@stigmer/runner 3.12.0 → 3.12.2

package/src/middleware/approval-gate.ts

@@ -88,10 +88,11 @@ export interface ApprovalGateConfig {
    * `write`/`delete` whose target path is capturable (git-tracked — see
    * {@link isCapturablePath}) FLOWS instead of interrupting: the edit is reviewed
    * post-hoc as a captured `FileChangeSet`, not gated before it runs. A gitignored
-   * path is NOT capturable, so it stays gated (the git substrate cannot capture or
-   * revert it) — the exact twin of the Cursor hook's `__stigmer_is_gitignored`
-   * allow-branch. `shell` and MCP tools are never bypassed by this flag. Off (the
-   * default) keeps the classic true-pause gate for every mutation.
+   * path is NOT capturable by the git substrate, so it stays gated unless
+   * {@link captureIgnored} routes it into CAS capture — the exact twin of the
+   * Cursor hook's `__stigmer_is_gitignored` allow-branch. `shell` and MCP tools
+   * are never bypassed by this flag. Off (the default) keeps the classic
+   * true-pause gate for every mutation.
    */
   readonly fileCaptureMode?: boolean;
   /**
@@ -107,12 +108,12 @@ export interface ApprovalGateConfig {
    * instead of the interrupt gate, applying the DD-E secret gate. When off, a
    * gitignored path stays on the interrupt gate exactly as before.
    *
-   * TRUE ONLY FOR THE PARENT GATE. Sub-agents build their own plain filesystem
-   * backends, which the CAS observer does not wrap, so flowing their gitignored
-   * edits would apply unobserved, unreviewable bytes. `buildSubAgentMiddleware`
-   * therefore forces this to false for sub-agent gates — it must NOT be inherited
-   * as true. (Sub-agent git-tracked edits are still captured by the turn-boundary
-   * git diff, which is backend-agnostic.)
+   * True only for gates whose backend a CAS observer wraps: the parent gate
+   * always (setup.ts), and — since DD-19 — sub-agent gates too, because
+   * `compileSubagents` gives every sub-agent a CAS-observing backend wired to
+   * the SAME shared observer and `buildSubAgentMiddleware` then inherits this
+   * config verbatim. A gate over an UNOBSERVED backend must keep this false:
+   * flowing its gitignored edits would apply unobserved, unreviewable bytes.
    */
   readonly captureIgnored?: boolean;
   /**
@@ -122,6 +123,20 @@ export interface ApprovalGateConfig {
    * secret; the CONTENT never leaves the workspace). Absent ⇒ nothing recorded.
    */
   readonly recordBlockedSecret?: (rawPath: string) => void;
+  /**
+   * Capture a file's pre-delete bytes into the CAS observer so a CAS-owned
+   * (gitignored / non-git) DELETE can flow under {@link captureIgnored} and be
+   * reviewed post-hoc exactly like a write (issue #303) — the delete twin of the
+   * backend's `recordBefore` write observation. A delete is the one mutation the
+   * backend cannot observe (deepagents has no backend delete method to wrap), so
+   * the gate captures at authorization time instead: the file's bytes are still
+   * on disk here, and the turn boundary then reads after=null and authors a
+   * `FILE_CHANGE_KIND_DELETE` with the same discard-restores contract.
+   *
+   * Absent ⇒ deletes keep today's interrupt-gate behavior (fail-closed: a delete
+   * we cannot capture cannot be reviewed, so it must be approved up front).
+   */
+  readonly captureDeleteBefore?: (rawPath: string) => Promise<void>;
   /**
    * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED):
    * the creating surface — a messaging channel, a guest share — has no
@@ -213,22 +228,39 @@ export function createApprovalGateMiddleware(
             emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", "file_capture");
             return await handler(request);
           }
-          // Gitignored path. Only the PARENT gate (captureIgnored) routes it into
-          // CAS capture; sub-agent gates fall through to the interrupt gate below,
-          // exactly as before (their backends are not CAS-observed).
+          // Gitignored / non-git path: a gate whose backend the shared CAS
+          // observer wraps (captureIgnored — the parent gate, and sub-agent
+          // gates since DD-19) routes it into CAS capture; any other gate falls
+          // through to the interrupt gate below.
           if (config.captureIgnored) {
-            if (isSecretLikePath(path)) {
-              // DD-E fail-closed: a secret-like gitignored edit is NEVER applied
-              // and NEVER captured. Record it so the turn boundary authors a
-              // DIFF_UNREVIEWABLE entry (blocking approval); nothing is written.
-              config.recordBlockedSecret?.(path);
-              return secretBlockToolMessage(toolName, path, toolCall.id);
-            }
             if (category === "write") {
+              if (isSecretLikePath(path)) {
+                // DD-E fail-closed: a secret-like gitignored WRITE is NEVER
+                // applied and NEVER captured — its content must not surface
+                // anywhere, approval prompt included. Record it so the turn
+                // boundary authors a DIFF_UNREVIEWABLE entry (blocking
+                // approval); nothing is written.
+                config.recordBlockedSecret?.(path);
+                return secretBlockToolMessage(toolName, path, toolCall.id);
+              }
               // Non-secret gitignored write/edit: flows (apply-then-review). The
               // CAS observer already holds its before-bytes and the turn boundary
-              // captures it into CAS. (A gitignored delete has no backend capture
-              // path, so it falls through to the interrupt gate.)
+              // captures it into CAS.
+              emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", "file_capture");
+              return await handler(request);
+            }
+            if (category === "delete" && config.captureDeleteBefore && !isSecretLikePath(path)) {
+              // Non-secret CAS-owned delete: capture the before-bytes NOW (the
+              // one moment they still exist on disk — no backend delete method
+              // to observe them), then flow. The turn boundary reads after=null
+              // and authors a reviewable, restorable DELETE entry (issue #303).
+              //
+              // A SECRET-LIKE delete deliberately falls through to the interrupt
+              // gate instead: unlike a write, its args expose no secret content,
+              // so a human may safely approve it — but its before-bytes must
+              // never enter CAS, so it cannot flow. (This also aligns the twins:
+              // the Cursor hook routes secret deletes to its deny-gate.)
+              await config.captureDeleteBefore(path);
               emitExecutionReceipt(config, toolCall, serverSlug, category, "auto_approve", "file_capture");
               return await handler(request);
             }
@@ -244,8 +276,10 @@ export function createApprovalGateMiddleware(
       // continues) exactly like the capture-mode secret block — a secret write is
       // never applied or persisted in ANY mode. Placed AFTER the capture block so
       // capture-mode paths stay byte-identical (a capturable write already flowed;
-      // a captureIgnored gitignored secret is already blocked). Deletes carry no
-      // content and stay on the deny-gate. recordBlockedSecret is a no-op unless a
+      // a captureIgnored gitignored secret write is already blocked). A delete
+      // carries no content, so a secret-like delete needs no hard-block: it stays
+      // on the interrupt gate below, where a human may still approve it (its
+      // bytes are simply never captured). recordBlockedSecret is a no-op unless a
       // turn boundary reads it (the git-no-storage case, where it authors a
       // content-less DIFF_UNREVIEWABLE).
       if (!serverSlug && category === "write") {

package/src/middleware/otel-spans.ts

@@ -2,7 +2,8 @@
  * OpenTelemetry spans and metrics middleware for deep-agent execution.
  *
  * Creates stigmer.llm.call and stigmer.mcp.tool_call spans with
- * attributes matching the Go workflow-runner schema (pkg/otel/spans.go).
+ * attributes matching the span schema inherited from the retired Go
+ * workflow-runner (kept stable so dashboards survived the migration).
  * Also records metrics (histograms + counters) for aggregate dashboards.
  *
  * Graceful no-op when no TracerProvider/MeterProvider is configured.

package/src/middleware/path-normalization.ts

@@ -1,6 +1,6 @@
 /**
  * Workspace-relative path normalization for permission-rule-bearing graphs
- * (issue #429).
+ * (issues #429, #528).
  *
  * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
  * rule or backend runs, and its validation refuses non-absolute paths — on
@@ -20,13 +20,26 @@
  * resolves relative paths under the workspace root, so act mode keeps a
  * byte-zero delta.
  *
+ * It also supplies the workspace root when `ls`/`glob`/`grep` are called
+ * with NO path argument (issue #528). Those tools' schema default is "/" —
+ * the OS ROOT under the legacy backend — and the default is applied inside
+ * the tool, after this seam, so under the workspace read boundary a bare
+ * first `ls` would otherwise die with `permission denied for read on /`
+ * (the same first-turn degradation class #429 fixed). An EXPLICIT "/" is
+ * deliberately NOT rewritten: the model asked for the OS root, and the
+ * honest answer under plan mode's read boundary is the rules' denial —
+ * silently substituting workspace contents would be an answer to a
+ * different question.
+ *
  * Invariant — nothing becomes newly reachable: only paths whose resolution
  * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
  * and `~`-carrying paths are left raw so today's validation refusal keeps
  * speaking (a naive join would resolve `..` away and smuggle an out-of-root
  * read past validation), and absolute paths pass through byte-untouched.
  * The middleware converts false errors into correct behavior — never a
- * refusal into an allowance the rules didn't decide.
+ * refusal into an allowance the rules didn't decide. (The absent-path
+ * injection honors the same line: it narrows the tool's own OS-root default
+ * to the workspace, granting nothing the rules would refuse.)
  *
  * Tool matching is by bare built-in name, the house doctrine (an MCP server
  * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
@@ -41,9 +54,8 @@ import type { StigmerMiddleware } from "./types.js";
 
 /**
  * The path-bearing argument of each deepagents built-in filesystem tool.
- * `ls`/`glob`/`grep` take a base directory `path` (defaulting to "/" when
- * omitted — absolute, so untouched here); the file tools take `file_path`.
- * Confirmed against the installed deepagents' tool definitions.
+ * `ls`/`glob`/`grep` take a base directory `path`; the file tools take
+ * `file_path`. Confirmed against the installed deepagents' tool definitions.
  */
 const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["ls", "path"],
@@ -54,6 +66,15 @@ const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
   ["edit_file", "file_path"],
 ]);
 
+/**
+ * The tools whose path argument is optional with an OS-root ("/") schema
+ * default. When the model omits it, this middleware supplies the workspace
+ * root instead (issue #528). The file tools are deliberately excluded: an
+ * absent `file_path` is a genuine model error, and the tool's own input
+ * validation gives the better message.
+ */
+const DIR_DEFAULTING_TOOLS: ReadonlySet<string> = new Set(["ls", "glob", "grep"]);
+
 export interface PathNormalizationConfig {
   /** The workspace root the graph's filesystem backend resolves against. */
   readonly rootDir: string;
@@ -108,6 +129,22 @@ export function createPathNormalizationMiddleware(
       if (!argKey) return handler(request);
 
       const raw = request.toolCall.args[argKey];
+
+      // Absent base directory on ls/glob/grep: the middleware sees the
+      // model's raw args, BEFORE the tool's zod parse applies the "/"
+      // (OS root) schema default — so the omission must be filled here,
+      // where the workspace root is known. An explicit "/" is not this
+      // case and flows through to an honest rule denial (header doctrine).
+      if (raw == null && DIR_DEFAULTING_TOOLS.has(request.toolCall.name)) {
+        return handler({
+          ...request,
+          toolCall: {
+            ...request.toolCall,
+            args: { ...request.toolCall.args, [argKey]: rootDir },
+          },
+        });
+      }
+
       if (typeof raw !== "string") return handler(request);
 
       const normalized = normalizeWorkspacePathArg(raw, rootDir);

package/src/runner-manager.ts

@@ -703,6 +703,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     { createCursorActivities },
     { createDeepAgentActivities },
     { createEnsureThreadActivities },
+    { createGenerateSessionSubjectActivities },
     { createClassifyToolApprovalsActivities },
     { createDiscoverMcpServerActivities },
     { createEvaluateExpressionsActivities },
@@ -721,6 +722,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     import("./activities/execute-cursor/index.js"),
     import("./activities/execute-deep-agent/index.js"),
     import("./activities/ensure-thread.js"),
+    import("./activities/generate-session-subject.js"),
     import("./activities/classify-tool-approvals.js"),
     import("./activities/discover-mcp-server.js"),
     import("./activities/evaluate-expressions.js"),
@@ -741,6 +743,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     ...createCursorActivities(config),
     ...createDeepAgentActivities(config),
     ...createEnsureThreadActivities(),
+    ...createGenerateSessionSubjectActivities(config),
     ...createClassifyToolApprovalsActivities(config),
     ...createDiscoverMcpServerActivities(config),
     ...createEvaluateExpressionsActivities(),

package/src/runner.ts

@@ -407,6 +407,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     { createCursorActivities },
     { createDeepAgentActivities },
     { createEnsureThreadActivities },
+    { createGenerateSessionSubjectActivities },
     { createClassifyToolApprovalsActivities },
     { createDiscoverMcpServerActivities },
     { createEvaluateExpressionsActivities },
@@ -425,6 +426,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     import("./activities/execute-cursor/index.js"),
     import("./activities/execute-deep-agent/index.js"),
     import("./activities/ensure-thread.js"),
+    import("./activities/generate-session-subject.js"),
     import("./activities/classify-tool-approvals.js"),
     import("./activities/discover-mcp-server.js"),
     import("./activities/evaluate-expressions.js"),
@@ -445,6 +447,7 @@ async function createAllActivities(config: Config): Promise<WorkerActivities> {
     ...createCursorActivities(config),
     ...createDeepAgentActivities(config),
     ...createEnsureThreadActivities(),
+    ...createGenerateSessionSubjectActivities(config),
     ...createClassifyToolApprovalsActivities(config),
     ...createDiscoverMcpServerActivities(config),
     ...createEvaluateExpressionsActivities(),

package/src/shared/__tests__/attachment-vision.test.ts

@@ -291,6 +291,10 @@ describe("VisionBudget — size and count budgets", () => {
   });
 
   it("ships the production constants agreed in T04 (raw bytes)", () => {
+    // Also the ADVERTISED == ENFORCED drift alarm (stigmer/stigmer#365):
+    // the registry document advertises these exact values in its
+    // `limits.vision` block, pinned by the cloud codec's own test. If this
+    // fails, the budget changed on one side only — update both together.
     expect(MAX_VISION_IMAGE_BYTES).toBe(3 * 1024 * 1024);
     expect(MAX_VISION_TOTAL_BYTES).toBe(4 * 1024 * 1024);
     expect(MAX_VISION_IMAGES).toBe(10);

package/src/shared/__tests__/mcp-manager.test.ts

@@ -66,7 +66,7 @@ describe("toMcpClientConfig", () => {
     });
   });
 
-  it("maps HTTP servers to streamable_http transport", () => {
+  it("maps HTTP servers to streamable_http transport with reconnect enabled", () => {
     const servers = [
       makeServer({
         slug: "github",
@@ -80,10 +80,14 @@ describe("toMcpClientConfig", () => {
       transport: "http",
       url: "https://api.github.com/mcp",
       headers: { Authorization: "Bearer tok" },
+      // oss#316: severed remote connections (e.g. the hosted bridge
+      // restarting mid-execution) re-initialize instead of stranding the
+      // agent on a dead session.
+      reconnect: { enabled: true, maxAttempts: 3, delayMs: 1_000 },
     });
   });
 
-  it("maps SSE servers to streamable_http transport", () => {
+  it("maps SSE servers to streamable_http transport with reconnect enabled", () => {
     const servers = [
       makeServer({
         slug: "sse-server",
@@ -96,6 +100,7 @@ describe("toMcpClientConfig", () => {
       transport: "http",
       url: "https://sse.example.com/mcp",
       headers: undefined,
+      reconnect: { enabled: true, maxAttempts: 3, delayMs: 1_000 },
     });
   });
 

package/src/shared/__tests__/plan-mode-permissions.test.ts

@@ -0,0 +1,58 @@
+/**
+ * Unit pins for the plan-mode rule builder (issue #528).
+ *
+ * The rule ORDER and SHAPE are the security boundary: deepagents evaluates
+ * first-match-wins with a permissive default, so the workspace read-allow
+ * must precede the read-deny, and the deny patterns must be the match-all
+ * "/**". These tests pin the built value; the boundary's end-to-end
+ * behavior (including matcher semantics for escaped roots and symlinked
+ * platform paths) is pinned against the real deepagents runtime in
+ * execute-deep-agent/__tests__/plan-mode-path-normalization.test.ts.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  buildPlanModePermissions,
+  escapeGlobLiteral,
+} from "../plan-mode-permissions.js";
+
+describe("buildPlanModePermissions", () => {
+  it("builds the policy in enforcement order: workspace read-allow, then read-deny, then write-deny", () => {
+    expect(buildPlanModePermissions("/ws/session-1/repo")).toEqual([
+      { operations: ["read"], paths: ["/ws/session-1/repo/**"] },
+      { operations: ["read"], paths: ["/**"], mode: "deny" },
+      { operations: ["write"], paths: ["/**"], mode: "deny" },
+    ]);
+  });
+
+  it("canonicalizes the root before building the pattern", () => {
+    // Enforcement canonicalizes incoming paths (no trailing separator,
+    // collapsed slashes) before matching — a pattern built from a raw
+    // trailing-slash root would silently match nothing.
+    const [allow] = buildPlanModePermissions("/ws//session-1/repo/");
+    expect(allow.paths).toEqual(["/ws/session-1/repo/**"]);
+  });
+
+  it("glob-escapes the root so special characters match literally", () => {
+    const [allow] = buildPlanModePermissions("/Users/x/My (work) [v2]");
+    expect(allow.paths).toEqual(["/Users/x/My \\(work\\) \\[v2\\]/**"]);
+  });
+});
+
+describe("escapeGlobLiteral", () => {
+  it("escapes every micromatch metacharacter", () => {
+    expect(escapeGlobLiteral("a*b?c(d)e[f]g{h}i!j+k@l")).toBe(
+      "a\\*b\\?c\\(d\\)e\\[f\\]g\\{h\\}i\\!j\\+k\\@l",
+    );
+  });
+
+  it("escapes backslashes themselves", () => {
+    expect(escapeGlobLiteral("a\\b")).toBe("a\\\\b");
+  });
+
+  it("leaves plain path characters alone", () => {
+    expect(escapeGlobLiteral("/ws/session-1/repo.dir")).toBe(
+      "/ws/session-1/repo.dir",
+    );
+  });
+});

package/src/shared/__tests__/zip-extract.test.ts

@@ -1,89 +1,12 @@
 import { describe, it, expect } from "vitest";
-import { deflateRawSync } from "node:zlib";
 import { extractZipFileEntries } from "../zip-extract.js";
-
-// ─── Helpers ─────────────────────────────────────────────────────────────
-
-/**
- * Build a minimal valid ZIP archive from an array of { name, content } entries.
- * Uses stored (method 0) compression for simplicity. Produces local file
- * headers only (no central directory) — sufficient for our parser.
- */
-function buildStoredZip(files: { name: string; content: string }[]): Uint8Array {
-  const parts: Uint8Array[] = [];
-
-  for (const file of files) {
-    const nameBytes = new TextEncoder().encode(file.name);
-    const contentBytes = new TextEncoder().encode(file.content);
-    const isDir = file.name.endsWith("/");
-
-    // Local file header: 30 bytes
-    const header = new ArrayBuffer(30);
-    const view = new DataView(header);
-    view.setUint32(0, 0x04034b50, true);  // signature
-    view.setUint16(4, 20, true);           // version needed
-    view.setUint16(6, 0, true);            // general purpose flags
-    view.setUint16(8, 0, true);            // compression method (stored)
-    view.setUint16(10, 0, true);           // last mod time
-    view.setUint16(12, 0, true);           // last mod date
-    view.setUint32(14, 0, true);           // crc-32 (unused for our purposes)
-    view.setUint32(18, isDir ? 0 : contentBytes.length, true); // compressed size
-    view.setUint32(22, isDir ? 0 : contentBytes.length, true); // uncompressed size
-    view.setUint16(26, nameBytes.length, true);  // file name length
-    view.setUint16(28, 0, true);           // extra field length
-
-    parts.push(new Uint8Array(header));
-    parts.push(nameBytes);
-    if (!isDir) {
-      parts.push(contentBytes);
-    }
-  }
-
-  const totalLength = parts.reduce((sum, p) => sum + p.length, 0);
-  const result = new Uint8Array(totalLength);
-  let offset = 0;
-  for (const part of parts) {
-    result.set(part, offset);
-    offset += part.length;
-  }
-  return result;
-}
-
-/**
- * Build a ZIP archive with a single deflated (method 8) entry.
- */
-function buildDeflatedZip(name: string, content: string): Uint8Array {
-  const nameBytes = new TextEncoder().encode(name);
-  const contentBytes = new TextEncoder().encode(content);
-  const compressed = deflateRawSync(contentBytes);
-
-  const header = new ArrayBuffer(30);
-  const view = new DataView(header);
-  view.setUint32(0, 0x04034b50, true);
-  view.setUint16(4, 20, true);
-  view.setUint16(6, 0, true);
-  view.setUint16(8, 8, true);            // deflated
-  view.setUint16(10, 0, true);
-  view.setUint16(12, 0, true);
-  view.setUint32(14, 0, true);
-  view.setUint32(18, compressed.length, true);
-  view.setUint32(22, contentBytes.length, true);
-  view.setUint16(26, nameBytes.length, true);
-  view.setUint16(28, 0, true);
-
-  const totalLength = 30 + nameBytes.length + compressed.length;
-  const result = new Uint8Array(totalLength);
-  result.set(new Uint8Array(header), 0);
-  result.set(nameBytes, 30);
-  result.set(new Uint8Array(compressed.buffer, compressed.byteOffset, compressed.length), 30 + nameBytes.length);
-  return result;
-}
+import { buildZip } from "../../__test-utils__/zip-fixtures.js";
 
 // ─── extractZipFileEntries ───────────────────────────────────────────────
 
 describe("extractZipFileEntries", () => {
   it("extracts stored files from a ZIP archive", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "SKILL.md", content: "# My Skill" },
       { name: "references/schema.md", content: "# Schema\n\nTable definitions." },
     ]);
@@ -96,7 +19,7 @@ describe("extractZipFileEntries", () => {
 
   it("extracts deflated files", async () => {
     const content = "This content is compressed with deflate.";
-    const zip = buildDeflatedZip("notes.txt", content);
+    const zip = buildZip([{ name: "notes.txt", content, method: "deflated" }]);
 
     const entries = await extractZipFileEntries(zip);
     expect(entries).toHaveLength(1);
@@ -104,7 +27,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("skips directory entries", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "references/", content: "" },
       { name: "references/data.md", content: "data" },
     ]);
@@ -115,7 +38,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("excludes files by basename", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "SKILL.md", content: "# Skill" },
       { name: "references/schema.md", content: "# Schema" },
       { name: "scripts/run.py", content: "print('hi')" },
@@ -127,7 +50,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("excludes files by full path", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "a.md", content: "a" },
       { name: "nested/a.md", content: "nested" },
     ]);
@@ -138,7 +61,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("excludes entries matching basename even when nested", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "SKILL.md", content: "root" },
       { name: "sub/SKILL.md", content: "sub" },
       { name: "data.md", content: "data" },
@@ -166,7 +89,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("handles multiple files with nested directories", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "SKILL.md", content: "# Skill" },
       { name: "references/", content: "" },
       { name: "references/database-schema.md", content: "# Schema" },
@@ -184,7 +107,7 @@ describe("extractZipFileEntries", () => {
   });
 
   it("returns all entries when no exclude option is provided", async () => {
-    const zip = buildStoredZip([
+    const zip = buildZip([
       { name: "a.txt", content: "aaa" },
       { name: "b.txt", content: "bbb" },
     ]);
@@ -194,11 +117,105 @@ describe("extractZipFileEntries", () => {
   });
 
   it("returns all entries when exclude list is empty", async () => {
-    const zip = buildStoredZip([
-      { name: "a.txt", content: "aaa" },
-    ]);
+    const zip = buildZip([{ name: "a.txt", content: "aaa" }]);
 
     const entries = await extractZipFileEntries(zip, { exclude: [] });
     expect(entries).toHaveLength(1);
   });
+
+  // ── Streaming entries (issue #450) ─────────────────────────────────────
+
+  it("extracts Go-default streaming archives (deflated, data descriptors)", async () => {
+    const zip = buildZip([
+      { name: "SKILL.md", content: "# Streamed Skill", method: "deflated", streaming: true },
+      { name: "references/notes.md", content: "streamed notes", method: "deflated", streaming: true },
+    ]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([
+      { path: "SKILL.md", content: "# Streamed Skill" },
+      { path: "references/notes.md", content: "streamed notes" },
+    ]);
+  });
+
+  it("extracts a stored streaming entry whose payload embeds the data-descriptor signature", async () => {
+    // The four bytes of the descriptor signature (0x08074b50, little-endian
+    // "PK\x07\x08") planted mid-content, followed by twelve bytes a
+    // descriptor-scanning parser would misread as CRC and sizes. The old
+    // local-header walk truncated this entry at the planted signature and
+    // desynchronized everything after it — the exact defect of issue #450.
+    const poisoned = "before PK\u0007\u0008AAAABBBBCCCC after — full content survives";
+    const zip = buildZip([
+      { name: "poison.md", content: poisoned, streaming: true },
+      { name: "after.md", content: "the entry after the poisoned one" },
+    ]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([
+      { path: "poison.md", content: poisoned },
+      { path: "after.md", content: "the entry after the poisoned one" },
+    ]);
+  });
+
+  it("uses central-directory sizes when local header sizes are zeroed", async () => {
+    const content = "sizes live only in the central directory";
+    const zip = buildZip([{ name: "cd-sizes.txt", content, streaming: true }]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([{ path: "cd-sizes.txt", content }]);
+  });
+
+  // ── Central directory edge cases ───────────────────────────────────────
+
+  it("locates the EOCD behind a trailing archive comment", async () => {
+    const zip = buildZip([{ name: "a.txt", content: "aaa" }], {
+      comment: "release archive — built by tooling",
+    });
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([{ path: "a.txt", content: "aaa" }]);
+  });
+
+  it("is not fooled by EOCD signature bytes inside the archive comment", async () => {
+    // "PK\x05\x06" inside the comment is a decoy EOCD; validation must
+    // reject it (its "fields" are comment text) and keep scanning backward
+    // to the real record.
+    const zip = buildZip([{ name: "a.txt", content: "aaa" }], {
+      comment: "decoy: PK\u0005\u0006 not a real record",
+    });
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([{ path: "a.txt", content: "aaa" }]);
+  });
+
+  it("returns empty array when the central directory is missing", async () => {
+    // Local headers and payloads only — a download truncated before the
+    // archive's index. The parser must not fall back to guessing from
+    // local headers (design record 017).
+    const zip = buildZip(
+      [
+        { name: "a.txt", content: "aaa" },
+        { name: "b.txt", content: "bbb" },
+      ],
+      { omitCentralDirectory: true },
+    );
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([]);
+  });
+
+  it("returns empty array for an archive with entries but a truncated tail", async () => {
+    const zip = buildZip([{ name: "a.txt", content: "aaa" }]);
+    const truncated = zip.subarray(0, zip.length - 10); // clips into the EOCD
+
+    const entries = await extractZipFileEntries(truncated);
+    expect(entries).toEqual([]);
+  });
+
+  it("extracts an empty archive (EOCD only) as no entries", async () => {
+    const zip = buildZip([]);
+
+    const entries = await extractZipFileEntries(zip);
+    expect(entries).toEqual([]);
+  });
 });

package/src/shared/attachment-vision.ts

@@ -32,6 +32,15 @@
 
 // ---------------------------------------------------------------------------
 // Budget constants (owner decision, 2026-08-09; project T04)
+//
+// ADVERTISED == ENFORCED (stigmer/stigmer#365): the model registry document
+// advertises these values in its `limits.vision` block (rendered by the
+// cloud's ModelRegistryDocumentCodec, mirrored verbatim by the OSS server)
+// so clients can warn BEFORE an upload this budget would degrade. Both sides
+// pin the literal values in tests — attachment-vision.test.ts here, the
+// codec test there — so changing either side alone fails its own suite.
+// Update both together; deploy the runner first if the budget ever shrinks
+// (never advertise more than the runner accepts).
 // ---------------------------------------------------------------------------
 
 /**