@stigmer/runner 3.11.0 → 3.11.1-dev.20260812192248

package/src/activities/execute-cursor/__tests__/model-pricing.test.ts

@@ -1,4 +1,9 @@
-import { describe, it, expect, vi, beforeAll } from "vitest";
+import { describe, it, expect, vi, beforeAll, beforeEach, afterEach } from "vitest";
+import {
+  getPricingTable,
+  _resetPricingCache,
+  DEFAULT_PRICING,
+} from "../model-pricing-data.js";
 
 /**
  * Verifies the cursor-runner display estimate resolves Cursor speed variants
@@ -110,3 +115,59 @@ describe("getCursorModelPricing — speed variant resolution", () => {
     expect(p.inputPricePerMillion).toBe(5.0);
   });
 });
+
+describe("getPricingTable failure caching (#468)", () => {
+  beforeEach(() => {
+    _resetPricingCache();
+  });
+
+  afterEach(() => {
+    _resetPricingCache();
+    vi.useRealTimers();
+  });
+
+  it("retries after the short failure TTL instead of pinning DEFAULT_PRICING for an hour", async () => {
+    // The model-registry.ts failure-cache policy, applied here: wrong default
+    // rates for cost tracking must not persist a full success TTL.
+    vi.useFakeTimers();
+    const registryResponse = () =>
+      new Response(
+        JSON.stringify({
+          models: [
+            {
+              id: "composer-2.5",
+              displayName: "Composer 2.5",
+              provider: "cursor",
+              harness: "cursor",
+              costTier: "economy",
+              pricing: {
+                inputPricePerMillion: 0.5,
+                outputPricePerMillion: 2.5,
+                cacheWritePricePerMillion: 0,
+                cacheReadPricePerMillion: 0.2,
+              },
+            },
+          ],
+        }),
+        { status: 200, headers: { "Content-Type": "application/json" } },
+      );
+    const fetchSpy = vi
+      .fn<typeof fetch>()
+      .mockRejectedValueOnce(new Error("network error"))
+      .mockResolvedValueOnce(registryResponse());
+    vi.stubGlobal("fetch", fetchSpy);
+
+    // First call fails and degrades to the default table.
+    expect((await getPricingTable())[0]).toBe(DEFAULT_PRICING);
+
+    // Within the failure TTL the fallback stays cached (no refetch).
+    vi.advanceTimersByTime(30_000);
+    expect((await getPricingTable())[0]).toBe(DEFAULT_PRICING);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+
+    // Past the failure TTL the registry is refetched and real rates recover.
+    vi.advanceTimersByTime(31_000);
+    expect((await getPricingTable())[0]?.model).toBe("composer-2.5");
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+});

package/src/activities/execute-cursor/__tests__/turn-recovery.test.ts

@@ -0,0 +1,160 @@
+/**
+ * Unit tests for the turn-recovery digest (issue #366).
+ *
+ * The digest is the replacement agent's only account of the work its lost
+ * predecessor did, so these pins cover the three doctrine properties it
+ * inherits from the DD-013 bridge composer — bounded lines, drop-oldest
+ * budget enforcement with disclosure, never-throw — plus the rendering
+ * contract per message/tool-call kind.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+  type AgentMessage,
+  type ToolCall,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+import { composeTurnRecoveryDigest, formatTurnRecoveryText } from "../turn-recovery.js";
+
+function aiMessage(content: string, toolCalls: ToolCall[] = []): AgentMessage {
+  return create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, content, toolCalls });
+}
+
+type ToolCallFields = Partial<
+  Pick<ToolCall, "name" | "argsPreview" | "approvalMessage" | "status" | "error">
+>;
+
+function toolCall(overrides: ToolCallFields): ToolCall {
+  return create(ToolCallSchema, {
+    id: "tc-1",
+    name: "Shell",
+    status: ToolCallStatus.TOOL_CALL_COMPLETED,
+    ...overrides,
+  });
+}
+
+describe("composeTurnRecoveryDigest", () => {
+  it("renders assistant text and tool calls oldest-first", () => {
+    const digest = composeTurnRecoveryDigest([
+      aiMessage("Let me check the config first.", [
+        toolCall({ name: "Read", argsPreview: '{"path":"config.yaml"}' }),
+      ]),
+      aiMessage("The port is wrong — fixing it."),
+    ]);
+    expect(digest).toBe(
+      [
+        "Assistant: Let me check the config first.",
+        'Tool: Read({"path":"config.yaml"}) — completed',
+        "Assistant: The port is wrong — fixing it.",
+      ].join("\n"),
+    );
+  });
+
+  it("prefers the resolved approval message for a tool line — the same description the user approved against", () => {
+    const digest = composeTurnRecoveryDigest([
+      aiMessage("", [
+        toolCall({
+          approvalMessage: "Write file: gated.txt",
+          argsPreview: '{"path":"gated.txt","content":"..."}',
+          status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+        }),
+      ]),
+    ]);
+    expect(digest).toBe("Tool: Write file: gated.txt — paused for user approval");
+  });
+
+  it("maps each terminal status honestly and treats in-flight calls as interrupted", () => {
+    const digest = composeTurnRecoveryDigest([
+      aiMessage("", [
+        toolCall({ name: "A", status: ToolCallStatus.TOOL_CALL_COMPLETED }),
+        toolCall({ name: "B", status: ToolCallStatus.TOOL_CALL_FAILED, error: "exit 1" }),
+        toolCall({ name: "C", status: ToolCallStatus.TOOL_CALL_FAILED }),
+        toolCall({ name: "D", status: ToolCallStatus.TOOL_CALL_SKIPPED }),
+        toolCall({ name: "E", status: ToolCallStatus.TOOL_CALL_RUNNING }),
+        toolCall({ name: "F", status: ToolCallStatus.TOOL_CALL_PENDING }),
+      ]),
+    ]);
+    expect(digest).toBe(
+      [
+        "Tool: A — completed",
+        "Tool: B — failed: exit 1",
+        "Tool: C — failed",
+        "Tool: D — skipped",
+        "Tool: E — interrupted before it finished",
+        "Tool: F — interrupted before it finished",
+      ].join("\n"),
+    );
+  });
+
+  it("keeps system notices but skips human messages (already in <user_request>), thinking, and blanks", () => {
+    const digest = composeTurnRecoveryDigest([
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_HUMAN, content: "Fix the build" }),
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_SYSTEM, content: "Budget warning: 80% used" }),
+      create(AgentMessageSchema, { type: MessageType.MESSAGE_THINKING, content: "hmm, maybe the lockfile" }),
+      aiMessage("   "),
+    ]);
+    expect(digest).toBe("System: Budget warning: 80% used");
+  });
+
+  it("returns undefined when nothing renders", () => {
+    expect(composeTurnRecoveryDigest([])).toBeUndefined();
+    expect(
+      composeTurnRecoveryDigest([
+        create(AgentMessageSchema, { type: MessageType.MESSAGE_HUMAN, content: "only the request" }),
+      ]),
+    ).toBeUndefined();
+  });
+
+  it("truncates a long assistant line at the per-line budget with an ellipsis", () => {
+    const digest = composeTurnRecoveryDigest([aiMessage("x".repeat(1000))]);
+    expect(digest).toBe(`Assistant: ${"x".repeat(400)}\u2026`);
+  });
+
+  it("drops the OLDEST lines when over the whole-digest budget and discloses the omission", () => {
+    // 30 lines of ~311 chars each (~9.6k total) against the 4000-char budget:
+    // the newest lines must survive, the oldest go, and the notice leads.
+    const messages = Array.from({ length: 30 }, (_, i) =>
+      aiMessage(`step ${String(i).padStart(2, "0")} ${"y".repeat(300)}`),
+    );
+    const digest = composeTurnRecoveryDigest(messages);
+    expect(digest).toBeDefined();
+    expect(digest!.length).toBeLessThanOrEqual(4000);
+    const lines = digest!.split("\n");
+    expect(lines[0]).toBe("[\u2026 earlier activity in this turn omitted for length]");
+    // Recency wins: the last line is the newest entry, the first entries are gone.
+    expect(lines[lines.length - 1]).toContain("step 29");
+    expect(digest).not.toContain("step 00");
+  });
+
+  it("never throws — a malformed message degrades to no digest, not a failed recovery", () => {
+    // Force the internal iteration to blow up: content getter that throws.
+    const poison = new Proxy(aiMessage("ok"), {
+      get(target, prop, receiver) {
+        if (prop === "content") throw new Error("corrupt row");
+        return Reflect.get(target, prop, receiver);
+      },
+    });
+    expect(composeTurnRecoveryDigest([poison as AgentMessage])).toBeUndefined();
+  });
+});
+
+describe("formatTurnRecoveryText", () => {
+  it("frames a digest with the work-already-done preamble", () => {
+    const text = formatTurnRecoveryText("Assistant: did things");
+    expect(text).toContain("session holding that conversation was lost");
+    expect(text).toContain("do not start the task over");
+    expect(text.endsWith("Assistant: did things")).toBe(true);
+  });
+
+  it("still discloses the state loss when there is no transcript — without it the appended decisions would read as reactions to proposals this agent never made", () => {
+    for (const empty of [undefined, "", "   "]) {
+      const text = formatTurnRecoveryText(empty);
+      expect(text).toContain("session holding that conversation was lost");
+      expect(text).toContain("no transcript of your progress is available");
+    }
+  });
+});

package/src/activities/execute-cursor/error-classifier.ts

@@ -131,6 +131,29 @@ function extractFromCandidate(v: unknown): RunErrorSources | undefined {
   return text.length > 0 ? { sdkError: undefined, sdkResultFields: text } : undefined;
 }
 
+/**
+ * Stable lead sentence of the detail-free fallback error (all five detail
+ * channels empty — empirically the shape of Cursor-side capacity rejections,
+ * oss#492). This is what end users read in embedded surfaces, so it must be
+ * actionable product copy, not a diagnostic; the diagnostic context follows
+ * in a parenthetical. Mirrors the COST_LIMIT_ERROR_PREFIX convention: a
+ * consumer that needs to recognize this failure can match on the prefix.
+ * Do not reword without checking consumers, and NEVER include the phrase
+ * "retry or resume" — sdk-react's isInterruptedError (MessageThread.tsx)
+ * reframes any error containing it as a neutral resumable notice instead of
+ * a failure alert.
+ */
+export const DETAIL_FREE_FALLBACK_USER_PREFIX =
+  "The model may be temporarily overloaded — please retry, or switch to a different model.";
+
+/**
+ * Stable lead sentence of the transport-timeout fallback error (0 messages,
+ * ~30s duration — the SDK's default timeout with no stream established).
+ * Same user-facing rules as DETAIL_FREE_FALLBACK_USER_PREFIX above.
+ */
+export const TRANSPORT_TIMEOUT_USER_PREFIX =
+  "The connection to the model could not be established — please retry.";
+
 const AUTH_PATTERNS = [
   "unauthenticated", "unauthorized", "401", "forbidden",
   "permission_denied", "invalid api key", "not logged in",
@@ -317,7 +340,10 @@ function classifyFromSources(opts: SynthesizeErrorOpts): ClassifiedError {
     const { model, mode, agentId } = opts.fallbackContext;
     return {
       category: "network",
-      message: `Transport timeout (${opts.durationMs}ms, 0 messages received). Model=${model}, mode=${mode}, agentId=${agentId}`,
+      message:
+        `${TRANSPORT_TIMEOUT_USER_PREFIX} ` +
+        `(Transport timeout: ${opts.durationMs}ms, 0 messages received. ` +
+        `Model=${model}, mode=${mode}, agentId=${agentId})`,
       retryable: true,
       source: "fallback",
     };
@@ -332,11 +358,22 @@ function classifyFromSources(opts: SynthesizeErrorOpts): ClassifiedError {
     };
   }
 
+  // The honest last resort: every detail channel was empty. Observed in prod
+  // only during provider capacity incidents (oss#492: Composer 2.5 degradation
+  // — the SDK rejection that carries ERROR_RESOURCE_EXHAUSTED in Cursor's IDE
+  // arrives here detail-free), so the copy leads with the capacity hypothesis
+  // hedged ("may be"), and retryable is true: the observed cause is transient
+  // by nature, and nothing gates a recovery loop on unknown+retryable. The
+  // parenthetical keeps the exact Model=/mode=/agentId= tokens for log-grep
+  // continuity and the env integration test's matcher.
   const { model, mode, agentId } = opts.fallbackContext;
   return {
     category: "unknown",
-    message: `Cursor run failed (no detail from SDK). Model=${model}, mode=${mode}, agentId=${agentId}`,
-    retryable: false,
+    message:
+      `${DETAIL_FREE_FALLBACK_USER_PREFIX} ` +
+      `(No error detail from the Cursor SDK. ` +
+      `Model=${model}, mode=${mode}, agentId=${agentId})`,
+    retryable: true,
     source: "fallback",
   };
 }

package/src/activities/execute-cursor/index.ts

@@ -41,7 +41,7 @@ import type { Config } from "../../config.js";
 import { StigmerClient } from "../../client/stigmer-client.js";
 import { describeExecutionError } from "../../shared/model-error.js";
 import { resolveAgentWithTransportRecovery } from "./session-lifecycle.js";
-import type { AgentResolution, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
+import type { AgentResolution, AgentResolutionReason, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
@@ -92,7 +92,8 @@ import { buildCursorSubAgentDefinitions } from "./subagent-config.js";
 import { resolveSkills } from "./skill-resolver.js";
 import { removeStigmerSymlink } from "../../shared/workspace/stigmer-link.js";
 import { resolveAttachments } from "./attachment-resolver.js";
-import { buildEnhancedPrompt, buildReinvocationPrompt, formatConversationCatchupSection, formatInputFiles, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
+import { buildEnhancedPrompt, buildHitlRecoveryPrompt, buildReinvocationPrompt, formatConversationCatchupSection, formatInputFiles, formatInteractionModePrefix, formatImplementPlanSection } from "./prompt-builder.js";
+import { composeTurnRecoveryDigest } from "./turn-recovery.js";
 import { installHitlGate, removeHitlGate } from "./workspace-setup.js";
 import { ensureHitlDir } from "../../shared/workspace/platform-dir.js";
 import {
@@ -1161,28 +1162,43 @@ async function executeCursorInner(
       senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
       sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
       conversationCatchup: readConversationCatchup(spec.conversationCatchup),
+      // The turn's recorded transcript, seeded from the persisted execution
+      // on a reinvocation (Phase 3). Consumed only by the HITL-recovery
+      // shape — reached from HERE when the stored handle failed to resume
+      // at resolution time (issue #366 crossing 2).
+      turnRecoveryDigest: isReinvocation
+        ? composeTurnRecoveryDigest(status.messages)
+        : undefined,
     });
 
-    // Phase 10a: Inject structured output instruction for Cursor harness
-    let effectivePrompt = prompt;
-    if (structuredOutputSchema) {
-      const schemaStr = JSON.stringify(structuredOutputSchema, null, 2);
-      effectivePrompt += `\n\n---\nCRITICAL OUTPUT REQUIREMENT:\nYour final response MUST be a single valid JSON object (no markdown, no commentary, no code fences) that matches this schema:\n${schemaStr}\n\nRespond with ONLY the JSON object. Nothing else.`;
-    }
+    // Phase 10a: Inject the structured output instruction for the Cursor
+    // harness. A per-turn directive, so like buildFromPlan it must ride every
+    // prompt this turn sends — the primary AND the poisoned-handle recovery
+    // rebuild (the transport retry re-sends effectivePrompt and inherits it).
+    const withStructuredOutputDirective = (basePrompt: string): string =>
+      appendStructuredOutputDirective(basePrompt, structuredOutputSchema);
+    const effectivePrompt = withStructuredOutputDirective(prompt);
 
     // Phase 10a1: The turn's vision payload. The invariant is "images
-    // accompany the user's turn message — where the message goes, they go":
-    // every send that delivers this turn's message carries them (the primary
-    // send and both fresh-agent recovery retries, whose empty conversations
-    // genuinely need the re-send), while a HITL re-invocation — whose prompt
-    // carries no user message and whose resumed agent already holds the
-    // images in its native conversation — carries none. Computed ONCE here so
-    // all send sites agree by construction.
-    const turnImages = isHitlReinvocation(approvalDecisions)
-      ? []
-      : toCursorImages(visionImages);
-    const toSendMessage = (sendPrompt: string): string | SDKUserMessage =>
-      turnImages.length > 0 ? { text: sendPrompt, images: turnImages } : sendPrompt;
+    // accompany the user's turn message, wherever the conversation does not
+    // already hold them" (primarySendCarriesImages): the ONLY send that
+    // skips them is a HITL re-invocation of a successfully RESUMED agent,
+    // whose native conversation carries the images from the original send.
+    // Every send that starts an empty conversation re-delivers them — the
+    // ordinary first/fresh-agent primary send, the HITL primary send after a
+    // resolution-time resume failure, and both mid-send recovery retries
+    // (which always run on a fresh agent, so their sites pass turnImages
+    // unconditionally). Attachments re-resolve on every invocation
+    // (Phase 5b), so the bytes are in hand even on a re-invocation.
+    const turnImages = toCursorImages(visionImages);
+    const primarySendImages = primarySendCarriesImages(approvalDecisions, resolution.reason)
+      ? turnImages
+      : [];
+    const toSendMessage = (
+      sendPrompt: string,
+      images: { data: string; mimeType: string }[],
+    ): string | SDKUserMessage =>
+      images.length > 0 ? { text: sendPrompt, images } : sendPrompt;
 
     // Phase 10a2: Log Stigmer preamble size for context trimming diagnostics
     const promptChars = effectivePrompt.length;
@@ -1298,7 +1314,7 @@ async function executeCursorInner(
     // The stall watchdog is armed inside consumeCursorTurnStream (it needs the
     // run to cancel), stored on turnState.stallWatchdog so this shared onDelta can
     // reset it and the activity's finally can stop it as a backstop.
-    const run = await resolution.agent.send(toSendMessage(effectivePrompt), {
+    const run = await resolution.agent.send(toSendMessage(effectivePrompt, primarySendImages), {
       onDelta: (event) => {
         if (!turnFirstEventEmitted) {
           turnFirstEventEmitted = true;
@@ -1669,10 +1685,11 @@ async function executeCursorInner(
       // poisoned-handle path leaked the fresh agent — it closed the stale one.)
       resolution = { ...resolution, agent: freshAgent, agentId: freshAgent.agentId, isNew: true };
       turnState.streamErrorMessage = undefined;
-      // The retry carries the turn's images too (same toSendMessage): the
-      // fresh agent's conversation is empty, so skipping them here would
-      // silently lose the user's photo on a recovered turn.
-      const retryRun = await freshAgent.send(toSendMessage(retryPrompt), {
+      // The retry always carries the turn's full image payload — never the
+      // primary send's HITL-trimmed set: the fresh agent's conversation is
+      // empty, so skipping them here would silently lose the user's photo on
+      // a recovered turn (issue #366's vision corollary).
+      const retryRun = await freshAgent.send(toSendMessage(retryPrompt, turnImages), {
         onDelta: makeCursorTurnOnDelta(onDeltaDeps),
       });
       await consumeCursorTurnStream(retryRun, streamDeps);
@@ -1812,6 +1829,10 @@ async function executeCursorInner(
             attachments: attachmentEntries,
             vision: visionPromptInfo,
             pendingApprovals: adjudicatedApprovals,
+            // Without the applied set, the HITL-recovery prompt would tell
+            // the fresh agent to carry out writes the runner already
+            // exact-applied (the primary call at Phase 10 passes it too).
+            appliedToolCallIds,
             interactionMode,
             // buildFromPlan was silently dropped here until T03 Sitting 3 —
             // a build turn that hit handle recovery lost its directive. The
@@ -1822,6 +1843,10 @@ async function executeCursorInner(
             senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
             sessionContext: readSessionContext(blueprint.sessionSpec.metadata),
             conversationCatchup: readConversationCatchup(spec.conversationCatchup),
+            // Composed fresh (not reused from Phase 10): the failed primary
+            // stream may have appended partial work onto status.messages,
+            // and the replacement agent should know about that too.
+            turnRecoveryDigest: composeTurnRecoveryDigest(status.messages),
           });
 
           console.log(
@@ -1837,7 +1862,14 @@ async function executeCursorInner(
             console.warn("Failed to update session with fresh agentId (non-fatal):", updateErr);
           }
 
-          const outcome = await runRecoveryStream(freshAgent, freshPrompt);
+          // Same per-turn directive rule as buildFromPlan above: a
+          // structured-output turn keeps its output contract on the rebuilt
+          // prompt (the transport retry re-sends effectivePrompt and
+          // inherits it without help).
+          const outcome = await runRecoveryStream(
+            freshAgent,
+            withStructuredOutputDirective(freshPrompt),
+          );
           if (!outcome.proceeded) {
             if (outcome.terminal.kind === "return") return slimStatus(status);
             throw new CancelledFailure(outcome.terminal.message);
@@ -2400,6 +2432,15 @@ export interface BuildPromptInput {
    * usually blank.
    */
   conversationCatchup?: string;
+  /**
+   * The turn's recorded transcript rendered as digest lines
+   * (turn-recovery.ts), composed from `status.messages` at the call site.
+   * Consumed ONLY by the HITL-recovery shape — a fresh agent that replaced
+   * a lost one mid-HITL needs the story of the work it no longer remembers
+   * (issue #366); every other shape either has native context or no prior
+   * work to tell.
+   */
+  turnRecoveryDigest?: string;
 }
 
 /**
@@ -2411,20 +2452,28 @@ export interface BuildPromptInput {
  * volume, or cloud server-side state) — there is no separate continuation
  * store. The prompt therefore depends only on how the agent was resolved:
  *
- * 1. HITL reinvocation        -> buildReinvocationPrompt (approval decisions;
- *                                 the resumed agent's native context carries
- *                                 the prior conversation)
- * 2. resumed_successfully      -> raw userMessage (native context carries it)
- * 3. first execution / fresh   -> buildEnhancedPrompt (full instructions +
+ * 1. HITL reinvocation,        -> buildReinvocationPrompt (approval decisions
+ *    resumed agent                 only; the resumed agent's native context
+ *                                  carries the prior conversation)
+ * 2. HITL reinvocation,        -> buildHitlRecoveryPrompt (full context +
+ *    fresh agent after            the turn's recorded transcript + decisions;
+ *    resume failure               the replacement agent's conversation is
+ *                                 empty, and both fresh-agent crossings —
+ *                                 resolution-time resume failure and mid-send
+ *                                 poisoned-handle recovery — land here by
+ *                                 keying on the reason, issue #366)
+ * 3. resumed_successfully      -> raw userMessage (native context carries it)
+ * 4. first execution / fresh   -> buildEnhancedPrompt (full instructions +
  *    agent after resume failure   skills; no prior conversation to inherit)
  */
 /**
  * Whether this activity invocation is a HITL re-invocation — the turn resumes
  * an agent purely to convey approval decisions, carrying NO user message.
- * The single discriminator for everything that must ride with the user's
- * message and nothing else: the reinvocation prompt shape (below) and the
- * vision payload (images accompany the message; a resumed agent already holds
- * them in its native conversation).
+ * Discriminates the two surfaces that depend on the agent already holding
+ * this turn's content natively — the prompt shape (below) and the primary
+ * send's vision payload — but never alone: both pair it with
+ * `resolution.reason`, because a FRESH agent mid-HITL holds nothing and
+ * needs the full re-delivery (issue #366).
  */
 export function isHitlReinvocation(
   approvalDecisions: Map<string, ApprovalAction> | undefined,
@@ -2432,6 +2481,39 @@ export function isHitlReinvocation(
   return approvalDecisions !== undefined && approvalDecisions.size > 0;
 }
 
+/**
+ * Whether the PRIMARY send delivers the turn's vision payload. The invariant
+ * is "images accompany the user's turn message, wherever the conversation
+ * does not already hold them" — so the only send that skips them is a HITL
+ * re-invocation of a successfully RESUMED agent, whose native conversation
+ * carries the images from the original send. A fresh agent mid-HITL
+ * (resolution-time resume failure — issue #366's vision corollary) holds
+ * nothing and needs the re-delivery. The mid-send recovery retries always
+ * run on a fresh agent, so their send sites carry the payload
+ * unconditionally rather than consulting this.
+ */
+export function primarySendCarriesImages(
+  approvalDecisions: Map<string, ApprovalAction> | undefined,
+  reason: AgentResolutionReason,
+): boolean {
+  return !(isHitlReinvocation(approvalDecisions) && reason === "resumed_successfully");
+}
+
+/**
+ * Append the structured-output contract to a prompt when the execution
+ * requests one. A per-turn directive (the buildFromPlan rule): it must ride
+ * every prompt this turn sends — the primary send AND the poisoned-handle
+ * recovery rebuild, which previously lost it (issue #366 ride-along).
+ */
+export function appendStructuredOutputDirective(
+  basePrompt: string,
+  schema: Record<string, unknown> | undefined,
+): string {
+  if (!schema) return basePrompt;
+  const schemaStr = JSON.stringify(schema, null, 2);
+  return basePrompt + `\n\n---\nCRITICAL OUTPUT REQUIREMENT:\nYour final response MUST be a single valid JSON object (no markdown, no commentary, no code fences) that matches this schema:\n${schemaStr}\n\nRespond with ONLY the JSON object. Nothing else.`;
+}
+
 export function buildPrompt(input: BuildPromptInput): string {
   const {
     resolution,
@@ -2448,10 +2530,44 @@ export function buildPrompt(input: BuildPromptInput): string {
     conversationCatchup,
   } = input;
 
-  // HITL reinvocation: the agent is resumed, so its native context carries the
-  // prior conversation; the reinvocation prompt conveys the approval decisions
-  // (and which approved writes the runner already exact-applied).
+  // HITL reinvocation: the decisions-only prompt is correct ONLY while the
+  // agent's native context still carries the prior conversation — which only
+  // resumed_successfully guarantees. Any other reason means a fresh agent
+  // mid-HITL (in practice created_after_resume_failure: the stored handle
+  // failed to resume, or a poisoned handle was replaced mid-send), which
+  // gets the full recovery shape instead — enhanced context + the turn's
+  // recorded transcript + the same decisions — because the bare decisions on
+  // an empty conversation strand the agent with instructions and no story,
+  // and the session inherits that amnesia permanently (issue #366).
   if (isHitlReinvocation(approvalDecisions)) {
+    if (resolution.reason !== "resumed_successfully") {
+      return buildHitlRecoveryPrompt(
+        {
+          instructions,
+          userMessage,
+          skills,
+          datastoreUsages: input.datastoreUsages ?? [],
+          channelMessaging: input.channelMessaging ?? [],
+          subAgents,
+          workspaceDirs,
+          workspaceFileRefs,
+          attachments,
+          vision: input.vision,
+          interactionMode,
+          buildFromPlan,
+          contextBridge: input.contextBridge,
+          senderIdentity: input.senderIdentity,
+          sessionContext: input.sessionContext,
+          conversationCatchup,
+        },
+        {
+          turnDigest: input.turnRecoveryDigest,
+          pendingApprovals: input.pendingApprovals,
+          approvalDecisions,
+          appliedToolCallIds: input.appliedToolCallIds,
+        },
+      );
+    }
     return buildReinvocationPrompt(
       input.pendingApprovals,
       approvalDecisions,

package/src/activities/execute-cursor/model-pricing-data.ts

@@ -8,7 +8,12 @@
  * endpoint is unreachable.
  */
 
-import { resolveModelRegistryUrl, buildRegistryHeaders } from "../../shared/registry-endpoint.js";
+import {
+  resolveModelRegistryUrl,
+  buildRegistryHeaders,
+  REGISTRY_RETRY_POLICY,
+} from "../../shared/registry-endpoint.js";
+import { fetchWithRetry } from "../../shared/http-retry.js";
 
 /** Per-million rates for a speed/mode variant (e.g. "fast") of a base model. */
 export interface CursorVariantPricing {
@@ -53,6 +58,10 @@ interface RegistryEntry {
 }
 
 const CACHE_TTL_MS = 3_600_000; // 1 hour
+// Failed fetches are cached much shorter than successes (the model-registry.ts
+// policy): a transient failure must not pin DEFAULT_PRICING — wrong rates for
+// cost tracking — for a full hour.
+const FAILURE_CACHE_TTL_MS = 60_000;
 
 const DEFAULT_PRICING: CursorModelPricing = {
   model: "unknown",
@@ -104,7 +113,11 @@ function parseVariants(
 }
 
 async function fetchFromApi(): Promise<readonly CursorModelPricing[]> {
-  const res = await fetch(resolveModelRegistryUrl(), { headers: buildRegistryHeaders() });
+  const res = await fetchWithRetry(
+    resolveModelRegistryUrl(),
+    { headers: buildRegistryHeaders() },
+    REGISTRY_RETRY_POLICY,
+  );
   if (!res.ok) throw new Error(`Model registry fetch failed: ${res.status}`);
   const data: unknown = await res.json();
   const table = parsePricingTable(data);
@@ -138,7 +151,7 @@ export async function getPricingTable(): Promise<readonly CursorModelPricing[]>
         `Failed to fetch model registry from API, using default pricing: ${err}`,
       );
       const fallback = [DEFAULT_PRICING];
-      cache = { data: fallback, expiresAt: Date.now() + CACHE_TTL_MS };
+      cache = { data: fallback, expiresAt: Date.now() + FAILURE_CACHE_TTL_MS };
       return fallback;
     })
     .finally(() => {
@@ -148,4 +161,10 @@ export async function getPricingTable(): Promise<readonly CursorModelPricing[]>
   return inflightFetch;
 }
 
+/** Exposed for testing — resets the in-memory cache. */
+export function _resetPricingCache(): void {
+  cache = null;
+  inflightFetch = null;
+}
+
 export { DEFAULT_PRICING };