@stigmer/runner 3.15.0 → 3.15.2-dev.20260913223433

package/dist/activities/execute-deep-agent/setup.js

@@ -1,767 +0,0 @@
-/**
- * Execution setup pipeline for the deep agent activity.
- *
- * Hydrates the execution from the database, resolves the full resource
- * chain (session -> agentInstance -> agent), provisions workspace, loads
- * MCP servers / environment, creates the LangGraph agent graph with the
- * full middleware stack, and returns a SetupResult containing everything
- * the streaming phase needs.
- */
-import { createDeepAgent } from "deepagents";
-import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
-import { createCheckpointer } from "../../shared/checkpointer/factory.js";
-import { readContextBridge } from "../../shared/context-bridge.js";
-import { readConversationCatchup } from "../../shared/conversation-catchup.js";
-import { readSenderIdentity } from "../../shared/sender-identity.js";
-import { injectCallerIdentityEnv, resolveCallerIdentity, } from "../../shared/caller-identity.js";
-import { readSessionContext } from "../../shared/session-context.js";
-import { readDeclaredPreferences } from "../../shared/declared-preferences.js";
-import { selectRecalledFacts } from "../../shared/memory-retrieval.js";
-import { connectMcpServers } from "../../shared/mcp-manager.js";
-import { mergeMcpServerUsages, resolveMcpServers } from "../../shared/mcp-resolver.js";
-import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
-import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
-import { discoverChannelMessaging, formatChannelTemplatesSection, synthesizeChannelAttachment, } from "../../shared/channel-attachment.js";
-import { readChannelConversationId, synthesizeConversationAttachment, } from "../../shared/conversation-attachment.js";
-import { memoryCaptureEnabled, synthesizeMemoryAttachment, } from "../../shared/memory-attachment.js";
-import { injectSynthesizedAttachment } from "../../shared/synthesized-attachment.js";
-import { shouldConnectMcp } from "./mcp-gate.js";
-import { WorkspaceProvisioner } from "../../shared/workspace/provisioner.js";
-import { LocalWorkspaceBackend } from "../../shared/workspace/local-backend.js";
-import { createCasCaptureBackend } from "./cas-capture-backend.js";
-import { buildShellEnv } from "./shell-env.js";
-import { buildPlanModePermissions } from "../../shared/plan-mode-permissions.js";
-import { CasCaptureObserver } from "./cas-capture-observer.js";
-import { isGitWorkTree, isPathCapturable } from "../../shared/filereview/git-substrate.js";
-import { deriveCaptureMode } from "../../shared/filereview/capture.js";
-import { resolveWorkspacePath } from "../../shared/file-change.js";
-import { ensurePlatformDir, ensureCheckpointDbPath } from "../../shared/workspace/platform-dir.js";
-import { resolveSessionWorkspaceRoot } from "../../shared/workspace/session-root.js";
-import { reportSetupProgress } from "../../shared/status.js";
-import { resolveEnvironment } from "./environment.js";
-import { buildEnhancedSystemPrompt, composeUserMessage } from "./prompt-builder.js";
-import { buildMiddlewareStack } from "../../middleware/index.js";
-import { createThinkTool, createWebFetchTool, resolveGuardPosture } from "../../tools/index.js";
-import { deriveExecutionFingerprintKey } from "../../shared/approval-fingerprint.js";
-import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
-import { getModelPricing, ensureLoaded as ensurePricingLoaded } from "../../shared/model-pricing.js";
-import { getDefaultModel, getModelVisionCapability } from "../../shared/model-registry.js";
-import { buildChatModel } from "../../shared/model-client.js";
-import { resolveEffectiveServiceTier } from "../../shared/service-tier.js";
-import { loadArtifactStorageConfig, resolveUsableArtifactStorage, } from "../../shared/artifact-storage.js";
-import { mergeApprovalPolicies, deriveActiveLeases, isUnattendedApprovalMode, } from "../../shared/approval-policy.js";
-import { mergeSkillRefs, fetchSkillsByRefs, mountSkills, generatePromptSection, generateAlsoAvailableSection, } from "../../shared/skill-writer.js";
-import { filterSkills, SKILL_COUNT_THRESHOLD } from "../../shared/skill-relevance.js";
-import { injectAttachments } from "./attachment-injector.js";
-import { DEEP_AGENT_VISION_PROFILE, VisionBudget, toLangChainImageBlocks, } from "../../shared/attachment-vision.js";
-import { transformAndCompileSubagents } from "./subagent-transformer.js";
-import { resolveRecursionLimit, UNBOUNDED_ADVISORY_RECURSION_LIMIT, } from "../../shared/tool-rounds.js";
-/**
- * Execute all setup phases and return resources for the streaming phase.
- *
- * On failure, partial resources (MCP connections, workspace backend) are
- * cleaned up internally before re-throwing.
- */
-export async function performSetup(deps) {
-    const { config, client, executionId, threadId } = deps;
-    let mcpConnection = null;
-    // Cold-start timeline of this setup (warm-agent-surfaces Phase 0): one mark
-    // after each phase, emitted as a single structured log line before return.
-    const timing = new TimingRecorder();
-    try {
-        // Step 1: Hydrate execution
-        await reportSetupProgress(client, executionId, "Fetching execution…");
-        const execution = await client.getExecution(executionId);
-        console.log(`[setup] Execution fetched: agent_id=${execution.spec?.agentId}`);
-        timing.mark("fetch_execution");
-        // Step 2: Resolve chain — execution → session → agentInstance → agent
-        await reportSetupProgress(client, executionId, "Resolving agent…");
-        const sessionId = execution.spec.sessionId;
-        if (!sessionId) {
-            throw new Error(`Session ID is required for execution ${executionId}. ` +
-                "Execution must have a valid session_id.");
-        }
-        const session = await client.getSession(sessionId);
-        const agentInstance = await client.getAgentInstance(session.spec.agentInstanceId);
-        const agent = await client.getAgent(agentInstance.spec.agentId);
-        const instructions = agent.spec.instructions || "You are a helpful AI assistant.";
-        console.log(`[setup] Chain resolved: session=${sessionId}, ` +
-            `agent=${agent.metadata.name}`);
-        timing.mark("resolve_chain");
-        // Step 3: Resolve model
-        const modelName = execution.spec.executionConfig?.modelName
-            || await getDefaultModel();
-        // Step 4: Create checkpointer. The durable local (sqlite) backend keys its
-        // file per session — a session has exactly one thread (`thread-{sessionId}`),
-        // so checkpoint lifetime tracks session lifetime. The saver is closed in the
-        // activity cleanup (see index.ts), alongside the MCP connection.
-        const checkpointer = await createCheckpointer({
-            type: config.checkpointerType,
-            proxyEndpoint: config.checkpointerProxyEndpoint ?? undefined,
-            authToken: config.stigmerToken ?? undefined,
-            sqlitePath: config.checkpointerType === "sqlite"
-                ? await ensureCheckpointDbPath(sessionId)
-                : undefined,
-        });
-        timing.mark("create_checkpointer");
-        // Step 5: Resolve environment
-        await reportSetupProgress(client, executionId, "Resolving environment…");
-        const envResult = await resolveEnvironment(client, executionId);
-        timing.mark("resolve_environment");
-        // Step 6: Resolve a usable artifact store (shared with the Cursor harness so
-        // both degrade identically). Returns `undefined` — never throws — when there
-        // is no working substrate: a proxy misconfig OR an unwritable local path
-        // (which `createArtifactStorage` cannot detect, since it just holds a path).
-        // An absent store flips capture mode off (deny-gate fallback below) and
-        // disables offload, instead of flowing writes then crashing at the boundary.
-        const artifactStorage = await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
-        timing.mark("resolve_artifact_storage");
-        // Step 7: Provision workspace
-        await reportSetupProgress(client, executionId, "Initializing workspace…");
-        const { workspaceBackend, provisionResults } = await provisionWorkspace(config, session, envResult.mergedEnvVars, sessionId);
-        timing.mark("provision_workspace");
-        // Apply-then-review is the file-review model whenever there is a capture
-        // SUBSTRATE (DD-21 D2, Slice 2b): file edits flow during the turn and are
-        // reviewed post-hoc as a captured `FileChangeSet` (reconciled byte-exactly on
-        // resume), never gated before they run. The substrate is selected by
-        // `gitWorkspace`:
-        //   - a git work tree diffs a pinned baseline -> candidate tree (git-substrate,
-        //     needs no artifact storage), and routes its .gitignored edits into the
-        //     path-scoped CAS observer;
-        //   - a non-git workspace has no git snapshot at all, so EVERY touched path is
-        //     captured into the content-addressed CAS manifest (cas-substrate), which
-        //     needs artifact storage to persist blobs.
-        // So a non-git workspace with NO artifact storage has no substrate: capture
-        // degrades to the deny-gate (file writes gated pre-execution), exactly like the
-        // Cursor harness (DD-22). `deriveCaptureMode` is the shared decision so both
-        // harnesses degrade identically. When capture is on, the deny-gate survives only
-        // for shell/MCP/irreversible tools.
-        const gitWorkspace = await isGitWorkTree(workspaceBackend.rootDir);
-        const captureMode = deriveCaptureMode(workspaceBackend.rootDir, gitWorkspace, !!artifactStorage);
-        // Git-tracked capturability, consulted by the gate to route a file write to
-        // disk-and-git-diff (tracked) vs into CAS (ignored). Only meaningful in a git
-        // work tree. In a non-git workspace nothing is "git-capturable" (there is no
-        // snapshot), so this resolves false for every path and the gate routes all
-        // file writes through its captureIgnored (CAS) arm.
-        const isCapturablePath = gitWorkspace
-            ? (rawPath) => isPathCapturable(workspaceBackend.rootDir, resolveWorkspacePath(rawPath, workspaceBackend.rootDir, true).path)
-            : (_rawPath) => Promise.resolve(false);
-        // CAS capture (design docs 08/11/12): the content-addressed half of
-        // apply-then-review. The single per-turn observer owns the before-bytes of
-        // first-touched CAS-owned paths AND the secret-blocked paths, keyed
-        // workspace-root-relative so they align with the CAS reconcile's
-        // `join(workspaceRoot, path)`. It is shared by the parent AND every sub-agent
-        // CAS backend, giving race-free first-touch-wins across concurrent graphs.
-        // Its ownership predicate is memoized, so `git check-ignore` runs at most once
-        // per distinct path.
-        const casObserver = new CasCaptureObserver({
-            rootDir: workspaceBackend.rootDir,
-            // Which touched paths the observer owns (records pre-turn bytes for). In a
-            // git work tree that is the .gitignored set only — git captures the tracked
-            // ones. In a non-git workspace there is no git substrate, so the observer
-            // owns EVERY touched path; the CAS manifest is the sole capture surface.
-            isIgnored: gitWorkspace
-                ? async (relPath) => !(await isPathCapturable(workspaceBackend.rootDir, relPath))
-                : async () => true,
-        });
-        // Step 7: Resolve and connect MCP servers. Session-wins-per-slug merge
-        // (the Cursor harness's blueprint semantics, shared so a duplicate slug
-        // resolves identically in both harnesses — one usage per server, whose
-        // enabled_tools is the one the connect-time filter honors).
-        const mcpServerUsages = mergeMcpServerUsages(agent.spec.mcpServerUsages || [], session.spec.mcpServerUsages || []);
-        // The synthesized attachments' credential story (DD-006 D4): the
-        // exchanged token authenticates the discovery reads per-call (the
-        // messaging reach refuses a desktop runner's ambient embedded_runner
-        // credential; undefined lets the ambient credential apply). The
-        // attachment header falls back to the ambient credential. Unlike the
-        // env read (which hard-fails on a broken exchange — secrets are
-        // load-bearing there), this exchange is opportunistic: every consumer
-        // below degrades to an empty answer by contract, and the server
-        // refuses the ambient fallback safely, so a failed exchange must not
-        // kill the run.
-        let exchangedRunnerToken;
-        try {
-            exchangedRunnerToken =
-                await client.acquireScopedRunnerToken({ agentExecutionId: executionId });
-        }
-        catch (err) {
-            console.warn("[execute-deep-agent] Scoped-token exchange failed for attachment/discovery " +
-                `reads; degrading to the ambient credential: ${err instanceof Error ? err.message : err}`);
-        }
-        const attachmentCredential = exchangedRunnerToken
-            ?? config.stigmerTokenRef?.current
-            ?? config.stigmerToken;
-        // The channel discovery read runs BEFORE the MCP gate below: an
-        // agent whose ONLY tool source is a proactive channel would
-        // otherwise never enter MCP resolution and never connect the
-        // attachment (DD-006 D7). Every failure mode degrades to an empty
-        // answer — no tool, no section, execution unharmed.
-        const channelMessaging = await discoverChannelMessaging(client, exchangedRunnerToken);
-        // The conversation-attachment decision (DD-008 D-c): the channel-id
-        // session label, stamped server-side on every channel session — a
-        // free, synchronous read, so no hoisted discovery needed.
-        const conversationChannelId = readChannelConversationId(session.metadata?.labels);
-        // The memory-attachment decision (DD-005 D1): the recall snapshot's
-        // enabled bit, stamped server-side at execution create — like the
-        // conversation attachment, a free, synchronous spec read.
-        const captureMemories = memoryCaptureEnabled(execution.spec?.recalledMemories);
-        let resolvedMcpServers = null;
-        if (shouldConnectMcp({
-            mcpServerUsageCount: mcpServerUsages.length,
-            channelMessagingCount: channelMessaging.length,
-            conversationChannelId,
-            memoryCaptureEnabled: captureMemories,
-        })) {
-            await reportSetupProgress(client, executionId, "Connecting tools…");
-            const transportPosture = resolveMcpTransportPosture(config.mode);
-            // The MCP-bound env map (and ONLY it) carries the reserved
-            // caller-identity keys — mirror of the Cursor harness's Phase 4
-            // injection; filterEnvToDeclaredKeys keeps undeclared servers blind.
-            const mcpEnvVars = injectCallerIdentityEnv(envResult.mergedEnvVars, resolveCallerIdentity(session.spec.metadata, session.status?.audit?.specAudit?.createdBy), sessionId);
-            resolvedMcpServers = await resolveMcpServers(client, mcpServerUsages, mcpEnvVars, transportPosture);
-            timing.mark("resolve_mcp_servers");
-            const sessionOrg = session.metadata?.org ?? "";
-            let backfilledServers = await backfillMcpServersIfNeeded(client, resolvedMcpServers.resolvedServers, mcpServerUsages, mcpEnvVars, sessionOrg, transportPosture, undefined, envResult.secretKeys);
-            // The channel messaging attachment (DD-006 D7/D8) — injected AFTER
-            // resolve + backfill so the destructiveHint tightener can never gate
-            // it; empty approval maps keep it approval-free by construction.
-            if (channelMessaging.length > 0) {
-                const attachment = synthesizeChannelAttachment(channelMessaging, {
-                    bridgeEndpoint: config.mcpBridgeEndpoint,
-                    credential: attachmentCredential,
-                    backendEndpoint: config.stigmerBackendEndpoint,
-                });
-                if (attachment) {
-                    backfilledServers = injectSynthesizedAttachment(backfilledServers, attachment, "channel messaging");
-                }
-            }
-            // The conversation participation attachment (DD-008 D-c) — the
-            // channel attachment's sibling, same after-backfill rule. HTTP-only:
-            // synthesize answers undefined with no bridge endpoint by design (see
-            // shared/conversation-attachment.ts).
-            const conversationAttachment = synthesizeConversationAttachment(conversationChannelId, {
-                bridgeEndpoint: config.mcpBridgeEndpoint,
-                credential: attachmentCredential,
-                backendEndpoint: config.stigmerBackendEndpoint,
-            });
-            if (conversationAttachment) {
-                backfilledServers = injectSynthesizedAttachment(backfilledServers, conversationAttachment, "conversation participation");
-            }
-            // The memory capture attachment (DD-005 D1) — same after-backfill
-            // rule. The capture context is attribution the server verifies or
-            // trusts per edition (Stage 3 provenance decision); the subject is
-            // never threaded — it derives from the credential.
-            if (captureMemories) {
-                const memoryAttachment = synthesizeMemoryAttachment(execution.spec?.recalledMemories, {
-                    org: session.metadata?.org ?? "",
-                    agentId: agent.metadata?.id ?? "",
-                    sessionId,
-                    agentExecutionId: executionId,
-                }, {
-                    bridgeEndpoint: config.mcpBridgeEndpoint,
-                    credential: attachmentCredential,
-                    backendEndpoint: config.stigmerBackendEndpoint,
-                });
-                if (memoryAttachment) {
-                    backfilledServers = injectSynthesizedAttachment(backfilledServers, memoryAttachment, "memory capture");
-                }
-            }
-            resolvedMcpServers = { resolvedServers: backfilledServers };
-            timing.mark("backfill_mcp");
-            // connect_mcp covers the whole fan-out: stdio servers spawn npx/uvx
-            // subprocesses here, so on-demand package installs land in this span.
-            mcpConnection = await connectMcpServers(resolvedMcpServers.resolvedServers);
-            timing.mark("connect_mcp");
-        }
-        // Step 7b: Resolve and write skills
-        const skillRefs = mergeSkillRefs(agent.spec.skillRefs || [], session.spec.skillRefs || []);
-        let skillsPromptSection = "";
-        if (skillRefs.length > 0) {
-            await reportSetupProgress(client, executionId, "Loading skills…");
-            const skills = await fetchSkillsByRefs(client, skillRefs);
-            if (skills.length > 0) {
-                // platformDir is an invariant of this path: provisionWorkspace below
-                // threads ensurePlatformDir into every backend it constructs.
-                const { paths: skillPaths } = await mountSkills(client, skills, workspaceBackend.platformDir);
-                const userMessage = execution.spec.message || "";
-                const skillNames = skills.map(s => s.spec?.name || s.metadata?.slug || "unknown");
-                const skillDescriptions = skills.map(s => s.spec?.description || "");
-                if (skills.length >= SKILL_COUNT_THRESHOLD) {
-                    const filterResult = filterSkills(userMessage, skillNames, skillDescriptions);
-                    if (filterResult.excludedNames.length > 0) {
-                        const includedSkills = filterResult.includedIndices.map(i => skills[i]);
-                        console.log(`[setup] Skill relevance filter: ${includedSkills.length} included, ` +
-                            `${filterResult.excludedNames.length} excluded: ${filterResult.excludedNames.join(", ")}`);
-                        skillsPromptSection =
-                            generatePromptSection(includedSkills, skillPaths) +
-                                generateAlsoAvailableSection(filterResult.excludedNames);
-                    }
-                    else {
-                        skillsPromptSection = generatePromptSection(skills, skillPaths);
-                    }
-                }
-                else {
-                    skillsPromptSection = generatePromptSection(skills, skillPaths);
-                }
-                console.log(`[setup] Skills loaded: ${skills.length} total, prompt section ${skillsPromptSection.length} chars`);
-            }
-            timing.mark("resolve_skills");
-        }
-        // Step 7c: Inject attachments. The vision budget rides along so image
-        // attachments are selected for inline delivery while their bytes are
-        // already in hand (attachment-vision.ts owns all policy). The budget
-        // also carries the root model's registry vision capability — the root
-        // model is the only one that ever receives inline image blocks
-        // (sub-agents get a fresh task description, summarization reuses this
-        // same model instance) — so a model flagged `vision: false` degrades
-        // images honestly instead of shipping a payload its provider rejects.
-        const attachments = execution.spec.attachments || [];
-        const visionBudget = new VisionBudget(DEEP_AGENT_VISION_PROFILE, {
-            modelVision: await getModelVisionCapability(modelName),
-        });
-        const injectedFiles = await injectAttachments({
-            backend: workspaceBackend,
-            attachments,
-            storage: artifactStorage,
-            isLocalMode: config.mode === "local",
-            visionBudget,
-        });
-        // Vision facts, derived once from the single injection result: the images
-        // the model will see inline (in attachment order) and the ones that
-        // degraded to path-only, disclosed in the system prompt's Input Files
-        // section.
-        const visionImages = injectedFiles.flatMap((f) => (f.vision ? [f.vision] : []));
-        const visionNotViewable = injectedFiles.flatMap((f) => f.visionDegraded ? [{ path: f.path, reason: f.visionDegraded }] : []);
-        const visionPromptInfo = visionImages.length > 0 || visionNotViewable.length > 0
-            ? {
-                inlineFilenames: visionImages.map((v) => v.filename),
-                notViewable: visionNotViewable,
-            }
-            : undefined;
-        if (visionPromptInfo) {
-            console.log(`[attachment-vision] execution=${executionId} inline=${visionImages.length} ` +
-                `(${visionImages.reduce((n, v) => n + v.byteSize, 0)} bytes) ` +
-                `degraded=${JSON.stringify(visionNotViewable.map((d) => `${d.path}:${d.reason}`))}`);
-        }
-        timing.mark("inject_attachments");
-        // Step 8: Build enhanced system prompt.
-        //
-        // Recalled memories go through the semantic retriever (DD-008), not the
-        // raw snapshot read: above the activation threshold it selects the
-        // top-k facts for THIS turn's message (one batched embeddings call);
-        // otherwise — and on any failure — it injects the full candidate set,
-        // exactly the Phase 2 behavior. A re-invocation of this execution
-        // (approval resume) replays the outcome recorded on the execution's
-        // status instead of re-selecting, so the prompt never shifts
-        // mid-execution. The report returned here is stamped onto the turn's
-        // status by the activity (index.ts) — setup has no status object yet.
-        const memorySelection = await selectRecalledFacts(execution.spec.recalledMemories, execution.spec.message, {
-            proxyEndpoint: config.proxyEndpoint,
-            stigmerToken: config.stigmerToken,
-            executionId,
-            priorReport: execution.status?.recalledMemoriesReport,
-        });
-        const systemPrompt = buildEnhancedSystemPrompt({
-            instructions,
-            provisionResults,
-            containerRoot: workspaceBackend.rootDir,
-            skillsPromptSection,
-            // "" (nothing sendable) threads as undefined: the tool alone still
-            // serves text sends inside a 24-hour window (DD-006 D6).
-            channelTemplatesPromptSection: channelMessaging.length > 0
-                ? formatChannelTemplatesSection(channelMessaging) || undefined
-                : undefined,
-            workspaceFileRefs: execution.spec.workspaceFileRefs || [],
-            workspaceRoot: workspaceBackend.rootDir,
-            injectedFiles,
-            vision: visionPromptInfo,
-            downloadUrlKind: artifactStorage?.downloadUrlKind,
-            interactionMode: execution.spec.executionConfig?.interactionMode,
-            buildFromPlan: execution.spec.executionConfig?.buildFromPlan,
-            contextBridge: readContextBridge(session.spec.metadata),
-            senderIdentity: readSenderIdentity(session.spec.metadata),
-            sessionContext: readSessionContext(session.spec.metadata),
-            declaredPreferences: readDeclaredPreferences(execution.spec.declaredPreferences),
-            recalledMemories: memorySelection.content,
-        });
-        // Step 9: Construct the LLM model. Resolution to the provider API id
-        // happens inside buildChatModel; modelName stays the registry id for
-        // pricing, the native-thinking heuristic, and sub-agent inheritance.
-        // The operator's STIGMER_LLM_REQUEST_TIMEOUT_MS bound is applied inside
-        // buildChatModel (#468) — the sub-agent modelFactory below silently
-        // dropped it when each caller parsed the env itself.
-        //
-        // The service tier resolves ONCE here (UNSPECIFIED → explicit
-        // STANDARD, shared/service-tier.ts) and rides every model this
-        // execution constructs — the primary below AND the sub-agent factory —
-        // so the provider account's default can never pick the price of any
-        // turn (#361, the native half of #357's contract). Sub-agents inherit
-        // it because the tier is an attribute of the EXECUTION's bill, and
-        // sub-agent calls land on the same ledger.
-        const serviceTier = resolveEffectiveServiceTier(execution.spec.executionConfig?.serviceTier);
-        const { model } = await buildChatModel({
-            modelName,
-            proxyEndpoint: config.proxyEndpoint ?? undefined,
-            stigmerToken: config.stigmerToken ?? undefined,
-            headerScope: { executionId },
-            serviceTier,
-        });
-        timing.mark("build_model");
-        // Step 10: Build middleware stack
-        await ensurePricingLoaded();
-        const pricing = getModelPricing(modelName);
-        const execConfig = execution.spec.executionConfig;
-        const isPlanMode = execConfig?.interactionMode === InteractionMode.PLAN;
-        const shellEnv = isPlanMode ? undefined : buildShellEnv(envResult.mergedEnvVars);
-        // Plan mode's filesystem permission rules, hoisted once: the parent graph
-        // and every sub-agent graph carry this single value. The rules are the
-        // write-deny half of plan mode only — the read boundary is structural
-        // (virtual-rooted backends, issue #754), and the path-normalization shim
-        // is no longer tied to the rules: every native graph installs it (see
-        // buildMiddlewareStack below) so the whole harness speaks one dialect.
-        const planModePermissions = isPlanMode ? buildPlanModePermissions() : undefined;
-        const toolServerMap = new Map();
-        if (mcpConnection) {
-            for (const [serverName, serverTools] of Object.entries(mcpConnection.serverToolMap)) {
-                for (const t of serverTools) {
-                    toolServerMap.set(t.name, serverName);
-                }
-            }
-        }
-        // Step 10b: Resolve approval policies + leases.
-        //
-        // Two distinct bypasses (see ActiveLeases): the pre-armed
-        // spec.auto_approve_all is the one whole-run global bypass; an interactive
-        // APPROVE_ALL grants a run-lifetime lease scoped to that action's class (its
-        // built-in category, or its MCP server). Server leases shape the policy map
-        // (leased servers dropped); built-in category leases are applied inside the
-        // gate. Both flow into sub-agents via the shared config below.
-        const leases = deriveActiveLeases(execution);
-        const globalBypass = leases.global;
-        // Layer-3 overrides ride each resolved server from its (session-wins
-        // merged) usage — see ResolvedMcpServer.toolApprovalOverrides (issue
-        // #349) — so there is no separate override input to pass here.
-        const approvalPolicies = mergeApprovalPolicies(resolvedMcpServers?.resolvedServers ?? [], leases);
-        // Unattended approval mode (DD-014): approver-less surfaces (channels,
-        // guest shares) stamp APPROVAL_MODE_UNATTENDED, and the gate resolves
-        // gated tools as automatic skips instead of interrupting. The registry is
-        // the gate→reconciler channel for the skipped tool-call ids; one instance
-        // is shared with sub-agent gates via the inherited config.
-        const unattended = isUnattendedApprovalMode(execution);
-        const unattendedSkips = new Set();
-        // The approval gate config is the single source of truth for HITL gating,
-        // built once and inherited verbatim by sub-agents (so a mutating tool inside
-        // a sub-agent is gated identically to one in the parent). Null under the
-        // global pre-arm, where the gate is inert; under scoped leases the gate stays
-        // active and clears only leased categories. The per-execution fingerprint key
-        // (runner master secret + execution_id) drives the shadow ExecutionReceipt.
-        const approvalGateConfig = !globalBypass
-            ? {
-                policies: approvalPolicies,
-                leasedCategories: leases.categories,
-                toolServerMap,
-                fingerprintKey: deriveExecutionFingerprintKey(getRunnerHitlMasterSecret(), executionId),
-                executionId,
-                // Capture mode: file edits flow and are reviewed post-hoc. In a git work
-                // tree, git-tracked edits flow to the git diff and .gitignored edits flow
-                // into CAS (captureIgnored) on THIS parent gate; in a non-git workspace
-                // isCapturablePath is always false, so ALL file writes take the CAS arm.
-                // Secret-like paths are hard-blocked (DD-E) and recorded for a
-                // DIFF_UNREVIEWABLE entry. shell/MCP stay gated. Sub-agents inherit this
-                // config; buildSubAgentMiddleware sets their captureIgnored explicitly
-                // from whether a CAS observer backs the sub-agent (Session 26, DD-19),
-                // so their captured edits flow into the SAME observer.
-                //
-                // When captureMode is false (no substrate — non-git + no storage),
-                // fileCaptureMode is false so file writes take the plain deny-gate. The
-                // CAS arm additionally requires storage: captureIgnored gates gitignored
-                // writes onto CAS only when a store exists to persist their blobs (the
-                // git+no-storage case), matching the Cursor harness's
-                // `captureMode && !!artifactStorage`.
-                fileCaptureMode: captureMode,
-                isCapturablePath,
-                captureIgnored: captureMode && !!artifactStorage,
-                recordBlockedSecret: (rawPath) => casObserver.recordBlockedSecret(rawPath),
-                // Pre-delete byte capture (issue #303): deepagents has no backend
-                // delete method for the CAS backend to observe, so a flowing delete's
-                // before-bytes are recorded by the gate at authorization time, through
-                // the SAME shared observer — the turn boundary then reads after=null
-                // and authors a reviewable, restorable DELETE. recordBefore's own
-                // ownership predicate (gitignored-only in a git tree, everything in
-                // non-git) agrees with the gate's not-capturable condition.
-                captureDeleteBefore: (rawPath) => casObserver.recordBefore(rawPath),
-                unattended,
-                unattendedSkips,
-            }
-            : null;
-        const maxCostUsd = execConfig?.maxCostUsd ?? 0;
-        // max_tool_rounds → recursion limit (proto contract: 0/unset = unlimited,
-        // set = clamped 10–1000 and enforced). One resolved value feeds BOTH the
-        // hard stop on the invoke config below and the budget middleware's ~80%
-        // wrap-up advisory, so the warning and the enforcement can never disagree.
-        const recursionLimit = resolveRecursionLimit(execConfig?.maxToolRounds);
-        const { middleware, gracefulStop, costCap: costCapMiddleware } = buildMiddlewareStack({
-            loopDetection: {
-                historySize: 20,
-                consecutiveThreshold: 7,
-                totalThreshold: 20,
-            },
-            executionBudget: {
-                recursionLimit: recursionLimit ?? UNBOUNDED_ADVISORY_RECURSION_LIMIT,
-                warningPct: 80,
-            },
-            toolTruncation: {
-                maxChars: execConfig?.maxToolResultChars || 30_000,
-            },
-            costCap: maxCostUsd > 0 ? {
-                maxCostUsd,
-                inputPricePerMillion: pricing.inputPricePerMillion,
-                outputPricePerMillion: pricing.outputPricePerMillion,
-                cacheReadPricePerMillion: pricing.cacheReadPricePerMillion,
-                warningPct: 80,
-            } : null,
-            otelSpans: { toolServerMap },
-            approvalGate: approvalGateConfig,
-            // Every graph, every mode (issue #754): the dialect-repair seam that
-            // keeps model-supplied paths canonical for the virtual-rooted backend
-            // and every downstream consumer (gate, capture, spans).
-            pathNormalization: { rootDir: workspaceBackend.rootDir },
-        });
-        timing.mark("build_middleware");
-        // Step 11: Build tools list (MCP tools + native built-in tools).
-        //
-        // web_fetch is always-on for every native run — the same posture as the
-        // Cursor harness, whose WebFetch is a CLI built-in that no configuration
-        // removes (issue #214 parity). It is auto-approved by design (see
-        // toolApprovalCategory in shared/tool-kind.ts), so its URL guard posture
-        // — strict on managed cloud runners, relaxed on user-owned machines — is
-        // the entire safety boundary. Derived from config.mode, NOT the
-        // cloudModeEnabled Cursor feature flag.
-        const webFetchPosture = resolveGuardPosture(config.mode);
-        const tools = [
-            ...(mcpConnection?.tools ?? []),
-            createThinkTool(),
-            createWebFetchTool({ posture: webFetchPosture }),
-        ];
-        // Step 11b: Transform and compile subagents
-        const subAgentProtos = agent.spec.subAgents || [];
-        let compiledSubagents;
-        if (subAgentProtos.length > 0 || workspaceBackend.rootDir) {
-            await reportSetupProgress(client, executionId, "Configuring sub-agents…");
-            const parentMcpServerToolMap = new Map();
-            if (mcpConnection) {
-                for (const [serverName, serverTools] of Object.entries(mcpConnection.serverToolMap)) {
-                    parentMcpServerToolMap.set(serverName, serverTools);
-                }
-            }
-            compiledSubagents = await transformAndCompileSubagents({
-                subAgents: subAgentProtos,
-                parentMcpTools: mcpConnection?.tools ?? [],
-                parentMcpServerToolMap,
-                parentMcpUsages: mcpServerUsages,
-                skillClient: client,
-                workspaceBackend,
-                approvalGate: approvalGateConfig,
-                // Capture is universal (Slice 2b), so every sub-agent gets a CAS-observing
-                // backend wired to the SAME per-turn observer as the parent — their
-                // captured writes (.gitignored in a git tree, all touched paths in a
-                // non-git one) compose into the parent's change set (Session 26, DD-19).
-                casObserver,
-                parentModelName: modelName,
-                parentHasNativeThinking: _modelHasNativeThinking(modelName),
-                webFetchPosture,
-                costCap: costCapMiddleware ?? undefined,
-                modelFactory: async (m) => (await buildChatModel({
-                    modelName: m,
-                    proxyEndpoint: config.proxyEndpoint ?? undefined,
-                    stigmerToken: config.stigmerToken ?? undefined,
-                    headerScope: { executionId },
-                    // The execution's tier, inherited: sub-agent calls bill to the
-                    // same execution (#361 — see the Step 9 resolution comment).
-                    serviceTier,
-                })).model,
-                // Presence of shellEnv is the shell-capability switch for sub-agent
-                // backends too (undefined in plan mode; see buildShellEnv above).
-                shellEnv,
-                // Plan mode's deny-all-writes rule, mirrored onto every sub-agent graph
-                // (issue #255) — pre-built CompiledSubAgents never inherit the parent's
-                // permissions, so read-only-by-construction must be baked in here.
-                // compileSubagents derives each sub-agent's path-normalization shim
-                // from this same value (issue #429).
-                ...(planModePermissions ? { permissions: planModePermissions } : {}),
-            });
-            timing.mark("compile_subagents");
-        }
-        // Step 12: Create the agent graph with middleware
-        await reportSetupProgress(client, executionId, "Creating agent…");
-        const outputSchema = execution.spec.executionConfig?.structuredOutputSchema;
-        let responseFormat;
-        if (outputSchema) {
-            responseFormat = jsonSchemaToZod(outputSchema);
-        }
-        // File capture point. Apply-then-review is universal (Slice 2b), so the
-        // CAS-observing backend: git-tracked edits flow to disk (the turn-boundary
-        // git diff is authoritative), and the shared CAS observer records the pre-turn
-        // bytes of every CAS-owned path — .gitignored paths in a git work tree, all
-        // touched paths in a non-git one — so the boundary can capture them into CAS.
-        // It is gate-independent, so it holds even under the global bypass.
-        const fileBackend = await createCasCaptureBackend({
-            rootDir: workspaceBackend.rootDir,
-            observer: casObserver,
-            shellEnv,
-        });
-        const agentGraph = await createDeepAgent({
-            model,
-            checkpointer: checkpointer,
-            backend: fileBackend,
-            systemPrompt,
-            tools,
-            middleware: middleware,
-            subagents: compiledSubagents ?? undefined,
-            ...(responseFormat ? { responseFormat } : {}),
-            ...(planModePermissions ? { permissions: planModePermissions } : {}),
-        });
-        // Step 11: Prepare invocation input and config. The conversation catchup
-        // (cloud DD-006) rides the USER MESSAGE, not the system prompt — see
-        // composeUserMessage for the durability rationale (A27).
-        let userMessage = composeUserMessage(execution.spec.message, readConversationCatchup(execution.spec.conversationCatchup));
-        if (outputSchema) {
-            userMessage += `\n\n---\nIMPORTANT: When your analysis is complete, provide your findings as structured output matching the required schema. The system will capture your structured response automatically.`;
-        }
-        // With inline images the user message becomes a multimodal content-block
-        // array — image blocks (with filename labels) FIRST, the composed text
-        // last, per Anthropic's images-before-text guidance. Without images the
-        // content stays a plain string, byte-identical to the pre-vision shape.
-        // The LangGraph messages reducer coerces either form into a HumanMessage
-        // untouched (verified against the installed @langchain/langgraph).
-        const langgraphInput = {
-            messages: [
-                {
-                    role: "user",
-                    content: visionImages.length > 0
-                        ? [
-                            ...toLangChainImageBlocks(visionImages),
-                            { type: "text", text: userMessage },
-                        ]
-                        : userMessage,
-                },
-            ],
-        };
-        const langgraphConfig = {
-            configurable: { thread_id: threadId },
-            // Hard enforcement of max_tool_rounds (null = unlimited, the default):
-            // when the graph exhausts this, the streaming loop's GraphRecursionError
-            // handler terminates gracefully with work saved ("send another message
-            // to continue"). The middleware's wrap-up advisory fires at ~80% of the
-            // same value, so a healthy run finishes normally before ever hitting it.
-            ...(recursionLimit !== null ? { recursionLimit } : {}),
-        };
-        const streamVersion = process.env.LANGGRAPH_STREAM_EVENTS_VERSION === "v2" ? "v2" : "v3";
-        console.log(`[setup] Complete: model=${modelName}, ` +
-            `tools=${tools.length}, middleware=${middleware.length}, ` +
-            `thread_id=${threadId}, streamVersion=${streamVersion}`);
-        timing.mark("create_agent_graph");
-        emitTimingLog("execution_setup", {
-            execution_id: executionId,
-            session_id: sessionId,
-            harness: "native",
-            mcp_server_count: mcpServerUsages.length,
-            skill_count: skillRefs.length,
-            workspace_entry_count: session.spec.workspaceEntries?.length ?? 0,
-        }, timing);
-        return {
-            agentGraph,
-            checkpointer,
-            langgraphConfig,
-            langgraphInput,
-            execution,
-            agent,
-            session,
-            workspaceBackend,
-            mcpConnection,
-            mergedEnvVars: envResult.mergedEnvVars,
-            secretKeys: envResult.secretKeys,
-            modelName,
-            gracefulStop,
-            artifactStorage,
-            provisionResults,
-            approvalPolicies,
-            toolServerMap,
-            leasedCategories: leases.categories,
-            globalBypass,
-            unattended,
-            unattendedSkips,
-            hasStructuredOutput: !!outputSchema,
-            streamVersion,
-            casObserver,
-            captureMode,
-            gitWorkspace,
-            recalledMemoriesReport: memorySelection.report,
-        };
-    }
-    catch (err) {
-        if (mcpConnection) {
-            try {
-                await mcpConnection.client.close();
-            }
-            catch { /* swallow */ }
-        }
-        throw err;
-    }
-}
-/**
- * Provision workspace from session workspace entries.
- *
- * A session with no entries gets its own empty per-session directory (see
- * shared/workspace/session-root.ts) — never the shared root, which would
- * leak other sessions' files into it. Mirrors shared/workspace/
- * session-provision.ts `provisionSessionWorkspace` exactly; S3 of the
- * harness runtime program retires this twin in favor of that one.
- */
-async function provisionWorkspace(config, session, mergedEnvVars, sessionId) {
-    const platformDir = await ensurePlatformDir(sessionId);
-    const workspaceEntries = session.spec.workspaceEntries || [];
-    if (workspaceEntries.length === 0) {
-        const sessionRoot = await resolveSessionWorkspaceRoot(config.workspaceRootDir, workspaceEntries, sessionId);
-        return {
-            workspaceBackend: new LocalWorkspaceBackend(sessionRoot, platformDir),
-            provisionResults: [],
-        };
-    }
-    const workspaceBackend = new LocalWorkspaceBackend(config.workspaceRootDir, platformDir);
-    const provisioner = new WorkspaceProvisioner();
-    const provisionResults = await provisioner.provisionAll(workspaceEntries.map(entry => ({
-        name: entry.name,
-        source: entry.source,
-    })), workspaceBackend, mergedEnvVars, config.mode === "local", config.mode !== "local");
-    // If single entry changed root dir, create a new backend with the same platformDir
-    if (provisionResults.length === 1 &&
-        provisionResults[0].rootDir !== workspaceBackend.rootDir) {
-        return {
-            workspaceBackend: new LocalWorkspaceBackend(provisionResults[0].rootDir, platformDir),
-            provisionResults,
-        };
-    }
-    return { workspaceBackend, provisionResults };
-}
-// Shared JSON Schema → Zod converter (consolidated from 3 duplicate copies).
-import { jsonSchemaToZod } from "../../shared/json-schema-to-zod.js";
-/**
- * Heuristic check for native extended thinking support.
- * Models with thinking support don't need the explicit think tool.
- */
-function _modelHasNativeThinking(modelId) {
-    const lower = modelId.toLowerCase();
-    if (lower.includes("haiku"))
-        return false;
-    if (lower.includes("gpt-4o-mini"))
-        return false;
-    if (lower.includes("claude") && (lower.includes("sonnet") || lower.includes("opus")))
-        return true;
-    if (lower.includes("o1") || lower.includes("o3") || lower.includes("o4")) {
-        return true;
-    }
-    return false;
-}
-//# sourceMappingURL=setup.js.map