@stigmer/runner 3.11.0 → 3.11.1-dev.20260812192248

package/src/shared/__tests__/model-pricing.test.ts

@@ -1,6 +1,11 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { computeLlmCostMicros, computeTurnCost, getModelPricing, resolveModelId, ensureLoaded } from "../model-pricing.js";
-import type { ModelPricing } from "../model-pricing-data.js";
+import {
+  getPricingTable,
+  _resetPricingCache,
+  DEFAULT_PRICING,
+  type ModelPricing,
+} from "../model-pricing-data.js";
 
 describe("computeLlmCostMicros", () => {
   it("falls back to DEFAULT_PRICING when registry is not loaded", () => {
@@ -83,3 +88,58 @@ describe("getModelPricing", () => {
     expect(pricing.model).toBe("custom-model");
   });
 });
+
+describe("getPricingTable failure caching (#468)", () => {
+  beforeEach(() => {
+    _resetPricingCache();
+    vi.restoreAllMocks();
+  });
+
+  afterEach(() => {
+    _resetPricingCache();
+    vi.useRealTimers();
+  });
+
+  const registryResponse = () =>
+    new Response(
+      JSON.stringify({
+        models: [
+          {
+            id: "claude-sonnet-4-6",
+            displayName: "Claude Sonnet",
+            costTier: "standard",
+            pricing: {
+              inputPricePerMillion: 3.0,
+              outputPricePerMillion: 15.0,
+              cacheWritePricePerMillion: 3.75,
+              cacheReadPricePerMillion: 0.3,
+            },
+          },
+        ],
+      }),
+      { status: 200, headers: { "Content-Type": "application/json" } },
+    );
+
+  it("retries after the short failure TTL instead of pinning DEFAULT_PRICING for an hour", async () => {
+    // The model-registry.ts failure-cache policy, applied here: wrong default
+    // rates for cost tracking must not persist a full success TTL.
+    vi.useFakeTimers();
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockRejectedValueOnce(new Error("network error"))
+      .mockResolvedValueOnce(registryResponse());
+
+    // First call fails and degrades to the default table.
+    expect((await getPricingTable())[0]).toBe(DEFAULT_PRICING);
+
+    // Within the failure TTL the fallback stays cached (no refetch).
+    vi.advanceTimersByTime(30_000);
+    expect((await getPricingTable())[0]).toBe(DEFAULT_PRICING);
+    expect(fetchSpy).toHaveBeenCalledTimes(1);
+
+    // Past the failure TTL the registry is refetched and real rates recover.
+    vi.advanceTimersByTime(31_000);
+    expect((await getPricingTable())[0]?.model).toBe("claude-sonnet-4-6");
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+});

package/src/shared/__tests__/model-registry.test.ts

@@ -223,6 +223,28 @@ describe("resolveToApiModelId", () => {
     expect(result).toBe("claude-haiku-4.5");
   });
 
+  it("recovers from a transient network failure without engaging the failure cache (#468)", async () => {
+    // undici's retryable shape (TypeError) — the shared bounded-backoff loop
+    // absorbs it, so resolution succeeds on the SAME call and the 60 s
+    // degraded window never opens. Pre-#468 code failed the fetch outright.
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockRejectedValueOnce(new TypeError("fetch failed"))
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify({
+            models: [
+              { id: "claude-haiku-4.5", apiModelId: "claude-haiku-4-5-20251001", provider: "anthropic", costTier: "economy", harness: "native" },
+            ],
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        ),
+      );
+
+    expect(await resolveToApiModelId("claude-haiku-4.5")).toBe("claude-haiku-4-5-20251001");
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+  });
+
   it("retries after the short failure TTL instead of caching the failure for an hour", async () => {
     vi.useFakeTimers();
     const fetchSpy = vi

package/src/shared/artifact-storage.ts

@@ -13,6 +13,11 @@
  * The runner never holds R2/S3 credentials — in cloud mode it calls the proxy
  * to obtain a presigned upload URL, then PUTs content over plain HTTPS.
  *
+ * Every proxy-backend request rides the shared bounded-backoff loop
+ * (http-retry.ts) with a per-request abort timeout, so a momentary
+ * stigmer-service interruption is retried and a hung connection cannot
+ * stall an agent turn unboundedly (stigmer/stigmer#468).
+ *
  * DD-6: No direct R2 backend. Local + Proxy only.
  */
 
@@ -20,6 +25,8 @@ import { mkdir, writeFile, readFile, access, rm } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import type { Config } from "../config.js";
+import type { RetryOptions } from "./grpc-retry.js";
+import { fetchWithRetry, type FetchRetryPolicy } from "./http-retry.js";
 
 // ── Interface ────────────────────────────────────────────────────────
 
@@ -117,13 +124,64 @@ export class LocalArtifactStorage implements ArtifactStorage {
 
 // ── Proxy Backend ────────────────────────────────────────────────────
 
+/** Retry policy plus the two per-request bounds; every field is defaulted. */
+export interface ProxyArtifactStorageOptions extends RetryOptions {
+  /** Bound for proxy presign calls and the 1-byte exists probe. Default 30 s. */
+  readonly requestTimeoutMs?: number;
+  /**
+   * Bound for the presigned R2 PUT/GET, which move whole artifact payloads
+   * (claim-check offloads, tool outputs, file-review captures — MB scale).
+   * Deliberately wider than requestTimeoutMs so a legitimate slow transfer
+   * is never aborted by a bound sized for JSON round-trips. Default 120 s.
+   */
+  readonly transferTimeoutMs?: number;
+}
+
+/**
+ * Default transient-retry policy (stigmer/stigmer#468): the checkpointer's
+ * budget — sized to span a pod-restart reroute, ~7.75 s of delays across
+ * 5 retries. Retrying is safe at every site: the presign POSTs are
+ * idempotent mints, the PUT re-sends identical bytes to the same key (a
+ * keyed overwrite), and the GETs are reads.
+ */
+const DEFAULT_RETRY = {
+  baseDelayMs: 250,
+  backoffFactor: 2,
+  maxRetries: 5,
+  requestTimeoutMs: 30_000,
+  transferTimeoutMs: 120_000,
+} as const;
+
 export class ProxyArtifactStorage implements ArtifactStorage {
   private readonly baseUrl: string;
   private readonly authTokenSource: ProxyAuthTokenSource;
-
-  constructor(proxyEndpoint: string, authToken: ProxyAuthTokenSource) {
+  /** Governs the proxy presign calls and the exists probe. */
+  private readonly requestPolicy: FetchRetryPolicy;
+  /** Governs the presigned R2 transfers; same budget, wider timeout. */
+  private readonly transferPolicy: FetchRetryPolicy;
+
+  constructor(
+    proxyEndpoint: string,
+    authToken: ProxyAuthTokenSource,
+    options: ProxyArtifactStorageOptions = {},
+  ) {
     this.baseUrl = `${proxyEndpoint.replace(/\/+$/, "")}/v1/proxy/artifacts`;
     this.authTokenSource = authToken;
+    const shared = {
+      label: "ProxyArtifactStorage",
+      baseDelayMs: options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
+      backoffFactor: options.backoffFactor ?? DEFAULT_RETRY.backoffFactor,
+      maxRetries: options.maxRetries ?? DEFAULT_RETRY.maxRetries,
+      delayFn: options.delayFn,
+    };
+    this.requestPolicy = {
+      ...shared,
+      requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs,
+    };
+    this.transferPolicy = {
+      ...shared,
+      requestTimeoutMs: options.transferTimeoutMs ?? DEFAULT_RETRY.transferTimeoutMs,
+    };
   }
 
   /**
@@ -141,14 +199,14 @@ export class ProxyArtifactStorage implements ArtifactStorage {
   async upload(key: string, content: Buffer, contentType?: string): Promise<string> {
     const ct = contentType ?? "application/octet-stream";
 
-    const presignResp = await fetch(`${this.baseUrl}/presigned-upload-url`, {
+    const presignResp = await fetchWithRetry(`${this.baseUrl}/presigned-upload-url`, {
       method: "POST",
       headers: {
         "Authorization": `Bearer ${this.authToken}`,
         "Content-Type": "application/json",
       },
       body: JSON.stringify({ key, content_type: ct }),
-    });
+    }, this.requestPolicy);
     if (!presignResp.ok) {
       throw new Error(
         `Failed to get presigned upload URL (HTTP ${presignResp.status}): ` +
@@ -180,11 +238,14 @@ export class ProxyArtifactStorage implements ArtifactStorage {
       uploadHeaders["Content-Type"] = ct;
     }
 
-    const putResp = await fetch(data.url, {
+    // Retrying the PUT alone (not the presign+PUT pair) is deliberate: the
+    // retry budget's few seconds of delays sit far inside presign validity,
+    // and re-sending the same Buffer to the same key is a keyed overwrite.
+    const putResp = await fetchWithRetry(data.url, {
       method: "PUT",
       headers: uploadHeaders,
       body: content,
-    });
+    }, this.transferPolicy);
     if (!putResp.ok) {
       throw new Error(
         `Presigned upload failed (HTTP ${putResp.status}): ` +
@@ -196,14 +257,14 @@ export class ProxyArtifactStorage implements ArtifactStorage {
   }
 
   async getDownloadUrl(key: string): Promise<string> {
-    const resp = await fetch(`${this.baseUrl}/presigned-download-url`, {
+    const resp = await fetchWithRetry(`${this.baseUrl}/presigned-download-url`, {
       method: "POST",
       headers: {
         "Authorization": `Bearer ${this.authToken}`,
         "Content-Type": "application/json",
       },
       body: JSON.stringify({ key }),
-    });
+    }, this.requestPolicy);
     if (!resp.ok) {
       throw new Error(
         `Failed to get presigned download URL (HTTP ${resp.status}): ` +
@@ -216,7 +277,7 @@ export class ProxyArtifactStorage implements ArtifactStorage {
 
   async download(key: string): Promise<Buffer> {
     const url = await this.getDownloadUrl(key);
-    const resp = await fetch(url);
+    const resp = await fetchWithRetry(url, undefined, this.transferPolicy);
     if (!resp.ok) {
       throw new Error(
         `Artifact download failed (HTTP ${resp.status}) for key '${key}': ` +
@@ -242,7 +303,11 @@ export class ProxyArtifactStorage implements ArtifactStorage {
       // addressed CAS blob dedup) then re-uploads, which is idempotent.
       return false;
     }
-    const resp = await fetch(url, { headers: { Range: "bytes=0-0" } });
+    const resp = await fetchWithRetry(
+      url,
+      { headers: { Range: "bytes=0-0" } },
+      this.requestPolicy,
+    );
     await resp.arrayBuffer().catch(() => undefined); // drain the <=1-byte body
     if (resp.status === 404) return false;
     if (resp.status === 200 || resp.status === 206 || resp.status === 416) return true;

package/src/shared/checkpointer/http-saver.ts

@@ -14,9 +14,9 @@
  * The Java proxy calls Document.parse(json) which handles $binary
  * natively, and doc.toJson() emits the same format on reads.
  *
- * Every request runs through {@link HttpCheckpointSaver.fetchWithRetry}:
- * bounded exponential backoff on transient failures (classified by
- * http-retry.ts) with a per-request abort timeout. This loop is the ONLY
+ * Every request runs through the shared bounded-backoff loop
+ * (http-retry.ts's fetchWithRetry, with this saver's policy: transient
+ * classification + a per-request abort timeout). That loop is the ONLY
  * retry layer between an agent execution and its checkpoints — the deep
  * agent activity is deliberately non-retryable at the Temporal level
  * (maximumAttempts: 1; replaying a whole agent run is not safe), so before
@@ -39,7 +39,7 @@ import {
 } from "@langchain/langgraph-checkpoint";
 import type { CheckpointMetadata, PendingWrite } from "@langchain/langgraph-checkpoint";
 import type { RetryOptions } from "../grpc-retry.js";
-import { isRetryableFetchError, isRetryableHttpStatus } from "../http-retry.js";
+import { fetchWithRetry, type FetchRetryPolicy } from "../http-retry.js";
 
 function encodeB64(data: Uint8Array): string {
   if (typeof Buffer !== "undefined") {
@@ -117,18 +117,10 @@ const DEFAULT_RETRY = {
   requestTimeoutMs: 30_000,
 } as const;
 
-function defaultDelay(ms: number): Promise<void> {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
 export class HttpCheckpointSaver extends BaseCheckpointSaver {
   private readonly baseUrl: string;
   private readonly headers: Record<string, string>;
-  private readonly baseDelayMs: number;
-  private readonly backoffFactor: number;
-  private readonly maxRetries: number;
-  private readonly requestTimeoutMs: number;
-  private readonly delay: (ms: number) => Promise<void>;
+  private readonly retryPolicy: FetchRetryPolicy;
 
   constructor(
     proxyEndpoint: string,
@@ -141,55 +133,18 @@ export class HttpCheckpointSaver extends BaseCheckpointSaver {
       Authorization: `Bearer ${authToken}`,
       "Content-Type": "application/json",
     };
-    this.baseDelayMs = options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs;
-    this.backoffFactor = options.backoffFactor ?? DEFAULT_RETRY.backoffFactor;
-    this.maxRetries = options.maxRetries ?? DEFAULT_RETRY.maxRetries;
-    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs;
-    this.delay = options.delayFn ?? defaultDelay;
-  }
-
-  /**
-   * `fetch` with bounded exponential backoff on transient failures and a
-   * per-request abort timeout.
-   *
-   * Composition contract: on a non-retryable status — or when the budget is
-   * exhausted on a retryable one — the last `Response` is RETURNED, so every
-   * call site keeps its own `resp.ok` / 404 handling unchanged; this wrapper
-   * changes when a response arrives, never what call sites do with it. It
-   * throws only what `fetch` itself throws: a network-level rejection that is
-   * non-retryable or has exhausted the budget.
-   */
-  private async fetchWithRetry(url: string, init?: RequestInit): Promise<Response> {
-    for (let attempt = 0; ; attempt++) {
-      const canRetry = attempt < this.maxRetries;
-      let resp: Response;
-      try {
-        resp = await fetch(url, {
-          ...init,
-          signal: AbortSignal.timeout(this.requestTimeoutMs),
-        });
-      } catch (err) {
-        if (canRetry && isRetryableFetchError(err)) {
-          await this.backOff(attempt, String(err));
-          continue;
-        }
-        throw err;
-      }
-      if (canRetry && isRetryableHttpStatus(resp.status)) {
-        await this.backOff(attempt, `HTTP ${resp.status} ${resp.statusText}`);
-        continue;
-      }
-      return resp;
-    }
+    this.retryPolicy = {
+      label: "HttpCheckpointSaver",
+      baseDelayMs: options.baseDelayMs ?? DEFAULT_RETRY.baseDelayMs,
+      backoffFactor: options.backoffFactor ?? DEFAULT_RETRY.backoffFactor,
+      maxRetries: options.maxRetries ?? DEFAULT_RETRY.maxRetries,
+      requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_RETRY.requestTimeoutMs,
+      delayFn: options.delayFn,
+    };
   }
 
-  private async backOff(attempt: number, reason: string): Promise<void> {
-    const delayMs = this.baseDelayMs * Math.pow(this.backoffFactor, attempt);
-    console.warn(
-      `[HttpCheckpointSaver] retryable failure ` +
-      `(attempt ${attempt + 1}/${this.maxRetries + 1}, retry in ${delayMs}ms): ${reason}`,
-    );
-    await this.delay(delayMs);
+  private fetchWithRetry(url: string, init?: RequestInit): Promise<Response> {
+    return fetchWithRetry(url, init, this.retryPolicy);
   }
 
   private async serializeTyped(obj: unknown): Promise<[string, BinaryObj]> {

package/src/shared/conversation-catchup.ts

@@ -1,8 +1,15 @@
 /**
  * Conversation catchup (cloud channel-conversations DD-006): what happened on
  * a live channel conversation that the agent has not seen — customer messages
- * handled by a human teammate, the teammate's replies, platform notices the
- * customer received, notes, and the agent's own earlier escalations.
+ * handled by a human teammate, the teammate's replies, platform notices,
+ * notes, and the agent's own earlier escalations. Since cloud#347 a line
+ * whose send is known-undelivered carries a `(not delivered)` speaker
+ * annotation and an in-flight one carries `(sending)` — the digest no longer
+ * implies every public-lane line reached the customer. Since cloud#352 the
+ * digest also closes the feedback loop on send OUTCOMES: the agent's own
+ * dead-lettered sends surface as `You (not delivered):` lines, and a send
+ * that failed only after an earlier digest already conveyed it surfaces as a
+ * `System:` delivery-failure notice at the moment the failure became known.
  *
  * The cloud composes the CONTENT (bare `Customer:` / `Teammate:` / `System:` /
  * `You escalated:` / `Note:` lines, oldest first) on the execution spec's
@@ -29,16 +36,42 @@ import type { ConversationCatchup } from "@stigmer/protos/ai/stigmer/agentic/age
  * drift between them. Deliberately takeover-neutral: a digest can exist with
  * no human handoff at all (a failed turn's re-composed window), so the
  * preamble asserts only what is always true (the A15/A20 honesty bar).
+ *
+ * The send-status annotations (cloud#347) get an explicit exception from the
+ * don't-re-answer contract: a `(not delivered)` teammate reply is words the
+ * customer never got, so treating it as settled history would silently
+ * abandon whatever it was meant to convey. The preamble defines the
+ * annotations — the DD-013 split puts model-facing meaning here, while the
+ * cloud composer owns which lines earn them.
+ *
+ * The send-outcome lines (cloud#352, cloud triage DD-009) extend the same
+ * exception to the agent's OWN sends: `You (not delivered):` lines and
+ * `System:` delivery-failure notices mean the customer never got those
+ * words. The behavioral contract is owner-ruled (DD-009 Q-4): treat the
+ * failure as unfinished conversation business — weigh what still needs
+ * saying and re-say it naturally in the next turn — but never resend the
+ * failed text verbatim: a multi-chunk send can partially land, and a
+ * word-for-word repeat risks the customer reading the same message twice.
  */
 const CONVERSATION_CATCHUP_PREAMBLE =
   "Below is activity from this conversation that you have not seen — " +
   "oldest first. It may include customer messages that were handled by a " +
-  "human teammate, the teammate's own replies, notices the customer " +
-  "received, internal notes, and escalations you raised earlier. Treat it " +
+  "human teammate, the teammate's own replies, notices sent to the " +
+  "customer, internal notes, and escalations you raised earlier. Treat it " +
   "as conversation history you already know: do not answer or re-answer " +
   "these messages, do not repeat or summarize them back, and do not " +
-  "mention any handoff unless asked. Continue from the customer's newest " +
-  "message.";
+  "mention any handoff unless asked. One exception: lines marked " +
+  "(not delivered) never reached the customer, and lines marked (sending) " +
+  "were still on their way when this summary was built — the customer may " +
+  "not have seen those words, so weigh that when deciding what still needs " +
+  "saying. That includes your own words: a line marked " +
+  "You (not delivered), or a System line reporting that a message was not " +
+  "delivered, means the customer never received it. Treat such a failure " +
+  "as unfinished business — if what it said still matters, work it " +
+  "naturally into your reply in your own words, but never resend the " +
+  "failed text word-for-word (part of it may have reached the customer, " +
+  "and an exact repeat reads as a duplicate). " +
+  "Continue from the customer's newest message.";
 
 /**
  * Read the catchup digest from an execution spec's `conversation_catchup`.

package/src/shared/grpc-retry.ts

@@ -6,7 +6,11 @@
  * `updateStatus` should back off and retry (transient transport errors) or
  * fail fast (deterministic errors). This module is intentionally just the
  * classification policy + its options type, kept small and separately tested;
- * the persist loop that consumes it lives with the rest of the persist logic.
+ * the persist loop that consumes it lives with the rest of the persist logic
+ * in status.ts — a single consumer whose loop is interwoven with persist
+ * semantics. (The HTTP twin, http-retry.ts, diverged there deliberately: with
+ * three fetch clients needing a byte-identical loop it hosts the shared
+ * fetchWithRetry too — see its module doc.)
  */
 
 import { ConnectError, Code } from "@connectrpc/connect";

package/src/shared/http-retry.ts

@@ -1,14 +1,17 @@
 /**
- * HTTP error classification for side-channel proxy retries.
+ * HTTP error classification AND the shared bounded-backoff loop for
+ * side-channel proxy retries.
  *
  * The runner reaches stigmer-service's Side-Channel Proxy (`/v1/proxy/...`)
- * over plain `fetch` from several clients — the checkpoint saver today;
- * artifact storage, the LLM proxy, and the registry endpoint are candidates
- * (stigmer/stigmer#468). This module is the one place that answers "is this
- * HTTP failure worth retrying?", the `fetch` twin of grpc-retry.ts: it holds
- * the classification policy only, kept small and separately tested. The
- * bounded-backoff loop that consumes it lives with each client (the
- * grpc-retry/status.ts split).
+ * over plain `fetch` from several clients: the checkpoint saver, artifact
+ * storage, and the model-registry fetches (stigmer/stigmer#468). This module
+ * is the one place that answers "is this HTTP failure worth retrying?" — the
+ * `fetch` twin of grpc-retry.ts — and, since #468, also owns the
+ * {@link fetchWithRetry} loop those clients share. That is a deliberate
+ * divergence from grpc-retry.ts's policy-only split: the gRPC side has a
+ * single consumer whose loop is interwoven with persist-specific logic
+ * (status.ts), while the HTTP side grew three consumers needing a
+ * byte-identical loop — per-client copies were the drift risk, not the seam.
  *
  * The policy is grounded in what the proxy actually emits, not HTTP folklore.
  * CheckpointerProxyController returns exactly four deterministic errors —
@@ -17,7 +20,10 @@
  * reach the runner only as 5xx (Spring's error handler, ingress 502-504),
  * 408/429 (infrastructure between runner and service), or as network-level
  * fetch rejections. 401/403 stay terminal deliberately: retrying cannot fix
- * an expired or rejected credential.
+ * an expired or rejected credential. The same classification holds for the
+ * presigned R2 URLs artifact storage talks to: their deterministic failures
+ * (403 expired signature, 404 missing object) are 4xx, their transient ones
+ * are 5xx/network.
  */
 
 /**
@@ -48,3 +54,86 @@ export function isRetryableFetchError(err: unknown): boolean {
   if (err instanceof TypeError) return true;
   return err instanceof Error && err.name === "TimeoutError";
 }
+
+/**
+ * A fully-resolved retry policy for {@link fetchWithRetry}. Every field is
+ * required on purpose: defaults differ per client (the checkpointer and the
+ * presign endpoints run 30 s requests, artifact transfers 120 s, registry
+ * fetches 10 s), so each client resolves its own defaults once and this
+ * module never guesses.
+ */
+export interface FetchRetryPolicy {
+  /** Client name for retry logs, e.g. "HttpCheckpointSaver". */
+  readonly label: string;
+  /** Delay before the first retry (ms); doubles per attempt via the factor. */
+  readonly baseDelayMs: number;
+  readonly backoffFactor: number;
+  /** Retry attempts after the initial one. */
+  readonly maxRetries: number;
+  /**
+   * Milliseconds before an in-flight request is aborted and the attempt is
+   * classified retryable. Without it a hung connection (the realistic
+   * unplanned-pod-kill symptom) stalls forever and the retry never engages.
+   */
+  readonly requestTimeoutMs: number;
+  /** Injectable delay for tests; defaults to a real setTimeout sleep. */
+  readonly delayFn?: (ms: number) => Promise<void>;
+}
+
+function defaultDelay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * `fetch` with bounded exponential backoff on transient failures and a
+ * per-request abort timeout.
+ *
+ * Composition contract: on a non-retryable status — or when the budget is
+ * exhausted on a retryable one — the last `Response` is RETURNED, so every
+ * call site keeps its own `resp.ok` / 404 handling unchanged; this wrapper
+ * changes when a response arrives, never what call sites do with it. It
+ * throws only what `fetch` itself throws: a network-level rejection that is
+ * non-retryable or has exhausted the budget.
+ */
+export async function fetchWithRetry(
+  url: string,
+  init: RequestInit | undefined,
+  policy: FetchRetryPolicy,
+): Promise<Response> {
+  const delay = policy.delayFn ?? defaultDelay;
+  for (let attempt = 0; ; attempt++) {
+    const canRetry = attempt < policy.maxRetries;
+    let resp: Response;
+    try {
+      resp = await fetch(url, {
+        ...init,
+        signal: AbortSignal.timeout(policy.requestTimeoutMs),
+      });
+    } catch (err) {
+      if (canRetry && isRetryableFetchError(err)) {
+        await backOff(policy, delay, attempt, String(err));
+        continue;
+      }
+      throw err;
+    }
+    if (canRetry && isRetryableHttpStatus(resp.status)) {
+      await backOff(policy, delay, attempt, `HTTP ${resp.status} ${resp.statusText}`);
+      continue;
+    }
+    return resp;
+  }
+}
+
+async function backOff(
+  policy: FetchRetryPolicy,
+  delay: (ms: number) => Promise<void>,
+  attempt: number,
+  reason: string,
+): Promise<void> {
+  const delayMs = policy.baseDelayMs * Math.pow(policy.backoffFactor, attempt);
+  console.warn(
+    `[${policy.label}] retryable failure ` +
+    `(attempt ${attempt + 1}/${policy.maxRetries + 1}, retry in ${delayMs}ms): ${reason}`,
+  );
+  await delay(delayMs);
+}

package/src/shared/mcp-manager.ts

@@ -4,6 +4,10 @@
  * Wraps @langchain/mcp-adapters MultiServerMCPClient with:
  * - Conversion from ResolvedMcpServer[] to the SDK's Connection config
  * - Proper async cleanup via close()
+ * - Input-schema sanitization of unicode-invalid regex patterns
+ *   (issue #420; semantics in shared/mcp-schema-sanitizer.ts) — a vendor
+ *   pattern that cannot compile under the /u flag must not leave its tool
+ *   permanently uncallable
  * - Tool filtering by each server's effective enabled_tools allow-list
  *   (issue #350; semantics in shared/mcp-enabled-tools.ts) — the model only
  *   ever sees the tools the agent's manifest enables
@@ -18,10 +22,10 @@
  * (HOME, LOGNAME, PATH, SHELL, TERM, USER — getDefaultEnvironment in
  * @modelcontextprotocol/sdk, merged under whatever we pass). The
  * runner's own process env is never passed: it carries runner-internal
- * credentials (STIGMER_TOKEN, STIGMER_RUNNER_HITL_SECRET,
- * CURSOR_API_KEY, LLM provider keys) that no third-party MCP subprocess
- * may see. A declared-empty env and an undeclared env are deliberately
- * equivalent — both yield the SDK base environment.
+ * credentials (enumerated in runner-credential-keys.ts) that no
+ * third-party MCP subprocess may see. A declared-empty env and an
+ * undeclared env are deliberately equivalent — both yield the SDK base
+ * environment.
  *
  * The Cursor execution path does NOT use this manager — it passes MCP
  * configs directly to the Cursor SDK via toCursorMcpConfig(). This
@@ -35,6 +39,7 @@ import type { Connection } from "@langchain/mcp-adapters";
 import type { DynamicStructuredTool } from "@langchain/core/tools";
 import type { ResolvedMcpServer } from "./mcp-resolver.js";
 import { filterToolsByEnabledTools } from "./mcp-enabled-tools.js";
+import { sanitizeSchemaPatterns } from "./mcp-schema-sanitizer.js";
 
 /**
  * Convert harness-agnostic ResolvedMcpServer[] into the
@@ -100,6 +105,32 @@ export async function connectMcpServers(
   const client = new MultiServerMCPClient(connectionConfig);
   const discoveredToolMap = await client.initializeConnections();
 
+  // Drop unicode-invalid regex patterns from every discovered tool's input
+  // schema BEFORE anything downstream holds a reference (issue #420):
+  // @langchain/core re-validates against tool.schema on every invocation,
+  // so one vendor pattern that cannot compile under the /u flag would
+  // otherwise make its tool permanently uncallable. Semantics and the
+  // loosen-never-tighten invariant live in shared/mcp-schema-sanitizer.ts.
+  for (const [slug, discovered] of Object.entries(discoveredToolMap)) {
+    for (const tool of discovered) {
+      const droppedPatterns = sanitizeSchemaPatterns(tool.schema);
+      if (droppedPatterns.length > 0) {
+        console.warn(
+          `[MCP] Server '${slug}' tool '${tool.name}': dropped ` +
+          `${droppedPatterns.length} regex pattern(s) that cannot compile ` +
+          `under the unicode flag — the tool stays callable, the server ` +
+          `still validates its own inputs (issue #420): ` +
+          droppedPatterns
+            .map((d) =>
+              `${d.location} ${JSON.stringify(d.pattern)}` +
+              (d.compilesWithoutUnicodeFlag ? "" : " (invalid without /u too)"),
+            )
+            .join(", "),
+        );
+      }
+    }
+  }
+
   // Enforce each server's effective enabled_tools allow-list (issue #350)
   // HERE, before anything downstream sees the tools: the parent tool list,
   // the approval gate's toolServerMap, and the sub-agent McpAccess filter