@stigmer/runner 3.12.4 → 3.12.6

package/src/activities/execute-cursor/__tests__/error-classifier-billing.test.ts

@@ -104,3 +104,70 @@ describe("error-classifier billing category", () => {
     expect(result.category).toBe("billing");
   });
 });
+
+describe("D4 platform attribution of billing errors (proxy mode)", () => {
+  // The exact message the 2026-08-15 pool-drain incident put in front of a
+  // customer: Cursor's team-usage-limit prose relayed raw, telling them to
+  // "reach out to an admin" of a Cursor team they cannot see.
+  const CURSOR_USAGE_LIMIT_MESSAGE =
+    "Your team has reached its usage limit. Please reach out to an admin to " +
+    "enable on-demand usage, or return on 8/20/2026 when your limit resets.";
+
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+  });
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("rewords managed-key billing errors with platform attribution", () => {
+    const result = synthesizeError({
+      ...base(),
+      streamErrorMessage: CURSOR_USAGE_LIMIT_MESSAGE,
+      proxyMode: true,
+    });
+    expect(result.category).toBe("billing");
+    expect(result.retryable).toBe(false);
+    expect(result.message).toContain("Stigmer platform");
+    expect(result.message).toContain("credits were not charged");
+    expect(result.message).toContain("STIGMER_PLATFORM_MODEL_CAPACITY");
+    // Cursor's limit-reset date must survive, quoted, not erased.
+    expect(result.message).toContain("return on 8/20/2026");
+  });
+
+  it("leaves BYO-key (direct mode) billing errors untouched", () => {
+    // A self-hoster's drained personal account: the raw message IS the
+    // actionable one — never hide it behind platform attribution.
+    const result = synthesizeError({
+      ...base(),
+      streamErrorMessage: CURSOR_USAGE_LIMIT_MESSAGE,
+      proxyMode: false,
+    });
+    expect(result.category).toBe("billing");
+    expect(result.message).toBe(CURSOR_USAGE_LIMIT_MESSAGE);
+    expect(result.message).not.toContain("STIGMER_PLATFORM_MODEL_CAPACITY");
+  });
+
+  it("does not double-wrap a message the proxy already rewrote", () => {
+    const proxyRewritten =
+      "The Stigmer platform's Cursor capacity is temporarily exhausted. " +
+      "[code: STIGMER_PLATFORM_MODEL_CAPACITY]";
+    const result = synthesizeError({
+      ...base(),
+      streamErrorMessage: proxyRewritten,
+      proxyMode: true,
+    });
+    expect(result.category).toBe("billing");
+    expect(result.message).toBe(proxyRewritten);
+  });
+
+  it("never rewords non-billing categories in proxy mode", () => {
+    const result = synthesizeError({
+      ...base(),
+      streamErrorMessage: "rate limit exceeded, retry after 2s",
+      proxyMode: true,
+    });
+    expect(result.category).toBe("rate-limit");
+    expect(result.message).not.toContain("Stigmer platform");
+  });
+});

package/src/activities/execute-cursor/__tests__/service-tier.test.ts

@@ -1,11 +1,12 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 /**
- * Verifies the service-tier → Cursor variant-parameter translation (#357):
- * the runner must always send an explicit selection whose price-bearing
- * parameters are a deterministic function of the requested tier — never
- * the catalog's (account-influenced) default variant.
+ * Verifies the variant-attribute → Cursor variant-parameter translation
+ * (#357 service tier, #772 thinking mode): the runner must always send an
+ * explicit selection whose user-selectable parameters are a deterministic
+ * function of the requested attributes — never the catalog's
+ * (account-influenced) default variant.
  *
  * Catalog fixtures mirror the real shapes observed 2026-08-06: composer
  * has a `fast` bool (default fast=true), haiku has a `thinking` bool
@@ -23,6 +24,7 @@ import {
   resetCatalogCacheForTests,
 } from "../service-tier.js";
 import { resolveEffectiveServiceTier } from "../../../shared/service-tier.js";
+import { resolveEffectiveThinkingMode } from "../../../shared/thinking-mode.js";
 
 const CATALOG = [
   {
@@ -66,8 +68,12 @@ const CATALOG = [
   },
 ];
 
-function opts(modelId: string, tier: ServiceTier.STANDARD | ServiceTier.FAST) {
-  return { apiKey: "key-1", modelId, tier, executionId: "aex_test" };
+function opts(
+  modelId: string,
+  tier: ServiceTier.STANDARD | ServiceTier.FAST,
+  thinking: ThinkingMode.DISABLED | ThinkingMode.ENABLED = ThinkingMode.DISABLED,
+) {
+  return { apiKey: "key-1", modelId, tier, thinking, executionId: "aex_test" };
 }
 
 beforeEach(() => {
@@ -88,6 +94,18 @@ describe("resolveEffectiveServiceTier", () => {
   });
 });
 
+describe("resolveEffectiveThinkingMode", () => {
+  it("resolves UNSPECIFIED to DISABLED — never the account default", () => {
+    expect(resolveEffectiveThinkingMode(ThinkingMode.UNSPECIFIED)).toBe(ThinkingMode.DISABLED);
+    expect(resolveEffectiveThinkingMode(undefined)).toBe(ThinkingMode.DISABLED);
+  });
+
+  it("preserves explicit DISABLED and ENABLED", () => {
+    expect(resolveEffectiveThinkingMode(ThinkingMode.DISABLED)).toBe(ThinkingMode.DISABLED);
+    expect(resolveEffectiveThinkingMode(ThinkingMode.ENABLED)).toBe(ThinkingMode.ENABLED);
+  });
+});
+
 describe("resolveServiceTierParams", () => {
   it("STANDARD pins fast=false on a fast-capable model", async () => {
     const params = await resolveServiceTierParams(opts("composer-2.5", ServiceTier.STANDARD));
@@ -123,6 +141,48 @@ describe("resolveServiceTierParams", () => {
     ]);
   });
 
+  it("ENABLED pins thinking=true on a thinking-capable model (#772)", async () => {
+    const params = await resolveServiceTierParams(
+      opts("claude-haiku-4-5", ServiceTier.STANDARD, ThinkingMode.ENABLED),
+    );
+    expect(params).toEqual([{ id: "thinking", value: "true" }]);
+  });
+
+  it("ENABLED on a model with no thinking parameter fails loudly, never a silent base variant", async () => {
+    await expect(
+      resolveServiceTierParams(opts("composer-2.5", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/no "thinking" parameter/);
+  });
+
+  it("thinking combines freely with the fast tier — both pinned true, sorted", async () => {
+    const params = await resolveServiceTierParams(
+      opts("claude-opus-4-8", ServiceTier.FAST, ThinkingMode.ENABLED),
+    );
+    expect(params).toEqual([
+      { id: "fast", value: "true" },
+      { id: "thinking", value: "true" },
+    ]);
+  });
+
+  it("Auto + ENABLED is a loud failure (no variant dimensions to pin)", async () => {
+    await expect(
+      resolveServiceTierParams(opts("default", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/requires a pinned model/);
+  });
+
+  it("unknown model + ENABLED fails loudly, never degrades", async () => {
+    await expect(
+      resolveServiceTierParams(opts("not-a-model", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/does not list that model/);
+  });
+
+  it("catalog fetch failure + ENABLED fails loudly, never degrades", async () => {
+    listMock.mockRejectedValue(new Error("proxy down"));
+    await expect(
+      resolveServiceTierParams(opts("claude-haiku-4-5", ServiceTier.STANDARD, ThinkingMode.ENABLED)),
+    ).rejects.toThrow(/catalog fetch failed/);
+  });
+
   it("resolves models referenced by alias", async () => {
     const params = await resolveServiceTierParams(opts("composer", ServiceTier.STANDARD));
     expect(params).toEqual([{ id: "fast", value: "false" }]);

package/src/activities/execute-cursor/__tests__/skill-resolver.test.ts

@@ -3,7 +3,7 @@ import { mkdtempSync, readFileSync, existsSync, rmSync, writeFileSync } from "no
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { ConnectError, Code } from "@connectrpc/connect";
-import { resolveSkills, downloadArtifact } from "../skill-resolver.js";
+import { resolveSkills } from "../skill-resolver.js";
 import { buildZip } from "../../../__test-utils__/zip-fixtures.js";
 
 /** A server that predates the transfer lane (#675) answers the mint RPC
@@ -390,96 +390,5 @@ describe("resolveSkills — artifact extraction", () => {
   });
 });
 
-// ─── downloadArtifact — transfer lane routing (#675) ─────────────────────
-
-describe("downloadArtifact — transfer lane routing", () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
-  });
-
-  function makeClient(overrides: Record<string, any> = {}) {
-    return {
-      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: new Uint8Array(0) }),
-      getSkillArtifactDownloadUrl: unimplementedMint(),
-      ...overrides,
-    } as any;
-  }
-
-  it("fetches bytes over HTTP when the server mints a download URL", async () => {
-    const bytes = new Uint8Array([1, 2, 3, 4, 5]);
-    const client = makeClient({
-      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
-        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
-        sizeBytes: 5n,
-        ttlSeconds: 0,
-      }),
-    });
-    const fetchMock = vi.fn().mockResolvedValue({
-      ok: true,
-      arrayBuffer: async () => bytes.buffer,
-    });
-    vi.stubGlobal("fetch", fetchMock);
-
-    const got = await downloadArtifact(client, "skills/abc.zip");
-
-    expect(got).toEqual(bytes);
-    expect(fetchMock).toHaveBeenCalledWith("http://localhost:7234/v1/skill-artifacts/skills/abc.zip");
-    // The unary lane (10MB-capped) must not be touched when the URL lane works.
-    expect(client.getSkillArtifact).not.toHaveBeenCalled();
-  });
-
-  it("falls back to the unary RPC when the server predates the lane", async () => {
-    const bytes = new Uint8Array([9, 9]);
-    const client = makeClient({
-      getSkillArtifact: vi.fn().mockResolvedValue({ artifact: bytes }),
-    });
-    vi.stubGlobal("fetch", vi.fn()); // must never be called
-
-    const got = await downloadArtifact(client, "skills/abc.zip");
-
-    expect(got).toEqual(bytes);
-    expect(client.getSkillArtifact).toHaveBeenCalledWith("skills/abc.zip");
-    expect(fetch).not.toHaveBeenCalled();
-  });
-
-  it("does NOT fall back on non-Unimplemented mint failures", async () => {
-    const client = makeClient({
-      getSkillArtifactDownloadUrl: vi.fn().mockRejectedValue(
-        new ConnectError("boom", Code.Internal),
-      ),
-    });
-
-    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow("boom");
-    // Falling back here would mask real server faults behind the capped lane.
-    expect(client.getSkillArtifact).not.toHaveBeenCalled();
-  });
-
-  it("rejects truncated fetches via the minted size", async () => {
-    const client = makeClient({
-      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
-        url: "http://localhost:7234/v1/skill-artifacts/skills/abc.zip",
-        sizeBytes: 100n,
-        ttlSeconds: 0,
-      }),
-    });
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
-      ok: true,
-      arrayBuffer: async () => new Uint8Array([1, 2, 3]).buffer,
-    }));
-
-    await expect(downloadArtifact(client, "skills/abc.zip")).rejects.toThrow(/truncated/);
-  });
-
-  it("surfaces HTTP failures with the status code", async () => {
-    const client = makeClient({
-      getSkillArtifactDownloadUrl: vi.fn().mockResolvedValue({
-        url: "http://localhost:7234/v1/skill-artifacts/skills/gone.zip",
-        sizeBytes: 0n,
-        ttlSeconds: 0,
-      }),
-    });
-    vi.stubGlobal("fetch", vi.fn().mockResolvedValue({ ok: false, status: 404 }));
-
-    await expect(downloadArtifact(client, "skills/gone.zip")).rejects.toThrow(/HTTP 404/);
-  });
-});
+// downloadArtifact's transfer-lane routing tests moved with the code to
+// shared/__tests__/skill-mount.test.ts (issue #337 extraction).

package/src/activities/execute-cursor/__tests__/usage-accumulator.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeAll } from "vitest";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import { UsageAccumulator } from "../usage-accumulator.js";
 
@@ -129,4 +129,36 @@ describe("UsageAccumulator", () => {
     expect(unspecified.snapshot().estimatedCostUsd)
       .toBe(standard.snapshot().estimatedCostUsd);
   });
+
+  it("records the requested thinking mode into the snapshot (#772 audit trail)", () => {
+    const acc = new UsageAccumulator(
+      "claude-haiku-4-5",
+      ServiceTier.STANDARD,
+      [{ id: "thinking", value: "true" }],
+      ThinkingMode.ENABLED,
+    );
+    acc.addTurn({ inputTokens: 10, outputTokens: 5 });
+    const snap = acc.snapshot();
+    expect(snap.requestedThinkingMode).toBe(ThinkingMode.ENABLED);
+    expect(snap.requestedModelParams).toBe('[{"id":"thinking","value":"true"}]');
+  });
+
+  it("thinking never changes the estimate — per-token price-neutral (#772)", () => {
+    // Ledger-verified 2026-08-15: thinking wire ids bill exactly base
+    // per-token rates; the extra cost of thinking is more output tokens,
+    // which the accumulator already counts as they arrive.
+    const turn = { inputTokens: 1_000_000, outputTokens: 1_000_000 };
+
+    const disabled = new UsageAccumulator(
+      "composer-2.5", ServiceTier.STANDARD, [], ThinkingMode.DISABLED,
+    );
+    disabled.addTurn(turn);
+    const enabled = new UsageAccumulator(
+      "composer-2.5", ServiceTier.STANDARD, [], ThinkingMode.ENABLED,
+    );
+    enabled.addTurn(turn);
+
+    expect(enabled.snapshot().estimatedCostUsd)
+      .toBe(disabled.snapshot().estimatedCostUsd);
+  });
 });

package/src/activities/execute-cursor/cursor-mcp-config.ts

@@ -0,0 +1,107 @@
+/**
+ * The Cursor harness's MCP output adapter: maps the shared resolver's
+ * {@link ResolvedMcpServer} servers into the Cursor SDK's mcpServers config
+ * for Agent.create(), plus the harness's env pre-flight check.
+ *
+ * Resolution itself lives in shared/mcp-resolver.ts (oss#387 consolidated the
+ * near-duplicate resolver this file used to carry) — this module is the
+ * symmetric twin of the deep-agent harness's toMcpClientConfig in
+ * shared/mcp-manager.ts: both consume the identical intermediate, only the
+ * final SDK serialization differs.
+ */
+
+import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { ResolvedMcpServer } from "../../shared/mcp-resolver.js";
+
+/**
+ * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
+ * Defined here to avoid tight coupling to the SDK's internal types.
+ */
+export type CursorMcpServerConfig =
+  | {
+      type?: "stdio";
+      command: string;
+      args?: string[];
+      env?: Record<string, string>;
+      cwd?: string;
+    }
+  | {
+      type?: "http" | "sse";
+      url: string;
+      headers?: Record<string, string>;
+    };
+
+/**
+ * Transform resolved MCP servers into the Cursor SDK's mcpServers config
+ * for Agent.create().
+ *
+ * Call it ONCE, after the last mutation of the resolved-server list (backfill,
+ * synthesized-attachment injection): the config is a projection of that list,
+ * and building it early just creates a stale copy someone must remember to
+ * rebuild. The Cursor SDK config cannot hide tools, so enabledTools is NOT
+ * expressed here — the HITL hook enforces it (see ResolvedMcpServer.enabledTools).
+ */
+export function toCursorMcpConfig(
+  servers: ResolvedMcpServer[],
+): Record<string, CursorMcpServerConfig> {
+  const result: Record<string, CursorMcpServerConfig> = {};
+
+  for (const server of servers) {
+    if (server.connectionType === "stdio") {
+      if (!server.command) continue;
+      result[server.slug] = {
+        type: "stdio",
+        command: server.command,
+        args: server.args,
+        env: server.env,
+        cwd: server.cwd,
+      };
+    } else {
+      if (!server.url) continue;
+      result[server.slug] = {
+        type: server.connectionType,
+        url: server.url,
+        headers: server.headers,
+      };
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Validate that resolved MCP servers have their required env vars populated.
+ * Returns a list of warnings for servers with empty/missing env.
+ * Used as a pre-flight check before agent.send() to surface config issues early.
+ */
+export function validateMcpServerEnv(
+  servers: ResolvedMcpServer[],
+  usages: McpServerUsage[],
+): string[] {
+  const warnings: string[] = [];
+
+  for (const usage of usages) {
+    const slug = usage.mcpServerRef?.slug;
+    if (!slug) continue;
+
+    const resolved = servers.find((s) => s.slug === slug);
+    if (!resolved) {
+      warnings.push(`MCP server '${slug}': failed to resolve (server may not exist or is inaccessible)`);
+      continue;
+    }
+
+    if (resolved.connectionType === "stdio" && resolved.env) {
+      const emptyKeys = Object.entries(resolved.env)
+        .filter(([, v]) => !v)
+        .map(([k]) => k);
+      if (emptyKeys.length > 0) {
+        warnings.push(
+          `MCP server '${slug}': env vars [${emptyKeys.join(", ")}] are empty — ` +
+          `server subprocess will likely fail to connect`,
+        );
+      }
+    }
+  }
+
+  return warnings;
+}

package/src/activities/execute-cursor/error-classifier.ts

@@ -21,6 +21,7 @@
  */
 
 import type { CapturedRejection } from "./rejection-capture.js";
+import { PLATFORM_CAPACITY_SENTINEL } from "../../shared/model-error.js";
 
 export type ErrorCategory =
   | "auth"
@@ -212,6 +213,15 @@ interface SynthesizeErrorOpts {
   durationMs?: number;
   /** Number of messages received from the stream (0 = no response at all). */
   messageCount?: number;
+  /**
+   * True when the execution key is platform-managed (the run rides the
+   * Stigmer proxy). Enables the D4 attribution of the platform provider
+   * error contract (see shared/model-error.ts): billing errors on a
+   * platform key must never tell the customer to fix an account they do
+   * not own. BYO-key runs leave this false — there the raw Cursor message
+   * IS the actionable one (it is the user's own account).
+   */
+  proxyMode?: boolean;
 }
 
 /**
@@ -244,7 +254,38 @@ export function synthesizeError(opts: SynthesizeErrorOpts): ClassifiedError {
     return { ...classified, category: "agent-stale", retryable: true };
   }
 
-  return classified;
+  return attributePlatformBilling(classified, opts.proxyMode === true);
+}
+
+/**
+ * D4 attribution (platform provider error contract, Cursor surface): a
+ * billing error on a platform-managed key is the PLATFORM's fault — the
+ * customer's org credits are fine, and Cursor's raw prose ("reach out to
+ * an admin to enable on-demand usage") points at a Cursor dashboard they
+ * do not own. Reword with platform attribution, quoting the original so
+ * Cursor's limit-reset date survives.
+ *
+ * <p>Two cases pass through untouched: messages already carrying the
+ * sentinel (the proxy's end-stream rewrite landed — this is the runner-side
+ * fallback for the message-bearing in-stream error path the proxy relays
+ * verbatim), and BYO-key runs (the raw message is about the user's own
+ * account and must never be hidden).
+ */
+function attributePlatformBilling(
+  classified: ClassifiedError,
+  proxyMode: boolean,
+): ClassifiedError {
+  if (classified.category !== "billing" || !proxyMode) return classified;
+  if (classified.message.includes(PLATFORM_CAPACITY_SENTINEL)) return classified;
+  return {
+    ...classified,
+    message:
+      `The Stigmer platform's Cursor capacity is temporarily exhausted. ` +
+      `This is a platform-side issue - your organization's credits were not ` +
+      `charged for this call. Ask your platform operator to restock Cursor ` +
+      `execution keys. Provider message: "${classified.message}" ` +
+      `[code: ${PLATFORM_CAPACITY_SENTINEL}]`,
+  };
 }
 
 /**