@stigmer/runner 3.2.1 → 3.2.3

package/src/activities/execute-cursor/__tests__/build-prompt.test.ts

@@ -87,6 +87,71 @@ describe("buildPrompt", () => {
     expect(prompt).toContain(USER_MESSAGE);
   });
 
+  it("carries the rollover context bridge on the first execution (DD-013)", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "created_first_execution"),
+        contextBridge: "Subject: Orders\nUser: where is my order?\nAssistant: Shipped.",
+      }),
+    );
+    expect(prompt).toContain("<previous_conversation_context>");
+    expect(prompt).toContain("User: where is my order?");
+    // The bridge is CONTEXT; the approval protocol keeps its pinned
+    // last-before-task slot so instructions outweigh it.
+    expect(prompt.indexOf("<previous_conversation_context>"))
+      .toBeLessThan(prompt.indexOf("<tool_approval_protocol>"));
+  });
+
+  it("never bridges a successfully resumed agent — its native context IS the conversation", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        contextBridge: "Subject: Orders\nUser: hi\nAssistant: hello",
+      }),
+    );
+    expect(prompt).toBe(USER_MESSAGE);
+  });
+
+  it("omits the bridge section when the session carries none", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_first_execution") }),
+    );
+    expect(prompt).not.toContain("<previous_conversation_context>");
+  });
+
+  it("carries the channel sender identity on the first execution", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "created_first_execution"),
+        senderIdentity: { value: "15550001111", kind: "whatsapp_phone" },
+      }),
+    );
+    expect(prompt).toContain("<conversation_sender>");
+    expect(prompt).toContain("WhatsApp phone number");
+    expect(prompt).toContain("15550001111");
+    // Identity is CONTEXT like the bridge; the approval protocol keeps its
+    // pinned last-before-task slot.
+    expect(prompt.indexOf("<conversation_sender>"))
+      .toBeLessThan(prompt.indexOf("<tool_approval_protocol>"));
+  });
+
+  it("never re-sends the identity to a successfully resumed agent — its native context carries it", () => {
+    const prompt = buildPrompt(
+      input({
+        resolution: resolution("local", "resumed_successfully"),
+        senderIdentity: { value: "U0USER", kind: "slack_user_id" },
+      }),
+    );
+    expect(prompt).toBe(USER_MESSAGE);
+  });
+
+  it("omits the sender section when the session carries no identity (console sessions)", () => {
+    const prompt = buildPrompt(
+      input({ resolution: resolution("local", "created_first_execution") }),
+    );
+    expect(prompt).not.toContain("<conversation_sender>");
+  });
+
   it("uses the reinvocation prompt for a HITL reinvocation (human-meaningful, no opaque ids)", () => {
     const approvalDecisions = new Map<string, ApprovalAction>([
       ["tool-call-1", ApprovalAction.APPROVE],

package/src/activities/execute-cursor/__tests__/hitl-ledger.test.ts

@@ -42,7 +42,9 @@ import {
   MessageType,
   ToolCallStatus,
   ApprovalAction,
+  ApprovalPolicySource,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 
 import {
   resetDenialLedger,
@@ -61,6 +63,7 @@ import {
   collapseRedundantToolCallTwins,
   toolCallIdentityToken,
   detectUnattributedHookBlocks,
+  stampUnattendedSkippedToolCalls,
   HOOK_BLOCK_ERROR_MARKERS,
 } from "../message-translator.js";
 import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
@@ -1843,6 +1846,105 @@ describe("reconcileDeniedToolCalls — non-approval kinds never gate", () => {
   });
 });
 
+describe("stampUnattendedSkippedToolCalls (DD-014)", () => {
+  it("settles a hook-blocked FAILED row to SKIPPED with UNATTENDED_SKIP provenance", () => {
+    const denied = toolCall({
+      id: "u1", name: "shell", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { command: "rm -rf build" },
+    });
+    const messages = [aiMessageWith([denied])];
+
+    const stamped = stampUnattendedSkippedToolCalls(messages, [], [
+      { toolName: "Shell", token: toolCallIdentityToken(denied), kind: "unattended" },
+    ]);
+
+    expect(stamped).toBe(1);
+    expect(denied.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(denied.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+    expect(denied.error).toBe("");
+    expect(denied.result).toContain("skipped automatically");
+    // Server-owned human-decision fields stay untouched (DD-014 D-e).
+    expect(denied.approvalAction).toBe(ApprovalAction.UNSPECIFIED);
+  });
+
+  it("settles an interrupted non-terminal row and covers sub-agent transcripts", () => {
+    const parentRow = toolCall({
+      id: "u2", name: "edit", status: ToolCallStatus.TOOL_CALL_RUNNING,
+      args: { path: "notes.md", old_string: "a", new_string: "b" },
+    });
+    const subRow = toolCall({
+      id: "u3", name: "shell", status: ToolCallStatus.TOOL_CALL_PENDING,
+      args: { command: "make" },
+    });
+    const subAgents = [create(SubAgentExecutionSchema, { messages: [aiMessageWith([subRow])] })];
+
+    const stamped = stampUnattendedSkippedToolCalls(
+      [aiMessageWith([parentRow])],
+      subAgents,
+      [
+        { toolName: "Write", token: toolCallIdentityToken(parentRow), kind: "unattended" },
+        { toolName: "Shell", token: toolCallIdentityToken(subRow), kind: "unattended" },
+      ],
+    );
+
+    expect(stamped).toBe(2);
+    expect(parentRow.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(subAgents[0].messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+  });
+
+  it("matches a FILE denial across abs-vs-rel path drift via the workspace root", () => {
+    // Hook recorded the ABSOLUTE path; the stream carried the relative one.
+    const denied = toolCall({
+      id: "u4", name: "edit", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { path: "notes.md" },
+    });
+
+    const stamped = stampUnattendedSkippedToolCalls(
+      [aiMessageWith([denied])],
+      [],
+      [{ toolName: "Write", token: grantToken("write", `${ROOT}/notes.md`), kind: "unattended" }],
+      ROOT,
+    );
+
+    expect(stamped).toBe(1);
+    expect(denied.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+  });
+
+  it("never rewrites a COMPLETED row or an unrelated failure", () => {
+    const completed = toolCall({
+      id: "u5", name: "shell", status: ToolCallStatus.TOOL_CALL_COMPLETED,
+      result: "ok", args: { command: "ls" },
+    });
+    const ordinaryFailure = toolCall({
+      id: "u6", name: "shell", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "command not found", args: { command: "make" },
+    });
+    const messages = [aiMessageWith([completed, ordinaryFailure])];
+
+    const stamped = stampUnattendedSkippedToolCalls(messages, [], [
+      { toolName: "Shell", token: toolCallIdentityToken(completed), kind: "unattended" },
+      { toolName: "Shell", token: toolCallIdentityToken(ordinaryFailure), kind: "unattended" },
+    ]);
+
+    // The completed row is a real execution; the ordinary failure is not a
+    // hook block — only interrupted/hook-blocked shapes are settled. The
+    // interrupted-shape sibling (PENDING/RUNNING) is covered above.
+    expect(stamped).toBe(0);
+    expect(completed.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(ordinaryFailure.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+    expect(ordinaryFailure.error).toBe("command not found");
+  });
+
+  it("is a no-op for an empty unattended ledger", () => {
+    const row = toolCall({
+      id: "u7", name: "shell", status: ToolCallStatus.TOOL_CALL_FAILED,
+      error: "blocked by a hook", args: { command: "make" },
+    });
+    expect(stampUnattendedSkippedToolCalls([aiMessageWith([row])], [], [])).toBe(0);
+    expect(row.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+  });
+});
+
 describe("generateHookScript ledger wiring", () => {
   it("bakes the active-turn pointer, derives the ledger from it, and records on EVERY deny arm", () => {
     const script = generateHookScript("/gate/active.json");
@@ -1858,6 +1960,9 @@ describe("generateHookScript ledger wiring", () => {
     // CAS staging-error fail-closed deny, and the missing-state-file failsafe.
     expect(script).toContain('record_denial "$PRIMARY_TOKEN" "approval"');
     expect(script).toContain('record_denial "$MCP_TOKEN" "approval"');
+    // DD-014: both approval arms have an unattended-resolution sibling.
+    expect(script).toContain('record_denial "$PRIMARY_TOKEN" "unattended"');
+    expect(script).toContain('record_denial "$MCP_TOKEN" "unattended"');
     expect(script.split('"secret"').length - 1).toBeGreaterThanOrEqual(2);
     expect(script).toContain('record_denial "$PRIMARY_TOKEN" "capture-error"');
     expect(script).toContain('record_denial "$PRIMARY_TOKEN" "fail-closed"');

package/src/activities/execute-cursor/__tests__/hook-script.test.ts

@@ -103,6 +103,60 @@ d("generated approval hook (preToolUse + beforeMCPExecution)", () => {
     expect(ledger[0]).not.toHaveProperty("input");
   });
 
+  // Unattended approval mode (DD-014): same gate, different RESOLUTION — the
+  // approval-deny arms record the non-pausing "unattended" kind with an
+  // adapt-and-explain message. What is gated must be byte-identical to
+  // interactive mode; only the kind and the agent message differ.
+  describe("unattended approval mode (DD-014)", () => {
+    it("denies a gated built-in with kind 'unattended' and the adapt message (no resume promise)", () => {
+      const h = setup({ unattendedSkip: true });
+      const res = h.decide(hookShell("rm -rf build"));
+      expect(res.permission).toBe("deny");
+      expect(res.raw).toContain("skipped automatically");
+      expect(res.raw).not.toContain("resume you");
+      const ledger = h.ledger();
+      expect(ledger).toHaveLength(1);
+      expect(ledger[0].kind).toBe("unattended");
+      // Same identity space as interactive mode — the stamping correlates on it.
+      expect(ledger[0].token).toBe(primaryToken("shell", "rm -rf build", ""));
+      // Non-approval kinds are content-free (no approval card needs a preview).
+      expect(ledger[0]).not.toHaveProperty("input");
+    });
+
+    it("denies a require-approval MCP tool with kind 'unattended'", () => {
+      const h = setup({
+        unattendedSkip: true,
+        mcpPolicies: { drop_table: { requiresApproval: true, message: "Drop table?" } },
+      });
+      const res = h.decide(hookMcp("drop_table", { table: "users" }));
+      expect(res.permission).toBe("deny");
+      expect(res.raw).toContain("skipped automatically");
+      const ledger = h.ledger();
+      expect(ledger).toHaveLength(1);
+      expect(ledger[0].kind).toBe("unattended");
+      expect(ledger[0].token).toBe(grantToken("drop_table", ""));
+    });
+
+    it("still allows auto-approved MCP tools and read-only built-ins (gating is unchanged)", () => {
+      const h = setup({
+        unattendedSkip: true,
+        mcpPolicies: { drop_table: { requiresApproval: true } },
+      });
+      expect(h.decide(hookMcp("list_tables")).permission).toBe("allow");
+      expect(h.decide(hookRead("/x/a.txt")).permission).toBe("allow");
+      expect(h.ledger()).toEqual([]);
+    });
+
+    it("the secret hard-block stays kind 'secret' (mode-independent)", () => {
+      const h = setup({ unattendedSkip: true });
+      const res = h.decide(hookWrite("/x/.env", "API_KEY=abc"));
+      expect(res.permission).toBe("deny");
+      const ledger = h.ledger();
+      expect(ledger).toHaveLength(1);
+      expect(ledger[0].kind).toBe("secret");
+    });
+  });
+
   // MCP gating runs ONLY on the beforeMCPExecution event (preToolUse does not
   // enforce MCP), so a denial is recorded in exactly one place. The identity is
   // name-only (base64("<tool>\n")) because the bare tool name is identical on the

package/src/activities/execute-cursor/__tests__/session-lifecycle.test.ts

@@ -20,7 +20,13 @@ vi.mock("@cursor/sdk", () => ({
 }));
 
 import { Agent } from "@cursor/sdk";
-import { resolvePlatformOptions, createAgent, resumeAgent } from "../session-lifecycle.js";
+import {
+  resolvePlatformOptions,
+  createAgent,
+  resumeAgent,
+  resolveAgentWithTransportRecovery,
+} from "../session-lifecycle.js";
+import type { CreateAgentOptions } from "../session-lifecycle.js";
 
 const tempRoots: string[] = [];
 
@@ -134,3 +140,118 @@ describe("workspace binding on create/resume", () => {
     expect(callOptions.local.cwd).toEqual(["/work/repo-a", "/work/repo-b"]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Transport recovery on agent-resolution timeout
+//
+// Regression: a stale HTTP/2 session to the proxy hangs Agent.create/resume
+// forever (prod incident, Jul 2026). The wrapper bounds each attempt, resets
+// the transport on the first expiry, and retries once. Only TimeoutError
+// triggers recovery — deterministic failures must propagate untouched.
+// ---------------------------------------------------------------------------
+
+describe("resolveAgentWithTransportRecovery", () => {
+  const TIMEOUT_MS = 1_000;
+  const hang = () => new Promise<never>(() => {});
+
+  function recoveryOptions(overrides?: {
+    harnessStateId?: string;
+    resetTransport?: () => void;
+  }) {
+    const createOptions: CreateAgentOptions = {
+      apiKey: "key",
+      model: "gpt-test",
+      workspaceDirs: ["/work/repo-a"],
+      sessionId: "ses-recovery-test",
+      workspaceRootDir: freshWorkspaceRoot(),
+    };
+    return {
+      harnessStateId: overrides?.harnessStateId ?? "",
+      createOptions,
+      mode: "local" as const,
+      timeoutMs: TIMEOUT_MS,
+      buildTimeoutMessage: (finalAttempt: boolean) =>
+        finalAttempt ? "final attempt timed out" : "first attempt timed out",
+      resetTransport: overrides?.resetTransport ?? vi.fn(),
+    };
+  }
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("passes the resolution through untouched when the first attempt succeeds", async () => {
+    const resetTransport = vi.fn();
+
+    const resolution = await resolveAgentWithTransportRecovery(
+      recoveryOptions({ resetTransport }),
+    );
+
+    expect(resolution.agentId).toBe("agent-created");
+    expect(resolution.reason).toBe("created_first_execution");
+    expect(resetTransport).not.toHaveBeenCalled();
+  });
+
+  it("resets the transport exactly once and recovers when the first attempt hangs", async () => {
+    vi.useFakeTimers();
+    const resetTransport = vi.fn();
+    vi.mocked(Agent.create).mockImplementationOnce(hang as any);
+
+    const promise = resolveAgentWithTransportRecovery(recoveryOptions({ resetTransport }));
+
+    await vi.advanceTimersByTimeAsync(TIMEOUT_MS + 1);
+    const resolution = await promise;
+
+    expect(resolution.agentId).toBe("agent-created");
+    expect(resetTransport).toHaveBeenCalledTimes(1);
+  });
+
+  it("retries resume-first so a transport hiccup does not discard conversation context", async () => {
+    vi.useFakeTimers();
+    const resetTransport = vi.fn();
+    vi.mocked(Agent.resume).mockImplementationOnce(hang as any);
+
+    const promise = resolveAgentWithTransportRecovery(
+      recoveryOptions({ harnessStateId: "agent-prior-turn", resetTransport }),
+    );
+
+    await vi.advanceTimersByTimeAsync(TIMEOUT_MS + 1);
+    const resolution = await promise;
+
+    // The load-bearing assertion: the retry went through Agent.resume again
+    // (only the transport was suspect, not the agent handle), so the native
+    // conversation context survives the recovery.
+    expect(resolution.reason).toBe("resumed_successfully");
+    expect(resolution.agentId).toBe("agent-resumed");
+    expect(resetTransport).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects with the final-attempt message when both attempts hang; transport reset only once", async () => {
+    vi.useFakeTimers();
+    const resetTransport = vi.fn();
+    vi.mocked(Agent.create)
+      .mockImplementationOnce(hang as any)
+      .mockImplementationOnce(hang as any);
+
+    const promise = resolveAgentWithTransportRecovery(recoveryOptions({ resetTransport }));
+    const rejection = expect(promise).rejects.toThrow("final attempt timed out");
+
+    await vi.advanceTimersByTimeAsync(TIMEOUT_MS + 1); // first attempt expires
+    await vi.advanceTimersByTimeAsync(TIMEOUT_MS + 1); // retry expires
+    await rejection;
+
+    expect(resetTransport).toHaveBeenCalledTimes(1);
+  });
+
+  it("propagates a non-timeout error immediately without touching the transport", async () => {
+    const resetTransport = vi.fn();
+    const authFailure = new Error("401 unauthorized");
+    vi.mocked(Agent.create).mockRejectedValueOnce(authFailure);
+
+    await expect(
+      resolveAgentWithTransportRecovery(recoveryOptions({ resetTransport })),
+    ).rejects.toBe(authFailure);
+
+    expect(resetTransport).not.toHaveBeenCalled();
+  });
+});

package/src/activities/execute-cursor/approval-state.ts

@@ -218,6 +218,17 @@ export interface ApprovalStateFile {
    *    deep-agent), and shell/MCP gate as always.
    */
   gitWorkspace: boolean;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED,
+   * DD-014): the creating surface — a messaging channel, a guest share — has
+   * no approver. What is gated is UNCHANGED; only the resolution differs: a
+   * deny that would be recorded kind "approval" (pausing) is recorded kind
+   * "unattended" (non-pausing) with an adapt-and-explain agent message, so
+   * the first-denial stop never fires, no WAITING_APPROVAL gate is
+   * reconciled, and the run continues to normal completion. The secret
+   * hard-block and fail-closed arms are mode-independent and unchanged.
+   */
+  unattendedSkip: boolean;
 }
 
 /**
@@ -384,6 +395,7 @@ export function buildApprovalState(
   captureMode = false,
   captureIgnored = false,
   gitWorkspace = true,
+  unattendedSkip = false,
 ): ApprovalStateFile {
   const approvedGrants = grants ?? [];
 
@@ -407,6 +419,7 @@ export function buildApprovalState(
     captureMode,
     captureIgnored,
     gitWorkspace,
+    unattendedSkip,
   };
 }
 
@@ -449,6 +462,11 @@ const DENIAL_LEDGER_FILE = "denials.jsonl";
  *
  * - `approval`      — the normal gate: the runner surfaces it as a
  *                     WAITING_APPROVAL pause. The ONLY kind that pauses.
+ * - `unattended`    — the same gate resolved under UNATTENDED approval mode
+ *                     (DD-014): the surface has no approver, so the deny is
+ *                     final for this turn — non-pausing, the agent was told
+ *                     to adapt, and the turn boundary stamps the call
+ *                     TOOL_CALL_SKIPPED with UNATTENDED_SKIP provenance.
  * - `secret`        — DD-26 secret hard-block: intentional, non-pausing (the
  *                     agent was told to move on), recorded content-free.
  * - `capture-error` — CAS staging failed; the write stayed on the deny-gate.
@@ -461,11 +479,14 @@ const DENIAL_LEDGER_FILE = "denials.jsonl";
  * unknown deny must never manufacture an approval) but still attributes the
  * blocked call to our own hook.
  */
-export type DenialKind = "approval" | "secret" | "capture-error" | "fail-closed";
+export type DenialKind = "approval" | "unattended" | "secret" | "capture-error" | "fail-closed";
 
 /** The one kind that pauses the run for user approval. */
 export const APPROVAL_DENIAL_KIND: DenialKind = "approval";
 
+/** The unattended-mode resolution kind (non-pausing; stamped SKIPPED). */
+export const UNATTENDED_DENIAL_KIND: DenialKind = "unattended";
+
 /**
  * One denial recorded by the preToolUse hook. `token` is the call's identity in
  * the same space as grantToken() (base64 of `toolName \n salientArg`), used to
@@ -511,6 +532,16 @@ export function approvalDenials(entries: readonly DeniedLedgerEntry[]): DeniedLe
   return entries.filter((e) => denialKindOf(e) === APPROVAL_DENIAL_KIND);
 }
 
+/**
+ * The entries the UNATTENDED approval mode resolved (DD-014) — never pausing,
+ * consumed by the turn boundary's `stampUnattendedSkippedToolCalls` to
+ * terminalize the corresponding streamed tool calls as TOOL_CALL_SKIPPED with
+ * UNATTENDED_SKIP provenance, so both harnesses persist the same honest shape.
+ */
+export function unattendedDenials(entries: readonly DeniedLedgerEntry[]): DeniedLedgerEntry[] {
+  return entries.filter((e) => denialKindOf(e) === UNATTENDED_DENIAL_KIND);
+}
+
 /**
  * Absolute path of the per-turn denial ledger the hook appends to, inside the
  * session's runner-owned HITL directory (never the user's workspace).

package/src/activities/execute-cursor/hook-script.ts

@@ -124,6 +124,24 @@ const APPROVAL_REQUIRED_AGENT_MESSAGE =
   "attempt a workaround for this action. The platform will resume you " +
   "automatically after the user responds — continue with the rest of the task.";
 
+// Shown to the model when the gate denies a tool call under UNATTENDED
+// approval mode (DD-014): the creating surface (a messaging channel, a guest
+// share) has no approver, so — unlike APPROVAL_REQUIRED_AGENT_MESSAGE — this
+// must NOT promise a resume: the deny is final for this turn and the model
+// must adapt. It also enforces the anti-leak posture: the end user hears a
+// plain-language explanation, never tool/approval vocabulary. Same embedding
+// constraint (single-quoted bash echo of a JSON object): no double quotes,
+// apostrophes, or backslashes. Mirrors the native gate skip message
+// (middleware/approval-gate.ts unattendedSkipMessage) in intent.
+const UNATTENDED_SKIP_AGENT_MESSAGE =
+  "This action was skipped automatically because it requires an approval that " +
+  "is not available in this conversation. This is the platform approval gate " +
+  "working as intended — it is not an error and not a Cursor misconfiguration. " +
+  "Do not retry it or attempt a workaround; it will not be resumed. Adapt your " +
+  "plan, and explain to the user in plain language what you could not do and " +
+  "what they can do instead — never mention tools, approvals, or platform " +
+  "mechanics.";
+
 // Shown to the model when a secret-like gitignored write is hard-blocked (DD-E /
 // DD-18). Unlike APPROVAL_REQUIRED_AGENT_MESSAGE, this must NOT promise a resume:
 // the write is discarded and never captured for review, so the model must move on
@@ -522,6 +540,14 @@ GIT_WORKSPACE=true
 if echo "$STATE" | grep -q '"gitWorkspace":false'; then
   GIT_WORKSPACE=false
 fi
+# Unattended approval mode (DD-014): the surface has no approver. Same gate,
+# different RESOLUTION — the approval-deny arms below record kind "unattended"
+# (non-pausing) with an adapt-and-explain message instead of kind "approval"
+# (pausing). Secret/fail-closed/capture-error arms are mode-independent.
+UNATTENDED_SKIP=false
+if echo "$STATE" | grep -q '"unattendedSkip":true'; then
+  UNATTENDED_SKIP=true
+fi
 
 # --- Capture mode: observe CAS-owned writes for review ----------------------
 # Runs BEFORE the auto-approve-all shortcut and the grant/lease checks because
@@ -588,6 +614,13 @@ if [ "$HOOK_EVENT" = "beforeMCPExecution" ]; then
       if [ -z "$MSG" ]; then
         MSG="Tool requires approval: $TOOL_NAME"
       fi
+      if [ "$UNATTENDED_SKIP" = "true" ]; then
+        # Unattended resolution (DD-014): non-pausing kind, final for this
+        # turn — the model adapts and the turn boundary stamps SKIPPED.
+        record_denial "$MCP_TOKEN" "unattended"
+        echo '{"permission":"deny","agent_message":"${UNATTENDED_SKIP_AGENT_MESSAGE}","user_message":"Skipped (approval not available on this surface): '"$TOOL_NAME"'"}'
+        exit 0
+      fi
       record_denial "$MCP_TOKEN" "approval"
       echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"'"$MSG"'"}'
       exit 0
@@ -655,6 +688,13 @@ if [ -n "$CATEGORY" ]; then
   fi
   # Record the PRIMARY token (content-exact when available, else coarse) so the
   # runner's denial correlation keys on the SAME identity it grants on approval.
+  if [ "$UNATTENDED_SKIP" = "true" ]; then
+    # Unattended resolution (DD-014): non-pausing kind, final for this turn —
+    # the model adapts and the turn boundary stamps SKIPPED.
+    record_denial "$PRIMARY_TOKEN" "unattended"
+    echo '{"permission":"deny","agent_message":"${UNATTENDED_SKIP_AGENT_MESSAGE}","user_message":"Skipped (approval not available on this surface): '"$TOOL_NAME"'"}'
+    exit 0
+  fi
   record_denial "$PRIMARY_TOKEN" "approval"
   echo '{"permission":"deny","agent_message":"${APPROVAL_REQUIRED_AGENT_MESSAGE}","user_message":"Tool requires approval: '"$TOOL_NAME"'"}'
   exit 0