@stigmer/runner 3.11.0 → 3.12.0

package/src/activities/execute-cursor/turn-recovery.ts

@@ -0,0 +1,208 @@
+/**
+ * Turn-recovery digest: the platform's recorded transcript of the current
+ * turn, rendered as prompt context for a fresh agent that replaced one whose
+ * conversation state was lost mid-turn (issue #366).
+ *
+ * A HITL-paused turn can lose its agent two ways — the stored handle fails
+ * to resume when the approval lands, or the resumed handle turns out to be
+ * poisoned mid-send. Either way the replacement agent starts with an EMPTY
+ * conversation, so the approval decisions alone read as instructions with no
+ * story: the agent no longer knows what it was doing. This module rebuilds
+ * that story from `status.messages` — the persisted execution transcript
+ * seeded on every re-invocation — which is the platform's durable record of
+ * the turn AND exactly what the user watched happen (introspecting the dead
+ * agent's own conversation is best-effort at most; the handle is the thing
+ * that failed).
+ *
+ * Doctrine (mirrors `ChannelRolloverBridgeComposer`, cloud DD-013 — the
+ * platform's reference for conversation digests):
+ * - Content here, presentation framing separate: {@link composeTurnRecoveryDigest}
+ *   emits bare `Assistant:` / `Tool:` / `System:` lines;
+ *   {@link formatTurnRecoveryText} adds the behavioral preamble; the prompt
+ *   builder wraps the section tag (the context-bridge / conversation-catchup
+ *   split).
+ * - Oldest-first reading order; over budget, the OLDEST lines drop first
+ *   (recency wins) and the drop is disclosed.
+ * - Best-effort by contract: composition never throws — a failed digest
+ *   degrades to recovery-without-transcript, never a failed recovery.
+ *
+ * Scope: the CURRENT turn only. Prior turns live in other execution records
+ * and are not recoverable runner-side (that is the rollover bridge's domain,
+ * composed cloud-side); the enhanced prompt's standing-context sections carry
+ * whatever the session already had.
+ */
+
+import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/** Per-line text budget; longer texts are cut with an ellipsis (DD-013 twin). */
+const MAX_LINE_CHARS = 400;
+
+/**
+ * Args-preview budget inside a tool line — the `describeApproval` precedent
+ * (prompt-builder.ts), so tool renderings are bounded the same way on both
+ * surfaces that describe them.
+ */
+const MAX_ARGS_CHARS = 200;
+
+/**
+ * Whole-digest budget (DD-013 twin). Enforced by dropping the OLDEST lines
+ * first — recency wins, matching how a human skims their own recent work
+ * before continuing it.
+ */
+const MAX_DIGEST_CHARS = 4000;
+
+const ELLIPSIS = "\u2026";
+
+/** Disclosed in place of the dropped prefix so the record never lies by omission. */
+const OMISSION_NOTICE = `[${ELLIPSIS} earlier activity in this turn omitted for length]`;
+
+/**
+ * How the transcript is introduced to the model. Establishes the three facts
+ * the replacement agent must hold: the work below is its OWN (continue, don't
+ * restart), completed actions are DONE (don't redo them), and the workspace —
+ * not this summary — is the source of truth for exact current state.
+ */
+const TURN_RECOVERY_PREAMBLE =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it. " +
+  "Below is the platform's recorded transcript of your progress in this " +
+  "turn, oldest first. Treat it as work YOU already did: do not start the " +
+  "task over, do not redo actions shown as completed, and check the " +
+  "workspace's current state where exact details matter.";
+
+/**
+ * Fallback framing when the turn produced no renderable transcript (or
+ * composition failed): the state-loss disclosure still matters — without it,
+ * the appended approval decisions read as reactions to proposals this agent
+ * never made.
+ */
+const TURN_RECOVERY_NO_TRANSCRIPT =
+  "You had already started working on the user's request above, but the " +
+  "session holding that conversation was lost, so you do not remember it " +
+  "and no transcript of your progress is available. Check the workspace's " +
+  "current state to see what you already did before continuing.";
+
+/**
+ * Render the turn's persisted transcript as bare digest lines, or undefined
+ * when there is nothing worth carrying. Never throws.
+ *
+ * Human messages are skipped — the turn's user message is already rendered
+ * in the enhanced prompt's `<user_request>`, and duplicating it here would
+ * dilute the budget. Thinking content is skipped as model-internal (the
+ * replacement agent forms its own). System notices are kept: platform
+ * messages like budget warnings or degradation notices are turn context the
+ * agent acted under.
+ */
+export function composeTurnRecoveryDigest(
+  messages: readonly AgentMessage[],
+): string | undefined {
+  try {
+    const lines: string[] = [];
+    for (const message of messages) {
+      lines.push(...messageLines(message));
+    }
+    if (lines.length === 0) return undefined;
+
+    // Oldest-first; drop from the FRONT when over budget so the newest work
+    // always survives, and disclose the drop (DD-013 enforcement shape). The
+    // notice participates in the budget so the result never overshoots.
+    let first = 0;
+    while (first < lines.length && totalLength(lines, first) > MAX_DIGEST_CHARS) {
+      first++;
+    }
+    if (first >= lines.length) {
+      // Degenerate case: even the newest line alone busts the budget (it is
+      // already line-truncated, so this would take a pathological budget/line
+      // ratio) — keep that one line rather than rendering nothing.
+      first = lines.length - 1;
+    }
+    const kept = lines.slice(first);
+    if (first > 0) kept.unshift(OMISSION_NOTICE);
+    return kept.join("\n");
+  } catch (err) {
+    console.warn("Turn-recovery digest composition failed — recovering without a transcript:", err);
+    return undefined;
+  }
+}
+
+/**
+ * The framed recovery body (preamble + digest), ready for section wrapping.
+ * Accepts an absent digest: the state-loss disclosure is load-bearing even
+ * when there is no transcript to show (see {@link TURN_RECOVERY_NO_TRANSCRIPT}).
+ */
+export function formatTurnRecoveryText(digest: string | undefined): string {
+  if (digest === undefined || digest.trim() === "") {
+    return TURN_RECOVERY_NO_TRANSCRIPT;
+  }
+  return `${TURN_RECOVERY_PREAMBLE}\n\n${digest.trim()}`;
+}
+
+/** The digest lines one transcript message contributes (possibly none). */
+function messageLines(message: AgentMessage): string[] {
+  const lines: string[] = [];
+  const text = message.content.trim();
+  switch (message.type) {
+    case MessageType.MESSAGE_AI:
+      if (text) lines.push(`Assistant: ${truncate(text, MAX_LINE_CHARS)}`);
+      // Tool calls ride AI messages (message.proto contract); render them
+      // even when the surrounding text is blank.
+      for (const toolCall of message.toolCalls) {
+        lines.push(toolCallLine(toolCall));
+      }
+      return lines;
+    case MessageType.MESSAGE_SYSTEM:
+      if (text) lines.push(`System: ${truncate(text, MAX_LINE_CHARS)}`);
+      return lines;
+    default:
+      // Human (already in <user_request>), thinking (model-internal), tool
+      // results (each ToolCall line already carries its outcome), unknown.
+      return lines;
+  }
+}
+
+/**
+ * One bounded line per tool call: what was attempted and how it ended.
+ * Prefers the resolved approval message where one exists — the same
+ * human-meaningful description the user approved against
+ * (the `describeApproval` convention).
+ */
+function toolCallLine(toolCall: ToolCall): string {
+  const action = toolCall.approvalMessage
+    ? toolCall.approvalMessage
+    : toolCall.argsPreview
+      ? `${toolCall.name}(${truncate(toolCall.argsPreview, MAX_ARGS_CHARS)})`
+      : toolCall.name;
+  return `Tool: ${truncate(action, MAX_LINE_CHARS)} — ${outcome(toolCall)}`;
+}
+
+function outcome(toolCall: ToolCall): string {
+  switch (toolCall.status) {
+    case ToolCallStatus.TOOL_CALL_COMPLETED:
+      return "completed";
+    case ToolCallStatus.TOOL_CALL_FAILED:
+      return toolCall.error
+        ? `failed: ${truncate(toolCall.error, MAX_ARGS_CHARS)}`
+        : "failed";
+    case ToolCallStatus.TOOL_CALL_WAITING_APPROVAL:
+      return "paused for user approval";
+    case ToolCallStatus.TOOL_CALL_SKIPPED:
+      return "skipped";
+    default:
+      // PENDING / RUNNING / unknown: in flight when the session was lost.
+      return "interrupted before it finished";
+  }
+}
+
+function truncate(text: string, max: number): string {
+  return text.length <= max ? text : `${text.slice(0, max)}${ELLIPSIS}`;
+}
+
+/** Joined length of lines[first..] plus the omission notice when one would render. */
+function totalLength(lines: readonly string[], first: number): number {
+  let total = first > 0 ? OMISSION_NOTICE.length + 1 : 0;
+  for (let i = first; i < lines.length; i++) {
+    total += lines[i].length + 1;
+  }
+  return total;
+}

package/src/activities/execute-deep-agent/__tests__/attachment-injector.test.ts

@@ -1014,3 +1014,108 @@ describe("injectAttachments — vision selection", () => {
     expect(injected[1].visionDegraded).toBe("budget_exhausted");
   });
 });
+
+// ═══════════════════════════════════════════════════════════════════════
+// injectAttachments — download-URL hand-off (issue #532)
+// ═══════════════════════════════════════════════════════════════════════
+// The URL is strictly additive (shared/attachment-download-urls.ts): every
+// case also asserts the file injected exactly as it would without one.
+
+describe("injectAttachments — download-URL hand-off", () => {
+  it("mints a URL for a storage-key attachment", async () => {
+    const content = Buffer.from("cloud data");
+    const storage = makeMockStorage();
+    await storage.upload("attachments/xyz/data.csv", content);
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [makeAttachment({ filename: "data.csv", storageKey: "attachments/xyz/data.csv" })],
+      storage,
+      isLocalMode: false,
+    });
+
+    expect(result[0]).toMatchObject({
+      path: ".stigmer/inputs/data.csv",
+      downloadUrl: "mem://attachments/xyz/data.csv",
+    });
+  });
+
+  it("mints a URL for an explicit-mountPath attachment (the rule ignores mount location)", async () => {
+    const storage = makeMockStorage();
+    await storage.upload("attachments/xyz/config.yaml", Buffer.from("a: 1"));
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [makeAttachment({
+        filename: "config.yaml",
+        storageKey: "attachments/xyz/config.yaml",
+        mountPath: "config/app.yaml",
+      })],
+      storage,
+      isLocalMode: false,
+    });
+
+    expect(result[0]).toMatchObject({
+      path: "config/app.yaml",
+      downloadUrl: "mem://attachments/xyz/config.yaml",
+    });
+  });
+
+  it("carries no URL on extracted ZIP entries — the stored object is the ZIP, not any listed file", async () => {
+    const zip = makeZip({ "src/a.txt": "alpha", "src/b.txt": "beta" });
+    const storage = makeMockStorage();
+    await storage.upload("attachments/xyz/code.zip", zip);
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [makeAttachment({
+        filename: "code.zip",
+        storageKey: "attachments/xyz/code.zip",
+        extract: true,
+      })],
+      storage,
+      isLocalMode: false,
+    });
+
+    expect(result.length).toBeGreaterThan(0);
+    for (const file of result) {
+      expect(file.downloadUrl).toBeUndefined();
+    }
+  });
+
+  it("carries no URL for a key-less local file", async () => {
+    const localFile = join(tmpdir(), `injector-url-${Date.now()}.txt`);
+    await writeFile(localFile, "local only");
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [makeAttachment({ filename: "local.txt", storageKey: "", localPath: localFile })],
+      storage: makeMockStorage(),
+      isLocalMode: true,
+    });
+
+    expect(result[0].downloadUrl).toBeUndefined();
+  });
+
+  it("degrades to no URL when the mint fails — file still injected, no throw", async () => {
+    const content = Buffer.from("cloud data");
+    const storage = makeMockStorage();
+    await storage.upload("attachments/xyz/data.csv", content);
+    storage.getDownloadUrl.mockRejectedValueOnce(new Error("presign endpoint unreachable"));
+    const backend = mockWorkspaceBackend();
+
+    const result = await injectAttachments({
+      backend,
+      attachments: [makeAttachment({ filename: "data.csv", storageKey: "attachments/xyz/data.csv" })],
+      storage,
+      isLocalMode: false,
+    });
+
+    expect(result[0].downloadUrl).toBeUndefined();
+    expect(backend.writeFileBuffer).toHaveBeenCalledWith(".stigmer/inputs/data.csv", content);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -184,7 +184,6 @@ function fakeHttpRejectSetup(): SetupResult {
     session: { spec: { workspaceEntries: [] } },
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-http" },
     mcpConnection: null,
-    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",
@@ -220,7 +219,6 @@ function fakeMemoryRejectSetup(): SetupResult {
     session: { spec: { workspaceEntries: [] } },
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-mem" },
     mcpConnection: null,
-    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -264,7 +264,6 @@ function fakeDurableResumeSetup(): SetupResult {
     // path shared across files would serialize parallel test workers for real.
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-approve-all" },
     mcpConnection: null,
-    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -219,7 +219,6 @@ function fakeDurableResumeSetup(): SetupResult {
     // path shared across files would serialize parallel test workers for real.
     workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-hitl-history" },
     mcpConnection: null,
-    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",

package/src/activities/execute-deep-agent/__tests__/mcp-gate.test.ts

@@ -12,7 +12,6 @@ import { shouldConnectMcp } from "../mcp-gate.js";
 
 const nothing = {
   mcpServerUsageCount: 0,
-  datastoreUsageCount: 0,
   channelMessagingCount: 0,
   conversationChannelId: undefined,
 };
@@ -26,17 +25,13 @@ describe("shouldConnectMcp", () => {
     expect(shouldConnectMcp({ ...nothing, mcpServerUsageCount: 1 })).toBe(true);
   });
 
-  it("enters on datastore usages alone (the records attachment)", () => {
-    expect(shouldConnectMcp({ ...nothing, datastoreUsageCount: 1 })).toBe(true);
-  });
-
   it("enters on a serving proactive channel alone (the channels attachment)", () => {
     expect(shouldConnectMcp({ ...nothing, channelMessagingCount: 1 })).toBe(true);
   });
 
   it("enters on a channel conversation alone (the conversation attachment)", () => {
-    // The reply-only pilot shape: no declared servers, no datastores,
-    // no proactive channel — the escalation tool is the ONLY source.
+    // The reply-only pilot shape: no declared servers, no proactive
+    // channel — the escalation tool is the ONLY source.
     expect(shouldConnectMcp({ ...nothing, conversationChannelId: "agch_1" })).toBe(true);
   });
 });

package/src/activities/execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts

@@ -0,0 +1,174 @@
+/**
+ * End-to-end proof (real deepagents + LangGraph runtime, no LLM/network) that
+ * a plan-mode PARENT graph accepts workspace-relative paths (issue #429).
+ *
+ * Before the fix, deepagents' permission enforcement canonicalized every
+ * filesystem tool-call path BEFORE any rule ran and refused non-absolute
+ * shapes, so on a rule-bearing graph a workspace-relative call — reads
+ * included — died with `path must be absolute` instead of just working. The
+ * path-normalization middleware (middleware/path-normalization.ts) rewrites
+ * relative paths to workspace-absolute at our seam, before enforcement sees
+ * them.
+ *
+ * The graph here is composed exactly the way setup.ts composes the parent:
+ * the PRODUCTION buildMiddlewareStack (pathNormalization present, the
+ * rule-bearing shape) + the CAS capture backend + the PRODUCTION
+ * PLAN_MODE_PERMISSIONS constant. These tests are also the empirical proof
+ * that langchain's wrapToolCall seam delivers rewritten args to the tool —
+ * if it did not, the relative read below could never succeed.
+ *
+ * The sub-agent twin of this contract is pinned in
+ * subagent-plan-mode-permissions.test.ts (issue #255 wiring).
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, mkdir, rm, readFile, writeFile, access } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { HumanMessage, ToolMessage, type BaseMessage } from "@langchain/core/messages";
+import { MemorySaver } from "@langchain/langgraph";
+import { createDeepAgent } from "deepagents";
+
+import { PLAN_MODE_PERMISSIONS } from "../../../shared/plan-mode-permissions.js";
+import { buildMiddlewareStack } from "../../../middleware/index.js";
+import { createCasCaptureBackend } from "../cas-capture-backend.js";
+import { CasCaptureObserver } from "../cas-capture-observer.js";
+import { ScriptedModel, type ScriptSelector } from "../__test-utils__/scripted-model.js";
+
+const SEEDED_CONTENT = "PLAN_MODE_README_TOKEN: hello from the seeded file";
+
+describe("plan-mode parent path normalization (issue #429)", () => {
+  let root: string;
+  let observer: CasCaptureObserver;
+
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), "plan-path-"));
+    await mkdir(join(root, "src"), { recursive: true });
+    await writeFile(join(root, "src/notes.md"), SEEDED_CONTENT);
+    observer = new CasCaptureObserver({ rootDir: root, isIgnored: async () => true });
+  });
+
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  /**
+   * Build a parent graph the way setup.ts does in plan mode: the production
+   * middleware stack with pathNormalization set (derived, like the graph's
+   * permissions, from the plan-mode rules), a filesystem-only CAS capture
+   * backend (no shellEnv — plan mode clears it), and PLAN_MODE_PERMISSIONS
+   * on the graph.
+   */
+  async function buildPlanModeParent(script: ScriptSelector) {
+    const { middleware } = buildMiddlewareStack({
+      approvalGate: null,
+      pathNormalization: { rootDir: root },
+    });
+    const backend = await createCasCaptureBackend({ rootDir: root, observer });
+    return createDeepAgent({
+      model: new ScriptedModel(script),
+      checkpointer: new MemorySaver() as never,
+      backend,
+      middleware: middleware as never[],
+      permissions: PLAN_MODE_PERMISSIONS,
+    } as Parameters<typeof createDeepAgent>[0]);
+  }
+
+  function toolResultById(messages: BaseMessage[], toolCallId: string): string {
+    const match = messages.find(
+      (m): m is ToolMessage => m instanceof ToolMessage && m.tool_call_id === toolCallId,
+    );
+    expect(match, `expected a tool result for call '${toolCallId}'`).toBeDefined();
+    return typeof match!.content === "string" ? match!.content : JSON.stringify(match!.content);
+  }
+
+  async function invokeOnce(script: ScriptSelector, threadId: string) {
+    const agent = await buildPlanModeParent(script);
+    return (await agent.invoke(
+      { messages: [new HumanMessage({ content: "go" })] },
+      { configurable: { thread_id: threadId }, recursionLimit: 50 },
+    )) as { messages: BaseMessage[] };
+  }
+
+  it("a prompt-compliant relative read succeeds on the first tool round", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: "src/notes.md" }, id: "c_read_rel" },
+        ],
+        done: "done",
+      }),
+      "t_read_rel",
+    );
+
+    const readResult = toolResultById(result.messages, "c_read_rel");
+    expect(readResult).toContain("PLAN_MODE_README_TOKEN");
+    expect(readResult).not.toMatch(/path must be absolute/i);
+    expect(readResult).not.toMatch(/permission denied/i);
+  });
+
+  it("a relative write is refused by the RULES — permission denied, not a path-shape error", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "write_file", args: { file_path: "src/out.txt", content: "x" }, id: "c_write_rel" },
+        ],
+        done: "done",
+      }),
+      "t_write_rel",
+    );
+
+    // The deny-all-writes rule fires on the normalized path — the honest
+    // plan-mode refusal the model can reason about, instead of the
+    // pre-fix validation error that taught it to abandon relative paths.
+    expect(toolResultById(result.messages, "c_write_rel")).toMatch(/permission denied for write/i);
+    expect(toolResultById(result.messages, "c_write_rel")).not.toMatch(/path must be absolute/i);
+    await expect(access(join(root, "src/out.txt"))).rejects.toThrow();
+    expect(observer.before.size).toBe(0);
+  });
+
+  it("an escaping relative read is still refused — normalization grants no new reachability", async () => {
+    // Outside the root, reachable only if `..` were naively joined away.
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: "../escape.txt" }, id: "c_read_escape" },
+        ],
+        done: "done",
+      }),
+      "t_read_escape",
+    );
+
+    // Left raw by the middleware, refused by upstream validation exactly as
+    // before the fix.
+    expect(toolResultById(result.messages, "c_read_escape")).toMatch(/must not contain|path must be absolute/i);
+  });
+
+  it("absolute in-workspace paths keep working unchanged", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [
+          { name: "read_file", args: { file_path: join(root, "src/notes.md") }, id: "c_read_abs" },
+        ],
+        done: "done",
+      }),
+      "t_read_abs",
+    );
+
+    expect(toolResultById(result.messages, "c_read_abs")).toContain("PLAN_MODE_README_TOKEN");
+  });
+
+  it("relative ls flows through normalization to list the workspace directory", async () => {
+    const result = await invokeOnce(
+      () => ({
+        toolCalls: [{ name: "ls", args: { path: "src" }, id: "c_ls_rel" }],
+        done: "done",
+      }),
+      "t_ls_rel",
+    );
+
+    const lsResult = toolResultById(result.messages, "c_ls_rel");
+    expect(lsResult).toContain("notes.md");
+    expect(lsResult).not.toMatch(/path must be absolute/i);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -190,6 +190,77 @@ describe("buildEnhancedSystemPrompt", () => {
     expect(prompt).toContain("`.stigmer/inputs/report.pdf` (10 bytes)\n");
   });
 
+  it("lists a minted download URL beside its file with the presigned hand-off line (issue #532)", () => {
+    const prompt = buildEnhancedSystemPrompt({
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [
+        {
+          filename: "lease.pdf",
+          path: ".stigmer/inputs/lease.pdf",
+          sizeBytes: 2048,
+          downloadUrl: "https://r2.example/lease?sig=abc",
+        },
+        { filename: "notes.md", path: ".stigmer/inputs/notes.md", sizeBytes: 12 },
+      ],
+      downloadUrlKind: "presigned",
+    });
+
+    expect(prompt).toContain(
+      "`.stigmer/inputs/lease.pdf` (2048 bytes) — download URL: https://r2.example/lease?sig=abc",
+    );
+    // The URL-less file keeps a clean entry.
+    expect(prompt).toContain("`.stigmer/inputs/notes.md` (12 bytes)\n");
+    expect(prompt).toContain("These URLs are time-limited");
+  });
+
+  it("words a local-serve URL honestly — reachable only from this machine", () => {
+    const prompt = buildEnhancedSystemPrompt({
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [
+        {
+          filename: "lease.pdf",
+          path: ".stigmer/inputs/lease.pdf",
+          sizeBytes: 2048,
+          downloadUrl: "http://localhost:7235/attachments/01A/lease.pdf",
+        },
+      ],
+      downloadUrlKind: "local-serve",
+    });
+
+    expect(prompt).toContain("download URL: http://localhost:7235/attachments/01A/lease.pdf");
+    expect(prompt).toContain("reachable only from this machine");
+    expect(prompt).not.toContain("time-limited");
+  });
+
+  it("renders no hand-off line when no listed file carries a URL (kind alone is not enough)", () => {
+    const prompt = buildEnhancedSystemPrompt({
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "/workspace",
+      injectedFiles: [
+        { filename: "local.csv", path: ".stigmer/inputs/local.csv", sizeBytes: 5 },
+      ],
+      downloadUrlKind: "presigned",
+    });
+
+    expect(prompt).toContain("## Input Files");
+    expect(prompt).not.toContain("download URL");
+    expect(prompt).not.toContain("time-limited");
+  });
+
   it("produces a git repo description for git workspace entries", () => {
     const prompt = buildEnhancedSystemPrompt({
       instructions: "Test",

package/src/activities/execute-deep-agent/__tests__/sequential-gate-resume.test.ts

@@ -196,7 +196,6 @@ function fakeMemoryGateSetup(opts: {
       readFile: vi.fn(async () => ""),
     },
     mcpConnection: null,
-    datastoreToolsMissing: [],
     mergedEnvVars: {},
     secretKeys: new Set<string>(),
     modelName: "claude-sonnet",