@stigmer/runner 3.11.1-dev.20260812192248 → 3.12.1

package/src/shared/zip-extract.ts

@@ -1,10 +1,24 @@
 /**
- * Minimal, dependency-free ZIP archive parser.
+ * Skill-artifact ZIP extraction: text-decoded entries with non-fatal
+ * structural failure.
  *
- * Handles the local file header format, supporting stored (method 0) and
- * deflated (method 8) entries. Returns parsed entries as path + content
- * pairs — consumers bring their own write mechanism (WorkspaceBackend,
- * node:fs, etc.).
+ * Structural parsing lives in zip-structure.ts (central-directory-based —
+ * see that module's doc for why local-header walks are never acceptable,
+ * issue #450). This module owns the skill-artifact *policy* on top of it:
+ *
+ * Input without a readable central directory is not given a second
+ * chance on purpose: every artifact reaching the runner was validated at
+ * push by a central-directory-based reader on both editions (OSS:
+ * `safearchive/zip` in stigmer-server's skill storage; cloud:
+ * commons-compress `ZipFile` in SkillArtifactExtractor), so a missing
+ * EOCD here can only mean a truncated or corrupted download — and the
+ * honest result for that is the documented empty return, not a guess.
+ * (The attachment injector consumes the same structural layer under the
+ * opposite policy — fail-hard — because its input is untrusted.)
+ *
+ * Handles stored (method 0) and deflated (method 8) entries. Returns
+ * parsed entries as path + content pairs — consumers bring their own
+ * write mechanism (WorkspaceBackend, node:fs, etc.).
  *
  * Extracted from skill-writer.ts so both the deep-agent and Cursor
  * harnesses can share the same ZIP parsing logic without coupling to
@@ -12,6 +26,7 @@
  */
 
 import { createInflateRaw } from "node:zlib";
+import { EOCD_MIN_SIZE, parseZipStructure, type ZipStructuralEntry } from "./zip-structure.js";
 
 // ─── Public API ──────────────────────────────────────────────────────────
 
@@ -29,18 +44,26 @@ export interface ZipFileEntry {
  * entries whose filename (basename or full path) matches any excluded name.
  *
  * Returns an empty array for empty, truncated, or non-ZIP input rather
- * than throwing — callers treat missing artifacts as non-fatal.
+ * than throwing — callers treat missing artifacts as non-fatal. Errors
+ * while *decompressing* a structurally valid entry (corrupt deflate
+ * stream, unsupported compression method) do propagate: at that point
+ * the archive's structure vouched for the entry, and silently dropping
+ * it would be the exact corruption this module exists to prevent.
  */
 export async function extractZipFileEntries(
   zipBytes: Uint8Array,
   options?: { exclude?: readonly string[] },
 ): Promise<ZipFileEntry[]> {
-  if (zipBytes.length < 4) return [];
+  if (zipBytes.length < EOCD_MIN_SIZE) return [];
 
-  let entries: ZipEntry[];
+  let entries: ZipStructuralEntry[];
   try {
-    entries = parseZipEntries(zipBytes);
-  } catch {
+    entries = parseZipStructure(zipBytes);
+  } catch (err) {
+    console.warn(
+      "[zip-extract] archive has no readable central directory " +
+      `(truncated or corrupt download?): ${err instanceof Error ? err.message : String(err)}`,
+    );
     return [];
   }
 
@@ -58,16 +81,6 @@ export async function extractZipFileEntries(
   return results;
 }
 
-// ─── Internals ───────────────────────────────────────────────────────────
-
-interface ZipEntry {
-  name: string;
-  isDirectory: boolean;
-  compressedData: Uint8Array;
-  compressionMethod: number;
-  uncompressedSize: number;
-}
-
 function isExcluded(name: string, excludeSet: ReadonlySet<string>): boolean {
   if (excludeSet.size === 0) return false;
   if (excludeSet.has(name)) return true;
@@ -76,104 +89,9 @@ function isExcluded(name: string, excludeSet: ReadonlySet<string>): boolean {
   return excludeSet.has(basename);
 }
 
-function parseZipEntries(data: Uint8Array): ZipEntry[] {
-  const entries: ZipEntry[] = [];
-  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
-  let offset = 0;
-
-  while (offset < data.length - 4) {
-    const signature = view.getUint32(offset, true);
-    if (signature !== 0x04034b50) break; // Local file header signature
-
-    const generalFlags = view.getUint16(offset + 6, true);
-    const hasDataDescriptor = (generalFlags & 0x08) !== 0;
-    const compressionMethod = view.getUint16(offset + 8, true);
-    let compressedSize = view.getUint32(offset + 18, true);
-    let uncompressedSize = view.getUint32(offset + 22, true);
-    const fileNameLength = view.getUint16(offset + 26, true);
-    const extraFieldLength = view.getUint16(offset + 28, true);
-
-    const fileNameStart = offset + 30;
-    const fileName = new TextDecoder().decode(
-      data.subarray(fileNameStart, fileNameStart + fileNameLength),
-    );
-
-    const dataStart = fileNameStart + fileNameLength + extraFieldLength;
-
-    if (hasDataDescriptor && compressedSize === 0) {
-      const sizes = findDataDescriptor(data, view, dataStart, compressionMethod);
-      compressedSize = sizes.compressedSize;
-      uncompressedSize = sizes.uncompressedSize;
-    }
-
-    const compressedData = data.subarray(dataStart, dataStart + compressedSize);
-
-    entries.push({
-      name: fileName,
-      isDirectory: fileName.endsWith("/"),
-      compressedData,
-      compressionMethod,
-      uncompressedSize,
-    });
-
-    let nextOffset = dataStart + compressedSize;
-    if (hasDataDescriptor) {
-      if (nextOffset + 4 <= data.length && view.getUint32(nextOffset, true) === 0x08074b50) {
-        nextOffset += 16; // signature(4) + crc(4) + compressedSize(4) + uncompressedSize(4)
-      } else {
-        nextOffset += 12; // crc(4) + compressedSize(4) + uncompressedSize(4)
-      }
-    }
-    offset = nextOffset;
-  }
-
-  return entries;
-}
-
-/**
- * Scan forward from dataStart to find the data descriptor that contains
- * the actual compressed and uncompressed sizes. Looks for either the
- * optional signature 0x08074b50 or falls back to scanning the central
- * directory for the matching entry.
- */
-function findDataDescriptor(
-  data: Uint8Array,
-  view: DataView,
-  dataStart: number,
-  _compressionMethod: number,
-): { compressedSize: number; uncompressedSize: number } {
-  for (let pos = dataStart; pos < data.length - 16; pos++) {
-    const sig = view.getUint32(pos, true);
-    if (sig === 0x08074b50) {
-      return {
-        compressedSize: view.getUint32(pos + 8, true),
-        uncompressedSize: view.getUint32(pos + 12, true),
-      };
-    }
-    if (sig === 0x04034b50 || sig === 0x02014b50) {
-      const descStart = pos - 12;
-      if (descStart >= dataStart) {
-        return {
-          compressedSize: view.getUint32(descStart + 4, true),
-          uncompressedSize: view.getUint32(descStart + 8, true),
-        };
-      }
-      break;
-    }
-  }
-  for (let pos = dataStart; pos < data.length - 4; pos++) {
-    const sig = view.getUint32(pos, true);
-    if (sig === 0x04034b50 || sig === 0x02014b50 || sig === 0x08074b50) {
-      const compressedSize = sig === 0x08074b50
-        ? view.getUint32(pos + 8, true)
-        : pos - dataStart;
-      return { compressedSize, uncompressedSize: 0 };
-    }
-  }
-  return { compressedSize: data.length - dataStart, uncompressedSize: 0 };
-}
+// ─── Decompression ───────────────────────────────────────────────────────
 
-async function decompressEntry(entry: ZipEntry): Promise<string> {
+async function decompressEntry(entry: ZipStructuralEntry): Promise<string> {
   if (entry.compressionMethod === 0) {
     return new TextDecoder().decode(entry.compressedData);
   }

package/src/shared/zip-structure.ts

@@ -0,0 +1,181 @@
+/**
+ * Policy-free structural ZIP parsing: end-of-central-directory (EOCD)
+ * location plus central-directory walk, producing one record per entry.
+ *
+ * Parsing is *central-directory-based* — never a front-to-back walk of
+ * local file headers. This is a correctness decision, not a style choice
+ * (issues #450 and #567): local headers of streaming entries
+ * (general-purpose flag bit 3) carry zeroed sizes, and the only
+ * local-only way to recover them is scanning the payload for the
+ * data-descriptor signature — which silently truncates any stored entry
+ * whose *content* happens to contain those four bytes, and
+ * desynchronizes every entry after it. The central directory always
+ * carries the real sizes, and every consumer here holds the complete
+ * archive bytes, so nothing a local-header walk could offer is needed.
+ *
+ * This layer maps bytes to entry records and nothing else. Policy — what
+ * a structural failure means, which entries are acceptable, how payloads
+ * are decoded — belongs to the consumers, and they differ on purpose:
+ *
+ *   - shared/zip-extract.ts (skill artifacts): structural failure is
+ *     NON-FATAL — both editions' push gates validated every artifact
+ *     with a central-directory-based reader before storage, so a defect
+ *     here can only be a truncated or corrupted download.
+ *   - execute-deep-agent/attachment-injector.ts (user attachments):
+ *     structural failure is FAIL-HARD — the input is an untrusted
+ *     upload and nothing upstream vouched for it.
+ *
+ * ZIP64 is deliberately unsupported: both consumers cap input far below
+ * every ZIP64 threshold (skill push gates: 100MB / 10,000 files;
+ * attachment uploads: 10MB).
+ *
+ * Throws plain `Error`s on structural defects (no valid EOCD, a central
+ * directory or local header record that does not parse, a payload slice
+ * that runs past the end of the buffer); consumers translate those into
+ * their own error models.
+ */
+
+// ─── Entry records ───────────────────────────────────────────────────────
+
+export interface ZipStructuralEntry {
+  /** Entry path exactly as recorded in the central directory. */
+  readonly name: string;
+  readonly isDirectory: boolean;
+  readonly compressionMethod: number;
+  /**
+   * The central directory's declared uncompressed size — authoritative for
+   * pre-extraction accounting (e.g. ZIP-bomb budgeting), but still a
+   * *declaration*: a consumer that distrusts its input must enforce it
+   * against the actual decompressed output.
+   */
+  readonly uncompressedSize: number;
+  /** The entry's raw payload slice (a view, not a copy) of the archive buffer. */
+  readonly compressedData: Uint8Array;
+}
+
+// ─── Format constants ────────────────────────────────────────────────────
+
+const LOCAL_FILE_HEADER_SIG = 0x04034b50;
+const CENTRAL_DIRECTORY_SIG = 0x02014b50;
+const EOCD_SIG = 0x06054b50;
+
+/** Fixed size of the EOCD record, excluding the variable-length comment. */
+export const EOCD_MIN_SIZE = 22;
+/** The archive comment length is a u16, so the EOCD sits within the last 64KB + 22 bytes. */
+const EOCD_MAX_COMMENT = 0xffff;
+
+const LOCAL_HEADER_SIZE = 30;
+const CD_RECORD_SIZE = 46;
+
+// ─── Parsing ─────────────────────────────────────────────────────────────
+
+/**
+ * Enumerate the archive's entries from its central directory.
+ *
+ * Throws on any structural defect: no valid EOCD, a central directory or
+ * local header record that doesn't parse, or a payload slice that runs
+ * past the end of the buffer.
+ */
+export function parseZipStructure(data: Uint8Array): ZipStructuralEntry[] {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const eocd = findEndOfCentralDirectory(data, view);
+
+  const entries: ZipStructuralEntry[] = [];
+  let offset = eocd.centralDirectoryOffset;
+
+  for (let i = 0; i < eocd.entryCount; i++) {
+    if (offset + CD_RECORD_SIZE > data.length || view.getUint32(offset, true) !== CENTRAL_DIRECTORY_SIG) {
+      throw new Error(`invalid central directory record at offset ${offset}`);
+    }
+
+    const compressionMethod = view.getUint16(offset + 10, true);
+    const compressedSize = view.getUint32(offset + 20, true);
+    const uncompressedSize = view.getUint32(offset + 24, true);
+    const fileNameLength = view.getUint16(offset + 28, true);
+    const extraFieldLength = view.getUint16(offset + 30, true);
+    const commentLength = view.getUint16(offset + 32, true);
+    const localHeaderOffset = view.getUint32(offset + 42, true);
+
+    const fileName = new TextDecoder().decode(
+      data.subarray(offset + CD_RECORD_SIZE, offset + CD_RECORD_SIZE + fileNameLength),
+    );
+
+    // The local header is consulted for one thing only: the payload start.
+    // Its name/extra field lengths can legitimately differ from the central
+    // directory's (streaming writers pad the extra field), so the offset
+    // cannot be derived from CD fields alone.
+    const dataStart = payloadStart(data, view, localHeaderOffset, fileName);
+    if (dataStart + compressedSize > data.length) {
+      throw new Error(`entry "${fileName}" payload runs past end of archive`);
+    }
+
+    entries.push({
+      name: fileName,
+      isDirectory: fileName.endsWith("/"),
+      compressionMethod,
+      uncompressedSize,
+      compressedData: data.subarray(dataStart, dataStart + compressedSize),
+    });
+
+    offset += CD_RECORD_SIZE + fileNameLength + extraFieldLength + commentLength;
+  }
+
+  return entries;
+}
+
+interface EndOfCentralDirectory {
+  centralDirectoryOffset: number;
+  entryCount: number;
+}
+
+/**
+ * Locate and validate the end-of-central-directory record.
+ *
+ * Scans backward from the end of the archive across the maximum comment
+ * span. A signature match alone is not trusted (the four bytes can occur
+ * inside a trailing comment): the record must also point at an offset
+ * that actually holds a central directory record, or be a genuinely
+ * empty archive.
+ */
+function findEndOfCentralDirectory(data: Uint8Array, view: DataView): EndOfCentralDirectory {
+  const scanFloor = Math.max(0, data.length - EOCD_MIN_SIZE - EOCD_MAX_COMMENT);
+
+  for (let pos = data.length - EOCD_MIN_SIZE; pos >= scanFloor; pos--) {
+    if (view.getUint32(pos, true) !== EOCD_SIG) continue;
+
+    const entryCount = view.getUint16(pos + 10, true);
+    const centralDirectorySize = view.getUint32(pos + 12, true);
+    const centralDirectoryOffset = view.getUint32(pos + 16, true);
+
+    const directoryEndsAtRecord = centralDirectoryOffset + centralDirectorySize <= pos;
+    const directoryLooksReal =
+      entryCount === 0 ||
+      (centralDirectoryOffset + 4 <= data.length &&
+        view.getUint32(centralDirectoryOffset, true) === CENTRAL_DIRECTORY_SIG);
+
+    if (directoryEndsAtRecord && directoryLooksReal) {
+      return { centralDirectoryOffset, entryCount };
+    }
+  }
+
+  throw new Error("no end-of-central-directory record found");
+}
+
+/** Resolve where an entry's payload begins, from its local file header. */
+function payloadStart(
+  data: Uint8Array,
+  view: DataView,
+  localHeaderOffset: number,
+  fileName: string,
+): number {
+  if (
+    localHeaderOffset + LOCAL_HEADER_SIZE > data.length ||
+    view.getUint32(localHeaderOffset, true) !== LOCAL_FILE_HEADER_SIG
+  ) {
+    throw new Error(`entry "${fileName}" has no local file header at offset ${localHeaderOffset}`);
+  }
+
+  const localNameLength = view.getUint16(localHeaderOffset + 26, true);
+  const localExtraLength = view.getUint16(localHeaderOffset + 28, true);
+  return localHeaderOffset + LOCAL_HEADER_SIZE + localNameLength + localExtraLength;
+}

package/dist/shared/datastore-attachment.d.ts

@@ -1,99 +0,0 @@
-/**
- * The runner-synthesized datastore records attachment (T05, DD-001 SD-2).
- *
- * When an agent declares `datastore_usages`, the runner synthesizes ONE
- * MCP attachment serving the five record tools (DD-005) — the agent
- * builder writes a usage line and gets tools; no McpServer resource, no
- * Environment, no credential in any manifest. Harness-agnostic like
- * mcp-resolver.ts: both ExecuteCursor and ExecuteDeepAgent inject the
- * synthesized entry through their existing ResolvedMcpServer paths.
- *
- * Two connection shapes, one roster (the bridge's records-only roster,
- * T05 R1):
- *   - Bridge endpoint configured (cloud): Streamable HTTP against the
- *     bridge's /records route, with the execution's own session-scoped
- *     credential as the Bearer token — the server's reach chain (DD-006
- *     Path 1) authorizes from that token; the bridge stays a
- *     non-validating passthrough.
- *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
- *     stdio child with STIGMER_MCP_ROSTER=records against the local
- *     backend (zero new distribution — the CLI already embeds the
- *     bridge). No credential: the local backend is unauthenticated and
- *     OSS callers resolve as the local principal (T05 R2).
- *
- * Approval-free by construction (DD-001 SD-3): empty toolApprovals +
- * pinnedToolApprovals + toolApprovalOverrides mean mergeApprovalPolicies
- * emits no entries for this server — zero classifier involvement, and no
- * proto surface can target it (the attachment has no McpServerUsage, and
- * since issue #349 an agent's overrides are scoped to their own usage's
- * server, so a same-named override elsewhere cannot reach this one).
- * `discoveredCapabilitiesEmpty`
- * is false and the attachment has no McpServerUsage, so the connect
- * backfill (whose destructiveHint tightener would force-gate
- * delete_record — silently skipped on channels under UNATTENDED mode)
- * is structurally unable to touch it. Callers must still inject AFTER
- * resolve + backfill; both harness call sites do.
- */
-import type { DatastoreUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
-import type { ResolvedMcpServer } from "./mcp-resolver.js";
-import { type SynthesizedAttachmentOptions } from "./synthesized-attachment.js";
-/**
- * The synthesized attachment's slug. Reserved: a user McpServer with
- * this slug is shadowed by the synthesized attachment (the record tools
- * must exist whenever `datastore_usages` says so), with a warning.
- */
-export declare const DATASTORE_ATTACHMENT_SLUG = "stigmer-records";
-/** The bridge route serving the records-only roster (mcp-server T05 R1). */
-export declare const RECORDS_ROUTE = "/records";
-/**
- * Synthesize the records attachment for an agent's datastore usages.
- * Returns undefined when the agent uses no datastores — the attachment
- * exists exactly when the usage edge does.
- */
-export declare function synthesizeDatastoreAttachment(datastoreUsages: DatastoreUsage[], options: SynthesizedAttachmentOptions): ResolvedMcpServer | undefined;
-/**
- * The five record tools the records roster always serves (DD-005; the
- * mcp-server's records roster registers all five unconditionally for the
- * agent audience — only the `org` argument shape varies by audience, see
- * mcp-server/src/domains/records/tools.ts). Because the roster never
- * legitimately narrows, any of these missing from the connected toolset
- * means the store is degraded (issue #325) — the prompt section and the
- * reconciliation both derive from this one list so they cannot drift.
- */
-export declare const EXPECTED_RECORD_TOOLS: readonly ["describe_datastore", "find_records", "insert_record", "update_record", "delete_record"];
-/**
- * Reconcile the record tools actually connected against the roster
- * contract (issue #325). Returns the expected tools absent from
- * `actualToolNames` — empty means healthy. Names are bare tool names
- * exactly as reported by tools/list (the mcp-enabled-tools identity
- * space); extraneous names are ignored.
- */
-export declare function missingRecordTools(actualToolNames: Iterable<string>): string[];
-/**
- * The operator-facing degradation notice (issue #325): pushed as a
- * MESSAGE_SYSTEM row on the execution status so "declared N datastores,
- * X/5 record tools connected" is visible without reading a transcript.
- * Lives HERE with the rest of the datastore-attachment wording — the
- * harness only threads it.
- */
-export declare function formatDatastoreDegradationNotice(declaredCount: number, missing: readonly string[]): string;
-/**
- * The datastores prompt section (DD-005 SD-5, the skills-section
- * precedent). Shared by both harnesses so the section text cannot drift
- * (the sender-identity precedent). Two honest renderings (issue #325):
- *
- * - Healthy (`missingToolNames` empty or omitted — the Cursor harness
- *   always calls it this way: the Cursor SDK connects MCP itself, so
- *   that harness can never observe the live roster):
- *   `<available_datastores>` names the attached datastores, points the
- *   model at describe_datastore first, and carries a standing
- *   failure-disclosure instruction — the only mechanism that covers
- *   tools which connected but fail at call time (the WhatsApp-pilot
- *   outage shape).
- * - Degraded (deep-agent only, from missingRecordTools against the
- *   connected roster): `<unavailable_datastores>` instead — the section
- *   must not promise tools the agent does not have. Names the declared
- *   datastores, states which record tools are missing, and instructs
- *   plain disclosure over improvisation.
- */
-export declare function formatDatastoresSection(datastoreUsages: DatastoreUsage[], missingToolNames?: readonly string[]): string;

package/dist/shared/datastore-attachment.js

@@ -1,184 +0,0 @@
-/**
- * The runner-synthesized datastore records attachment (T05, DD-001 SD-2).
- *
- * When an agent declares `datastore_usages`, the runner synthesizes ONE
- * MCP attachment serving the five record tools (DD-005) — the agent
- * builder writes a usage line and gets tools; no McpServer resource, no
- * Environment, no credential in any manifest. Harness-agnostic like
- * mcp-resolver.ts: both ExecuteCursor and ExecuteDeepAgent inject the
- * synthesized entry through their existing ResolvedMcpServer paths.
- *
- * Two connection shapes, one roster (the bridge's records-only roster,
- * T05 R1):
- *   - Bridge endpoint configured (cloud): Streamable HTTP against the
- *     bridge's /records route, with the execution's own session-scoped
- *     credential as the Bearer token — the server's reach chain (DD-006
- *     Path 1) authorizes from that token; the bridge stays a
- *     non-validating passthrough.
- *   - No bridge endpoint (OSS/local): a spawned `stigmer mcp-server`
- *     stdio child with STIGMER_MCP_ROSTER=records against the local
- *     backend (zero new distribution — the CLI already embeds the
- *     bridge). No credential: the local backend is unauthenticated and
- *     OSS callers resolve as the local principal (T05 R2).
- *
- * Approval-free by construction (DD-001 SD-3): empty toolApprovals +
- * pinnedToolApprovals + toolApprovalOverrides mean mergeApprovalPolicies
- * emits no entries for this server — zero classifier involvement, and no
- * proto surface can target it (the attachment has no McpServerUsage, and
- * since issue #349 an agent's overrides are scoped to their own usage's
- * server, so a same-named override elsewhere cannot reach this one).
- * `discoveredCapabilitiesEmpty`
- * is false and the attachment has no McpServerUsage, so the connect
- * backfill (whose destructiveHint tightener would force-gate
- * delete_record — silently skipped on channels under UNATTENDED mode)
- * is structurally unable to touch it. Callers must still inject AFTER
- * resolve + backfill; both harness call sites do.
- */
-import { grpcTarget } from "./synthesized-attachment.js";
-/**
- * The synthesized attachment's slug. Reserved: a user McpServer with
- * this slug is shadowed by the synthesized attachment (the record tools
- * must exist whenever `datastore_usages` says so), with a warning.
- */
-export const DATASTORE_ATTACHMENT_SLUG = "stigmer-records";
-/** The bridge route serving the records-only roster (mcp-server T05 R1). */
-export const RECORDS_ROUTE = "/records";
-/**
- * Synthesize the records attachment for an agent's datastore usages.
- * Returns undefined when the agent uses no datastores — the attachment
- * exists exactly when the usage edge does.
- */
-export function synthesizeDatastoreAttachment(datastoreUsages, options) {
-    if (datastoreUsages.length === 0) {
-        return undefined;
-    }
-    // Approval-free by construction + backfill-proof: see file header.
-    const base = {
-        slug: DATASTORE_ATTACHMENT_SLUG,
-        toolApprovals: [],
-        pinnedToolApprovals: [],
-        toolApprovalOverrides: [],
-        discoveredCapabilitiesEmpty: false,
-    };
-    if (options.bridgeEndpoint !== null && options.bridgeEndpoint !== "") {
-        return {
-            ...base,
-            connectionType: "http",
-            url: options.bridgeEndpoint.replace(/\/+$/, "") + RECORDS_ROUTE,
-            headers: options.credential !== null && options.credential !== ""
-                ? { Authorization: `Bearer ${options.credential}` }
-                : undefined,
-        };
-    }
-    return {
-        ...base,
-        connectionType: "stdio",
-        command: "stigmer",
-        args: ["mcp-server"],
-        env: {
-            STIGMER_MCP_ROSTER: "records",
-            STIGMER_SERVER_ADDRESS: grpcTarget(options.backendEndpoint),
-        },
-    };
-}
-/**
- * The five record tools the records roster always serves (DD-005; the
- * mcp-server's records roster registers all five unconditionally for the
- * agent audience — only the `org` argument shape varies by audience, see
- * mcp-server/src/domains/records/tools.ts). Because the roster never
- * legitimately narrows, any of these missing from the connected toolset
- * means the store is degraded (issue #325) — the prompt section and the
- * reconciliation both derive from this one list so they cannot drift.
- */
-export const EXPECTED_RECORD_TOOLS = [
-    "describe_datastore",
-    "find_records",
-    "insert_record",
-    "update_record",
-    "delete_record",
-];
-/**
- * Reconcile the record tools actually connected against the roster
- * contract (issue #325). Returns the expected tools absent from
- * `actualToolNames` — empty means healthy. Names are bare tool names
- * exactly as reported by tools/list (the mcp-enabled-tools identity
- * space); extraneous names are ignored.
- */
-export function missingRecordTools(actualToolNames) {
-    const present = new Set(actualToolNames);
-    return EXPECTED_RECORD_TOOLS.filter((name) => !present.has(name));
-}
-/**
- * The operator-facing degradation notice (issue #325): pushed as a
- * MESSAGE_SYSTEM row on the execution status so "declared N datastores,
- * X/5 record tools connected" is visible without reading a transcript.
- * Lives HERE with the rest of the datastore-attachment wording — the
- * harness only threads it.
- */
-export function formatDatastoreDegradationNotice(declaredCount, missing) {
-    const connected = EXPECTED_RECORD_TOOLS.length - missing.length;
-    return (`Datastore record tools unavailable this turn: declared ` +
-        `${declaredCount} datastore(s), ${connected}/${EXPECTED_RECORD_TOOLS.length} ` +
-        `record tools connected (missing: ${missing.join(", ")}). The agent has ` +
-        `been instructed to disclose this instead of answering from memory.`);
-}
-/**
- * The datastores prompt section (DD-005 SD-5, the skills-section
- * precedent). Shared by both harnesses so the section text cannot drift
- * (the sender-identity precedent). Two honest renderings (issue #325):
- *
- * - Healthy (`missingToolNames` empty or omitted — the Cursor harness
- *   always calls it this way: the Cursor SDK connects MCP itself, so
- *   that harness can never observe the live roster):
- *   `<available_datastores>` names the attached datastores, points the
- *   model at describe_datastore first, and carries a standing
- *   failure-disclosure instruction — the only mechanism that covers
- *   tools which connected but fail at call time (the WhatsApp-pilot
- *   outage shape).
- * - Degraded (deep-agent only, from missingRecordTools against the
- *   connected roster): `<unavailable_datastores>` instead — the section
- *   must not promise tools the agent does not have. Names the declared
- *   datastores, states which record tools are missing, and instructs
- *   plain disclosure over improvisation.
- */
-export function formatDatastoresSection(datastoreUsages, missingToolNames = []) {
-    const entries = datastoreUsages
-        .map((u) => u.datastoreRef?.slug)
-        .filter((s) => !!s)
-        .map((slug) => `- ${slug}`);
-    if (missingToolNames.length > 0) {
-        return [
-            "<unavailable_datastores>",
-            "This agent is configured to use the datastores listed below, but the",
-            "following record tools failed to connect this turn:",
-            missingToolNames.join(", ") + ".",
-            "Treat these datastores as unreachable for any operation that needs a",
-            "missing tool.",
-            "",
-            ...entries,
-            "",
-            "When the user's request depends on one of these datastores, tell them",
-            "plainly that the datastore cannot be reached right now. Never answer",
-            "from memory, guess, or improvise a substitute for what the datastore",
-            "would have returned.",
-            "</unavailable_datastores>",
-        ].join("\n");
-    }
-    return [
-        "<available_datastores>",
-        "You have access to the following datastores through the record tools",
-        `(${EXPECTED_RECORD_TOOLS.join(", ")}).`,
-        "Before your first operation against a datastore, call describe_datastore to",
-        "learn its collections, field encodings, and which operations you are allowed",
-        "to perform.",
-        "",
-        ...entries,
-        "",
-        "If any record tool is missing from your toolset or a record tool call",
-        "fails, the datastore is unreachable: tell the user plainly that you cannot",
-        "reach it right now, and do not answer from memory, guess, or improvise a",
-        "substitute for what it would have returned.",
-        "</available_datastores>",
-    ].join("\n");
-}
-//# sourceMappingURL=datastore-attachment.js.map

package/dist/shared/datastore-attachment.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"datastore-attachment.js","sourceRoot":"","sources":["../../src/shared/datastore-attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,UAAU,EAAqC,MAAM,6BAA6B,CAAC;AAE5F;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,eAAiC,EACjC,OAAqC;IAErC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,yBAAyB;QAC/B,aAAa,EAAE,EAAE;QACjB,mBAAmB,EAAE,EAAE;QACvB,qBAAqB,EAAE,EAAE;QACzB,2BAA2B,EAAE,KAAK;KACnC,CAAC;IAEF,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,cAAc,EAAE,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,aAAa;YAC/D,OAAO,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,EAAE;gBAC/D,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,EAAE;gBACnD,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,cAAc,EAAE,OAAO;QACvB,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,GAAG,EAAE;YACH,kBAAkB,EAAE,SAAS;YAC7B,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,eAAe,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,eAAe;IACf,eAAe;CACP,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,eAAiC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACzC,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAC9C,aAAqB,EACrB,OAA0B;IAE1B,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAChE,OAAO,CACL,yDAAyD;QACzD,GAAG,aAAa,kBAAkB,SAAS,IAAI,qBAAqB,CAAC,MAAM,GAAG;QAC9E,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB;QACzE,oEAAoE,CACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,eAAiC,EACjC,mBAAsC,EAAE;IAExC,MAAM,OAAO,GAAG,eAAe;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC;SAChC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAE9B,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,0BAA0B;YAC1B,sEAAsE;YACtE,qDAAqD;YACrD,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG;YACjC,sEAAsE;YACtE,eAAe;YACf,EAAE;YACF,GAAG,OAAO;YACV,EAAE;YACF,uEAAuE;YACvE,sEAAsE;YACtE,sEAAsE;YACtE,sBAAsB;YACtB,2BAA2B;SAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO;QACL,wBAAwB;QACxB,sEAAsE;QACtE,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACxC,6EAA6E;QAC7E,8EAA8E;QAC9E,aAAa;QACb,EAAE;QACF,GAAG,OAAO;QACV,EAAE;QACF,uEAAuE;QACvE,4EAA4E;QAC5E,0EAA0E;QAC1E,6CAA6C;QAC7C,yBAAyB;KAC1B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}