@stigmer/runner 3.2.1 → 3.2.3

package/src/activities/execute-deep-agent/__tests__/index.test.ts

@@ -47,6 +47,7 @@ describe("ExecuteDeepAgent activity", () => {
     checkpointerProxyEndpoint: null,
     primaryModel: "gpt-4.1",
     cursorStreamStallTimeoutMs: 180000,
+    agentResolveTimeoutMs: 120000,
     workspaceLockTimeoutMs: 900000,
   };
 

package/src/activities/execute-deep-agent/__tests__/prompt-builder.test.ts

@@ -208,6 +208,64 @@ describe("buildEnhancedSystemPrompt", () => {
     expect(prompt).not.toContain("## Workspace");
   });
 
+  describe("rollover context bridge (DD-013)", () => {
+    const base = {
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "",
+      injectedFiles: [],
+    };
+
+    it("appends the bridge as standing session context (every-turn injection)", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        contextBridge: "Subject: Orders\nUser: where is my order?\nAssistant: Shipped.",
+      });
+
+      expect(prompt).toContain("## Previous conversation context");
+      expect(prompt).toContain("User: where is my order?");
+      expect(prompt).toContain("Do not repeat it back");
+    });
+
+    it("omits the section when the session carries no bridge", () => {
+      const prompt = buildEnhancedSystemPrompt(base);
+
+      expect(prompt).not.toContain("## Previous conversation context");
+    });
+  });
+
+  describe("channel sender identity", () => {
+    const base = {
+      instructions: "Test",
+      provisionResults: [],
+      containerRoot: "",
+      skillsPromptSection: "",
+      workspaceFileRefs: [],
+      workspaceRoot: "",
+      injectedFiles: [],
+    };
+
+    it("appends the sender as standing session context (every-turn injection)", () => {
+      const prompt = buildEnhancedSystemPrompt({
+        ...base,
+        senderIdentity: { value: "15550001111", kind: "whatsapp_phone" },
+      });
+
+      expect(prompt).toContain("## Conversation sender");
+      expect(prompt).toContain("WhatsApp phone number");
+      expect(prompt).toContain("15550001111");
+    });
+
+    it("omits the section when the session carries no identity (console sessions)", () => {
+      const prompt = buildEnhancedSystemPrompt(base);
+
+      expect(prompt).not.toContain("## Conversation sender");
+    });
+  });
+
   describe("plan mode", () => {
     const base = {
       instructions: "Test",

package/src/activities/execute-deep-agent/__tests__/sequential-gate-resume.test.ts

@@ -256,6 +256,7 @@ const memoryConfig: Config = {
   checkpointerProxyEndpoint: null,
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  agentResolveTimeoutMs: 120000,
   workspaceLockTimeoutMs: 900000,
 };
 

package/src/activities/execute-deep-agent/hitl.ts

@@ -17,9 +17,11 @@ import { Command } from "@langchain/langgraph";
 import type { AgentExecution, AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ApprovalAction,
+  ApprovalPolicySource,
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { POLICY_ENGINE_VERSION, unattendedSkipMessage } from "../../shared/approval-policy.js";
 
 // APPROVE_ALL resumes the interrupted tool exactly like APPROVE. Its
 // "auto-approve the rest of the run" effect is realized in setup.ts (the
@@ -233,3 +235,52 @@ export function reconcileNonExecutingDecisions(status: AgentExecutionStatus): vo
     apply(subAgent.messages);
   }
 }
+
+/**
+ * Terminalize every tool call the approval gate auto-skipped under UNATTENDED
+ * approval mode — the sibling of {@link reconcileNonExecutingDecisions} for
+ * skips that have no human decision behind them.
+ *
+ * The gate (the single writer of the registry) records each auto-skipped
+ * tool-call id at the moment it returns the skip ToolMessage; this reconciler
+ * (the single writer of the terminal row) folds each id into:
+ * - `status = TOOL_CALL_SKIPPED` — the tool did not run, whatever transient
+ *   status the stream left behind (COMPLETED from a tool_finished that carried
+ *   the skip message, or RUNNING when no tool events fired);
+ * - `approval_policy_source = UNATTENDED_SKIP` — the resolution layer,
+ *   overriding the gating-layer source stamped at tool-start (the
+ *   AUTO_APPROVE_ALL precedent: layer-4 resolutions own the resolved call);
+ * - a result backfilled from {@link unattendedSkipMessage} when the stream
+ *   delivered none, so the transcript row is never blank.
+ *
+ * `approval_action` / `approved_by` are deliberately NOT touched — those are
+ * server-owned fields recording HUMAN decisions only (DD-014 D-e). No
+ * approval-request event exists for these calls, so the pending-approvals
+ * projection stays empty by construction. Idempotent: re-running re-resolves
+ * identically. Covers sub-agent transcripts because sub-agent gates inherit
+ * the parent's registry instance.
+ */
+export function reconcileUnattendedSkips(
+  status: AgentExecutionStatus,
+  unattendedSkips: ReadonlySet<string> | undefined,
+): void {
+  if (!unattendedSkips || unattendedSkips.size === 0) return;
+
+  const apply = (messages: readonly AgentMessage[]): void => {
+    for (const msg of messages) {
+      for (const tc of msg.toolCalls) {
+        if (!unattendedSkips.has(tc.id)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.isStreaming = false;
+        if (!tc.result) tc.result = unattendedSkipMessage(tc.name);
+      }
+    }
+  };
+
+  apply(status.messages);
+  for (const subAgent of status.subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+}

package/src/activities/execute-deep-agent/index.ts

@@ -47,7 +47,7 @@ import { StatusBuilder } from "./status-builder.js";
 import { InlinePublisher } from "./inline-publisher.js";
 import { WriteBackCoordinator } from "../../shared/workspace/writeback-coordinator.js";
 import { processPostStream } from "./post-stream.js";
-import { resolveResumeInput, reconcileNonExecutingDecisions, type GraphStateSnapshot } from "./hitl.js";
+import { resolveResumeInput, reconcileNonExecutingDecisions, reconcileUnattendedSkips, type GraphStateSnapshot } from "./hitl.js";
 import { captureApprovalArtifacts } from "./approval-file-change.js";
 import {
   applyCaptureDecisions,
@@ -144,6 +144,7 @@ export function createDeepAgentActivities(config: Config) {
           toolServerMap: setup.toolServerMap,
           leasedCategories: setup.leasedCategories,
           globalBypass: setup.globalBypass,
+          unattended: setup.unattended,
         });
 
         const resume = resolveResumeInput(
@@ -408,6 +409,7 @@ export function createDeepAgentActivities(config: Config) {
             toolServerMap: setup.toolServerMap,
             leasedCategories: setup.leasedCategories,
             globalBypass: setup.globalBypass,
+            unattended: setup.unattended,
           },
           streamVersion: setup.streamVersion,
           // Mid-run live capture (DD-32 / DD-33): attach file_change_progress
@@ -465,6 +467,14 @@ export function createDeepAgentActivities(config: Config) {
         // completion persists below so the terminal status is what is persisted.
         reconcileNonExecutingDecisions(initialStatus);
 
+        // Terminalize every tool call the gate auto-skipped under UNATTENDED
+        // approval mode (DD-014): the skip has no human decision behind it, so
+        // reconcileNonExecutingDecisions cannot see it — this sibling folds the
+        // gate's registry into terminal SKIPPED rows with UNATTENDED_SKIP
+        // provenance, whatever transient status the stream left behind. No-op
+        // for interactive executions (empty registry).
+        reconcileUnattendedSkips(initialStatus, setup.unattendedSkips);
+
         // Turn boundary (capture mode): capture the candidate change set from the
         // git diff and author CANDIDATE_CAPTURED, then stamp the flowed file-edit
         // rows with the change set id — they stay visible in place as

package/src/activities/execute-deep-agent/prompt-builder.ts

@@ -10,6 +10,11 @@ import { relative } from "node:path";
 import { InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { ProvisionResult, GitMetadata } from "../../shared/workspace/types.js";
 import { SourceType } from "../../shared/workspace/types.js";
+import { formatContextBridgeText } from "../../shared/context-bridge.js";
+import {
+  formatSenderIdentityText,
+  type SenderIdentity,
+} from "../../shared/sender-identity.js";
 import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
 import {
   buildImplementPlanDirective,
@@ -106,6 +111,24 @@ export interface PromptBuilderInput {
    * message itself is just a short label ("Build from plan").
    */
   buildFromPlan?: boolean;
+  /**
+   * Rollover context bridge (cloud DD-013): a digest of the previous
+   * session's conversation, read from `SessionSpec.metadata`. Injected on
+   * EVERY turn by design: the native system prompt is rebuilt per
+   * invocation (never checkpointed with the message history), so a
+   * first-turn-only injection would vanish from turn 2 onward. The bridge
+   * is standing session context, like skills.
+   */
+  contextBridge?: string;
+  /**
+   * Channel sender identity (attribution, not authorization): the
+   * provider-verified identifier of the person on the channel, read from
+   * `SessionSpec.metadata`. Injected on EVERY turn like the bridge — the
+   * native system prompt is rebuilt per invocation, and the sender is
+   * constant for the session's lifetime (channel sessions are keyed
+   * per-sender).
+   */
+  senderIdentity?: SenderIdentity;
 }
 
 export interface InjectedFile {
@@ -147,6 +170,18 @@ export function buildEnhancedSystemPrompt(input: PromptBuilderInput): string {
     prompt += buildInjectedFilesSection(input.injectedFiles);
   }
 
+  if (input.senderIdentity) {
+    prompt +=
+      "\n\n## Conversation sender\n\n" +
+      formatSenderIdentityText(input.senderIdentity);
+  }
+
+  if (input.contextBridge) {
+    prompt +=
+      "\n\n## Previous conversation context\n\n" +
+      formatContextBridgeText(input.contextBridge);
+  }
+
   prompt += RESPONSE_RULES;
   prompt += SUB_AGENT_RULES;
 

package/src/activities/execute-deep-agent/setup.ts

@@ -23,6 +23,8 @@ import type { DynamicStructuredTool } from "@langchain/core/tools";
 import type { Config } from "../../config.js";
 import type { StigmerClient } from "../../client/stigmer-client.js";
 import { createCheckpointer } from "../../shared/checkpointer/factory.js";
+import { readContextBridge } from "../../shared/context-bridge.js";
+import { readSenderIdentity } from "../../shared/sender-identity.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { resolveMcpServers } from "../../shared/mcp-resolver.js";
 import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
@@ -57,6 +59,7 @@ import {
 import {
   mergeApprovalPolicies,
   deriveActiveLeases,
+  isUnattendedApprovalMode,
   type MergedToolPolicy,
 } from "../../shared/approval-policy.js";
 import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
@@ -123,6 +126,20 @@ export interface SetupResult {
    * the gate (see ActiveLeases / deriveActiveLeases).
    */
   readonly globalBypass: boolean;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED,
+   * stamped by approver-less surfaces — channels, guest shares). The gate
+   * resolves gated tools as automatic skips instead of interrupting; the
+   * builders never seed WAITING_APPROVAL. See isUnattendedApprovalMode.
+   */
+  readonly unattended: boolean;
+  /**
+   * Tool-call ids the gate auto-skipped under {@link unattended} this turn.
+   * Written ONLY by the approval gate (parent + inherited sub-agent gates
+   * share this instance); read by reconcileUnattendedSkips after the stream
+   * to stamp terminal SKIPPED rows. Empty set when not unattended.
+   */
+  readonly unattendedSkips: Set<string>;
   readonly hasStructuredOutput: boolean;
   readonly streamVersion: "v2" | "v3";
   /**
@@ -386,6 +403,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       injectedFiles,
       interactionMode: execution.spec!.executionConfig?.interactionMode,
       buildFromPlan: execution.spec!.executionConfig?.buildFromPlan,
+      contextBridge: readContextBridge(session.spec!.metadata),
+      senderIdentity: readSenderIdentity(session.spec!.metadata),
     });
 
     // Step 9: Construct the LLM model. Resolution to the provider API id
@@ -436,6 +455,14 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       leases,
     );
 
+    // Unattended approval mode (DD-014): approver-less surfaces (channels,
+    // guest shares) stamp APPROVAL_MODE_UNATTENDED, and the gate resolves
+    // gated tools as automatic skips instead of interrupting. The registry is
+    // the gate→reconciler channel for the skipped tool-call ids; one instance
+    // is shared with sub-agent gates via the inherited config.
+    const unattended = isUnattendedApprovalMode(execution);
+    const unattendedSkips = new Set<string>();
+
     // The approval gate config is the single source of truth for HITL gating,
     // built once and inherited verbatim by sub-agents (so a mutating tool inside
     // a sub-agent is gated identically to one in the parent). Null under the
@@ -472,6 +499,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           isCapturablePath,
           captureIgnored: captureMode && !!artifactStorage,
           recordBlockedSecret: (rawPath: string) => casObserver.recordBlockedSecret(rawPath),
+          unattended,
+          unattendedSkips,
         }
       : null;
 
@@ -644,6 +673,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       toolServerMap,
       leasedCategories: leases.categories,
       globalBypass,
+      unattended,
+      unattendedSkips,
       hasStructuredOutput: !!outputSchema,
       streamVersion,
       casObserver,

package/src/activities/execute-deep-agent/status-builder-shared.ts

@@ -157,6 +157,14 @@ export interface ApprovalProvenanceInputs {
   readonly leasedCategories?: ReadonlySet<ToolApprovalCategory>;
   /** Pre-armed spec.auto_approve_all — the one whole-run global bypass. */
   readonly globalBypass: boolean;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED):
+   * the gate auto-skips gated calls instead of interrupting, so the builders
+   * must NOT seed WAITING_APPROVAL rows or flip the phase to
+   * WAITING_FOR_APPROVAL — the row streams as RUNNING and the post-stream
+   * `reconcileUnattendedSkips` stamps the terminal SKIPPED + provenance.
+   */
+  readonly unattended?: boolean;
 }
 
 /** Shared empty set so a provider without leases allocates nothing per call. */

package/src/activities/execute-deep-agent/status-builder.ts

@@ -319,6 +319,13 @@ export class StatusBuilder {
       return { requiresApproval: false, message: "", serverSlug };
     }
 
+    // Unattended mode: the gate auto-skips instead of interrupting, so no row
+    // is ever WAITING_APPROVAL and the phase never flips — the streamed row
+    // runs to its skip result and reconcileUnattendedSkips terminalizes it.
+    if (this.approvalProvider.unattended) {
+      return { requiresApproval: false, message: "", serverSlug };
+    }
+
     if (serverSlug) {
       const key = `${serverSlug}/${toolName}`;
       const policy = this.approvalProvider.policies.get(key);

package/src/activities/execute-deep-agent/v3-status-builder.ts

@@ -419,6 +419,13 @@ export class V3StatusBuilder implements ExecutionStatusWriter {
       return { requiresApproval: false, message: "", serverSlug };
     }
 
+    // Unattended mode: the gate auto-skips instead of interrupting, so no row
+    // is ever WAITING_APPROVAL and the phase never flips — the streamed row
+    // runs to its skip result and reconcileUnattendedSkips terminalizes it.
+    if (this.approvalProvider.unattended) {
+      return { requiresApproval: false, message: "", serverSlug };
+    }
+
     if (serverSlug) {
       const key = `${serverSlug}/${toolName}`;
       const policy = this.approvalProvider.policies.get(key);

package/src/activities/workflow-event-activities.ts

@@ -34,6 +34,7 @@ import {
   ArtifactCreatedPayloadSchema,
   HumanInputOutcomeInfoSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/event_pb";
+import { ApiResourceAuditActorSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/status_pb";
 import { WorkflowExecutionStatusSchema, WorkflowTaskSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
 import {
   WorkflowExecutionUpdateStatusInputSchema,
@@ -221,6 +222,7 @@ export function toProtoEvent(desc: WorkflowEventDescriptor): WorkflowExecutionEv
         case: "taskStarted",
         value: create(TaskStartedPayloadSchema, {
           taskKind: TASK_KIND_MAP[desc.taskKind] ?? 0,
+          inputSummary: toJsonObject(desc.inputSummary),
           attemptNumber: desc.attemptNumber,
         }),
       };
@@ -233,6 +235,7 @@ export function toProtoEvent(desc: WorkflowEventDescriptor): WorkflowExecutionEv
         value: create(TaskCompletedPayloadSchema, {
           taskKind: TASK_KIND_MAP[desc.taskKind] ?? 0,
           durationMs: BigInt(desc.durationMs),
+          outputSummary: toJsonObject(desc.outputSummary),
           costMicros: BigInt(desc.costMicros),
           tokensUsed: BigInt(desc.tokensUsed),
         }),
@@ -307,6 +310,14 @@ export function toProtoEvent(desc: WorkflowEventDescriptor): WorkflowExecutionEv
         case: "approvalResolved",
         value: create(ApprovalResolvedPayloadSchema, {
           resolvedBy: desc.resolvedBy,
+          resolvedByActor: desc.resolvedByActor
+            ? create(ApiResourceAuditActorSchema, {
+                id: desc.resolvedByActor.id,
+                displayName: desc.resolvedByActor.display_name ?? "",
+                email: desc.resolvedByActor.email ?? "",
+                avatar: desc.resolvedByActor.avatar ?? "",
+              })
+            : undefined,
           comment: desc.comment,
           waitDurationMs: BigInt(desc.waitDurationMs),
         }),

package/src/config.ts

@@ -37,6 +37,17 @@ import { homedir, tmpdir } from "node:os";
  */
 export const DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS = 180_000;
 
+/**
+ * Default bound for Cursor Agent.create/Agent.resume (ms). These SDK calls
+ * have no timeout of their own; a degraded transport (dead proxy connection,
+ * stale HTTP/2 session) hangs them forever — which surfaces as an opaque
+ * Temporal heartbeat timeout minutes later instead of an actionable error.
+ * 120s comfortably covers a slow create (token exchange + workspace
+ * registration) while failing fast enough to diagnose. Single source of truth
+ * for env-loaded and options-mapped config (mirrors the stall timeout above).
+ */
+export const DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS = 120_000;
+
 // Re-exported so the runner/manager options mappers default the lock-wait
 // bound from the same constant the lock module owns (no drift across the
 // three construction sites — mirrors DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS).
@@ -89,6 +100,13 @@ export interface Config {
    * heartbeatTimeout (process liveness) and the 30s keep-alive heartbeat.
    */
   readonly cursorStreamStallTimeoutMs: number;
+  /**
+   * Bound (milliseconds) for Cursor Agent.create/Agent.resume. On expiry the
+   * execution fails fast with an explicit transport diagnosis instead of
+   * hanging into Temporal's heartbeat timeout. See
+   * {@link DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS} for why this exists.
+   */
+  readonly agentResolveTimeoutMs: number;
   /**
    * Max wait (milliseconds) for the per-workspace turn lock before failing
    * the execution with a "workspace is in use by another session" error.
@@ -174,6 +192,10 @@ export function loadConfig(): Config {
     ? parseInt(process.env.WORKSPACE_LOCK_TIMEOUT_MS, 10)
     : DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS;
 
+  const agentResolveTimeoutMs = process.env.CURSOR_AGENT_RESOLVE_TIMEOUT_MS
+    ? parseInt(process.env.CURSOR_AGENT_RESOLVE_TIMEOUT_MS, 10)
+    : DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS;
+
   return {
     taskQueue,
     temporalAddress,
@@ -191,6 +213,7 @@ export function loadConfig(): Config {
     checkpointerProxyEndpoint,
     primaryModel,
     cursorStreamStallTimeoutMs,
+    agentResolveTimeoutMs,
     workspaceLockTimeoutMs,
   };
 }

package/src/middleware/__tests__/approval-gate.test.ts

@@ -784,4 +784,99 @@ describe("ApprovalGateMiddleware", () => {
     expect(result).toBeInstanceOf(ToolMessage);
     expect((result as ToolMessage).content).toContain("unknown action");
   });
+
+  describe("unattended approval mode (DD-014)", () => {
+    const gatedMcpPolicies = new Map<string, MergedToolPolicy>([
+      ["srv/gated_tool", {
+        toolName: "gated_tool",
+        mcpServerSlug: "srv",
+        requiresApproval: true,
+        approvalMessage: "Run gated_tool",
+        source: "classifier_default",
+      }],
+    ]);
+
+    it("skips a gated MCP tool without interrupting and records it in the registry", async () => {
+      const unattendedSkips = new Set<string>();
+      const mw = createApprovalGateMiddleware(makeConfig({
+        policies: gatedMcpPolicies,
+        toolServerMap: new Map([["gated_tool", "srv"]]),
+        unattended: true,
+        unattendedSkips,
+      }));
+
+      const handler = vi.fn(passthrough);
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "gated_tool", args: { target: "prod" } }),
+        handler,
+      );
+
+      // Gateway invariant: the side effect never ran, and no interrupt was
+      // raised — the turn continues instead of parking WAITING_FOR_APPROVAL.
+      expect(handler).not.toHaveBeenCalled();
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect((result as ToolMessage).content).toContain("skipped automatically");
+      expect(unattendedSkips.has("call_abc123")).toBe(true);
+    });
+
+    it("skips a gated built-in (shell) the same way", async () => {
+      const unattendedSkips = new Set<string>();
+      const mw = createApprovalGateMiddleware(makeConfig({
+        unattended: true,
+        unattendedSkips,
+      }));
+
+      const handler = vi.fn(passthrough);
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "shell", args: { command: "rm -rf /" } }),
+        handler,
+      );
+
+      expect(handler).not.toHaveBeenCalled();
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+      expect((result as ToolMessage).content).toContain("skipped automatically");
+      expect(unattendedSkips.has("call_abc123")).toBe(true);
+    });
+
+    it("still runs tools the policy chain auto-approved (un-gating stays the operator lever)", async () => {
+      // The operator's tool_approval_overrides path: an un-gated tool is
+      // absent from the policy map, so unattended mode never touches it.
+      const unattendedSkips = new Set<string>();
+      const mw = createApprovalGateMiddleware(makeConfig({
+        toolServerMap: new Map([["book_appointment", "clinic"]]),
+        unattended: true,
+        unattendedSkips,
+      }));
+
+      const result = await mw.wrapToolCall!(
+        makeRequest({ name: "book_appointment", args: { slot: "mon-10" } }),
+        passthrough,
+      );
+
+      expect((result as ToolMessage).content).toBe("tool result");
+      expect(unattendedSkips.size).toBe(0);
+      expect(mockedInterrupt).not.toHaveBeenCalled();
+    });
+
+    it("never emits an execution receipt for an unattended skip (no side effect)", async () => {
+      const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+      try {
+        const mw = createApprovalGateMiddleware(makeConfig({
+          policies: gatedMcpPolicies,
+          toolServerMap: new Map([["gated_tool", "srv"]]),
+          unattended: true,
+          unattendedSkips: new Set<string>(),
+        }));
+
+        await mw.wrapToolCall!(makeRequest({ name: "gated_tool" }), passthrough);
+
+        const receipts = logSpy.mock.calls
+          .map((c) => String(c[0]))
+          .filter((line) => line.includes("[hitl-gateway] receipt"));
+        expect(receipts).toHaveLength(0);
+      } finally {
+        logSpy.mockRestore();
+      }
+    });
+  });
 });

package/src/middleware/approval-gate.ts

@@ -51,6 +51,7 @@ import {
   type PolicySource,
   POLICY_ENGINE_VERSION,
   resolveApprovalMessage,
+  unattendedSkipMessage,
 } from "../shared/approval-policy.js";
 import { toolApprovalCategory, type ToolApprovalCategory } from "../shared/tool-kind.js";
 import { extractFilePath } from "../shared/file-tools.js";
@@ -121,6 +122,26 @@ export interface ApprovalGateConfig {
    * secret; the CONTENT never leaves the workspace). Absent ⇒ nothing recorded.
    */
   readonly recordBlockedSecret?: (rawPath: string) => void;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED):
+   * the creating surface — a messaging channel, a guest share — has no
+   * approver, so a gated tool is resolved as an automatic SKIP (the model is
+   * told to adapt) instead of `interrupt()`. The execution never enters
+   * WAITING_FOR_APPROVAL. What is gated is unchanged — only the resolution
+   * differs; an operator un-gates a specific tool for the agent via
+   * tool_approval_overrides, not by weakening this mode.
+   */
+  readonly unattended?: boolean;
+  /**
+   * Registry of tool-call ids this gate auto-skipped under {@link unattended}
+   * — the gate is the single WRITER; `reconcileUnattendedSkips` (hitl.ts) is
+   * the reader that folds each id into a terminal TOOL_CALL_SKIPPED row with
+   * UNATTENDED_SKIP provenance after the stream. In-process, per-execution
+   * state keyed by the framework's own tool-call id (direct identity, no
+   * matching); inherited verbatim by sub-agent gates so their skips land in
+   * the same registry.
+   */
+  readonly unattendedSkips?: Set<string>;
 }
 
 interface ApprovalDecision {
@@ -249,6 +270,22 @@ export function createApprovalGateMiddleware(
         return await handler(request);
       }
 
+      // Unattended surfaces (channels, guest shares) have no approver, so a
+      // gate that would interrupt() here resolves as an automatic SKIP: the
+      // tool does NOT run (the gateway invariant holds — no side effect
+      // without a backing authorization), the model is told to adapt in plain
+      // language, and the turn continues to normal completion instead of
+      // parking in WAITING_FOR_APPROVAL forever. The registry entry lets the
+      // post-stream reconciler stamp the terminal SKIPPED row + provenance.
+      if (config.unattended) {
+        config.unattendedSkips?.add(toolCall.id);
+        return new ToolMessage({
+          content: unattendedSkipMessage(toolName),
+          tool_call_id: toolCall.id,
+          name: toolName,
+        });
+      }
+
       const approvalRequest = {
         tool_call_id: toolCall.id,
         tool_name: toolName,

package/src/runner-manager.ts

@@ -24,7 +24,7 @@ import {
 } from "@temporalio/worker";
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
-import { DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS, DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS, DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS } from "./config.js";
 import type { WorkerActivities } from "./worker.js";
 import { resolveWorkflowSource, OTEL_WORKFLOW_INTERCEPTOR_MODULE } from "./workflow-source.js";
 import { resolveRunnerBootstrap, refreshRunnerAccessToken } from "./bootstrap.js";
@@ -91,6 +91,9 @@ export interface RunnerManagerOptions {
   /** No-progress bound for the Cursor harness stream (ms). @default 180000 */
   readonly cursorStreamStallTimeoutMs?: number;
 
+  /** Bound for Cursor Agent.create/resume (ms). @default 120000 */
+  readonly agentResolveTimeoutMs?: number;
+
   /** Max wait for the per-workspace turn lock (ms). @default 900000 */
   readonly workspaceLockTimeoutMs?: number;
 
@@ -598,6 +601,8 @@ export function mapManagerOptionsToConfig(
     primaryModel: options.primaryModel ?? "gpt-4.1",
     cursorStreamStallTimeoutMs:
       options.cursorStreamStallTimeoutMs ?? DEFAULT_CURSOR_STREAM_STALL_TIMEOUT_MS,
+    agentResolveTimeoutMs:
+      options.agentResolveTimeoutMs ?? DEFAULT_CURSOR_AGENT_RESOLVE_TIMEOUT_MS,
     workspaceLockTimeoutMs:
       options.workspaceLockTimeoutMs ?? DEFAULT_WORKSPACE_LOCK_TIMEOUT_MS,
   };