    // disclosure payload for the prompt.
+    expect(result[1]).toMatchObject({
+      filename: "data-2.csv",
+      path: ".stigmer/inputs/data-2.csv",
+      renamedFrom: "data.csv",
+    });
+    expect(backend.writeFileBuffer).toHaveBeenCalledWith(
+      ".stigmer/inputs/data.csv", contentA,
+    );
+    expect(backend.writeFileBuffer).toHaveBeenCalledWith(
+      ".stigmer/inputs/data-2.csv", contentB,
+    );
+  });
+
+  it("rejects two attachments explicitly pinning the same mountPath (a user contradiction)", async () => {
     const backend = mockWorkspaceBackend();
     const storage = makeMockStorage();
 
     await expect(injectAttachments({
       backend,
       attachments: [
-        makeAttachment({ filename: "data.csv", storageKey: "key1" }),
-        makeAttachment({ filename: "data.csv", storageKey: "key2" }),
+        makeAttachment({ filename: "a.csv", storageKey: "key1", mountPath: "inputs/data.csv" }),
+        makeAttachment({ filename: "b.csv", storageKey: "key2", mountPath: "inputs/data.csv" }),
       ],
       storage,
       isLocalMode: false,
     })).rejects.toThrow(/collides with/);
 
-    // Verify no downloads were attempted
+    // The contradiction is detected before any downloads
     expect(storage.download).not.toHaveBeenCalled();
   });
 
+  it("default-derived names dodge an explicit mountPath already inside the inputs prefix", async () => {
+    const storage = makeMockStorage();
+    await storage.upload("attachments/a/pinned", Buffer.from("pinned"));
+    await storage.upload("attachments/b/report.pdf", Buffer.from("derived"));
+
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [
+        // Listed AFTER the default-derived attachment: explicit paths claim
+        // first regardless of order, so the default still dodges.
+        makeAttachment({ filename: "report.pdf", storageKey: "attachments/b/report.pdf" }),
+        makeAttachment({
+          filename: "report.pdf",
+          storageKey: "attachments/a/pinned",
+          mountPath: ".stigmer/inputs/report.pdf",
+        }),
+      ],
+      storage,
+      isLocalMode: false,
+    });
+
+    const byPath = new Map(result.map((f) => [f.path, f]));
+    expect(byPath.get(".stigmer/inputs/report.pdf")?.renamedFrom).toBeUndefined();
+    expect(byPath.get(".stigmer/inputs/report-2.pdf")).toMatchObject({
+      filename: "report-2.pdf",
+      renamedFrom: "report.pdf",
+    });
+  });
+
   it("derives filename from storageKey when filename is empty", async () => {
     const content = Buffer.from("fallback");
     const localFile = join(tempDir, "fallback.txt");
@@ -662,7 +735,7 @@ describe("injectAttachments", () => {
     expect(result[0].path).toBe("workspace/input.csv");
   });
 
-  it("error message includes attachment filename and actionable suggestion", async () => {
+  it("explicit-collision error names both attachments and stays actionable", async () => {
     const backend = mockWorkspaceBackend();
     const storage = makeMockStorage();
 
@@ -670,8 +743,8 @@ describe("injectAttachments", () => {
       await injectAttachments({
         backend,
         attachments: [
-          makeAttachment({ filename: "first.csv" }),
-          makeAttachment({ filename: "first.csv", storageKey: "key2" }),
+          makeAttachment({ filename: "first.csv", mountPath: "inputs/shared.csv" }),
+          makeAttachment({ filename: "second.csv", storageKey: "key2", mountPath: "inputs/shared.csv" }),
         ],
         storage,
         isLocalMode: false,
@@ -680,7 +753,7 @@ describe("injectAttachments", () => {
     } catch (err) {
       expect(err).toBeInstanceOf(AttachmentInjectionError);
       const injErr = err as AttachmentInjectionError;
-      expect(injErr.attachmentFilename).toBe("first.csv");
+      expect(injErr.attachmentFilename).toBe("second.csv");
       expect(injErr.message).toContain("first.csv");
       expect(injErr.message).toContain("mountPath");
     }
@@ -860,6 +933,35 @@ describe("injectAttachments — vision selection", () => {
     expect(injected.visionDegraded).toBe("type_mismatch");
   });
 
+  it("labels a duplicate-renamed image's vision payload with the on-disk name", async () => {
+    // Coherence pin: the prompt lists the renamed path and the vision
+    // disclosure lists image filenames — if the offer used the original
+    // attachment.filename, the agent would see two images with one
+    // indistinguishable name.
+    const backend = mockWorkspaceBackend();
+    const storage = makeMockStorage();
+    await storage.upload("attachments/a/photo.png", PNG_BYTES);
+    await storage.upload("attachments/b/photo.png", PNG_BYTES);
+
+    const injected = await injectAttachments({
+      backend,
+      attachments: [
+        makeAttachment({ filename: "photo.png", storageKey: "attachments/a/photo.png", contentType: "image/png" }),
+        makeAttachment({ filename: "photo.png", storageKey: "attachments/b/photo.png", contentType: "image/png" }),
+      ],
+      storage,
+      isLocalMode: false,
+      visionBudget: new VisionBudget(DEEP_AGENT_VISION_PROFILE),
+    });
+
+    expect(injected[0].vision?.filename).toBe("photo.png");
+    expect(injected[1]).toMatchObject({
+      filename: "photo-2.png",
+      renamedFrom: "photo.png",
+    });
+    expect(injected[1].vision?.filename).toBe("photo-2.png");
+  });
+
   it("never offers an extract archive to the budget — extracted files carry no vision fields", async () => {
     // A PNG inside a ZIP has no attachment-level bytes; the archive rides the
     // normal extraction story with no vision involvement or disclosure.

package/src/activities/execute-deep-agent/__tests__/datastore-degradation.test.ts

@@ -0,0 +1,104 @@
+/**
+ * Datastore degradation disclosure, activity half (issue #325).
+ *
+ * The activity appends the operator-facing MESSAGE_SYSTEM notice to
+ * `initialStatus.messages` BEFORE streaming (index.ts) — deliberately not
+ * through a status builder, because the v2 and v3 stream paths each
+ * construct their own builder around that same proto. These tests pin the
+ * property that push site depends on: BOTH builders preserve pre-seeded
+ * messages (ExecutionState only appends; index rebuilds touch runtime
+ * tool-call state, and a MESSAGE_SYSTEM row carries no tool calls), so
+ * the notice survives whichever stream version runs and rides every
+ * persist. The prompt half (section selection) is pinned in
+ * shared/__tests__/datastore-attachment.test.ts.
+ */
+
+import { describe, it, expect, beforeEach } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import {
+  EXPECTED_RECORD_TOOLS,
+  formatDatastoreDegradationNotice,
+} from "../../../shared/datastore-attachment.js";
+import { StatusBuilder } from "../status-builder.js";
+import { V3StatusBuilder } from "../v3-status-builder.js";
+import { normalize } from "../v3-protocol-normalizer.js";
+import {
+  resetSeq,
+  makeMessageStart,
+  makeMessageFinish,
+  makeTextDelta,
+} from "../__test-utils__/v3-event-fixtures.js";
+
+beforeEach(() => resetSeq());
+
+/** initialStatus as index.ts shapes it when setup reports missing tools. */
+function statusWithDegradationNotice(): AgentExecutionStatus {
+  const status = create(AgentExecutionStatusSchema, {});
+  status.messages.push(create(AgentMessageSchema, {
+    type: MessageType.MESSAGE_SYSTEM,
+    content: formatDatastoreDegradationNotice(1, [...EXPECTED_RECORD_TOOLS]),
+    timestamp: "2026-08-11T00:00:00.000Z",
+  }));
+  return status;
+}
+
+describe("datastore degradation notice survives streaming (issue #325)", () => {
+  it("v2 StatusBuilder preserves the pre-seeded notice through a streamed turn", () => {
+    const initialStatus = statusWithDegradationNotice();
+    const sb = new StatusBuilder("exec-1", initialStatus);
+
+    sb.processEvent({
+      event: "on_chat_model_stream",
+      run_id: "run-1",
+      data: { chunk: { content: "I cannot reach the datastore right now." } },
+    });
+    sb.processEvent({ event: "on_chat_model_end", run_id: "run-1", data: {} });
+
+    const messages = sb.currentStatus.messages;
+    expect(messages.length).toBeGreaterThanOrEqual(2);
+    expect(messages[0].type).toBe(MessageType.MESSAGE_SYSTEM);
+    expect(messages[0].content).toContain("0/5 record tools connected");
+    expect(messages[0].content).toContain("declared 1 datastore(s)");
+  });
+
+  it("v3 V3StatusBuilder preserves the pre-seeded notice through a streamed turn", () => {
+    const initialStatus = statusWithDegradationNotice();
+    const sb = new V3StatusBuilder("exec-1", initialStatus);
+
+    const protocolEvents = [
+      makeMessageStart("run-1"),
+      makeTextDelta("run-1", "I cannot reach the datastore right now."),
+      makeMessageFinish("run-1"),
+    ];
+    for (const raw of protocolEvents) {
+      for (const e of normalize(raw)) {
+        sb.processEvent(e);
+      }
+    }
+
+    const messages = sb.currentStatus.messages;
+    expect(messages.length).toBeGreaterThanOrEqual(2);
+    expect(messages[0].type).toBe(MessageType.MESSAGE_SYSTEM);
+    expect(messages[0].content).toContain("0/5 record tools connected");
+  });
+
+  it("both builders share the initialStatus proto, so the append needs no builder", () => {
+    // The push-site contract itself: mutating initialStatus.messages is
+    // visible through whichever builder wraps it.
+    const initialStatus = create(AgentExecutionStatusSchema, {});
+    const sb = new StatusBuilder("exec-1", initialStatus);
+    initialStatus.messages.push(create(AgentMessageSchema, {
+      type: MessageType.MESSAGE_SYSTEM,
+      content: formatDatastoreDegradationNotice(2, ["delete_record"]),
+      timestamp: "2026-08-11T00:00:00.000Z",
+    }));
+    expect(sb.currentStatus.messages).toHaveLength(1);
+    expect(sb.currentStatus.messages[0].content).toContain(
+      "4/5 record tools connected",
+    );
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -184,6 +184,7 @@ function fakeHttpRejectSetup(): SetupResult {
     session: { spec: { workspaceEntries: [] } },
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-http" },
     mcpConnection: null,
+    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",
@@ -219,6 +220,7 @@ function fakeMemoryRejectSetup(): SetupResult {
     session: { spec: { workspaceEntries: [] } },
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-mem" },
     mcpConnection: null,
+    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -264,6 +264,7 @@ function fakeDurableResumeSetup(): SetupResult {
     // path shared across files would serialize parallel test workers for real.
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-approve-all" },
     mcpConnection: null,
+    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",