@stigmer/runner 3.2.1 → 3.2.3

package/src/activities/execute-cursor/index.ts

@@ -39,12 +39,14 @@ import type { Run, ConversationTurn } from "@cursor/sdk";
 
 import type { Config } from "../../config.js";
 import { StigmerClient } from "../../client/stigmer-client.js";
-import { resolveAgent } from "./session-lifecycle.js";
+import { resolveAgentWithTransportRecovery } from "./session-lifecycle.js";
 import type { AgentResolution, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
+import { readContextBridge } from "../../shared/context-bridge.js";
+import { readSenderIdentity } from "../../shared/sender-identity.js";
 import { withholdSecretContentFromMessages } from "../../shared/tool-row.js";
 import { StallTimeoutError, formatStallFailure } from "../../shared/stall-watchdog.js";
 import { resolveUsableArtifactStorage, loadArtifactStorageConfig, type ArtifactStorage } from "../../shared/artifact-storage.js";
@@ -55,7 +57,7 @@ import { StreamingUpdateScheduler, loadStreamingConfig } from "../../shared/stre
 import { createCursorEventRecorder } from "./cursor-event-recorder.js";
 import { resolveMcpServers, validateMcpServerEnv } from "./mcp-resolver.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
-import { deriveActiveLeases } from "../../shared/approval-policy.js";
+import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
 import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
@@ -257,6 +259,25 @@ async function executeCursorInner(
   // can be classified with the same context as the run.wait() error path.
   let errorContext = { model: "default", mode: "local", agentId: "" };
 
+  // Periodic heartbeat for the ENTIRE activity, started before any phase runs.
+  // Setup phases make network calls (blueprint resolution, workspace clone, MCP
+  // backfill, Agent.create) that can stall; the scattered manual heartbeat()
+  // pulses between them leave every individual call uncovered. The production
+  // stale-proxy incident hung inside Agent.create with zero heartbeats and
+  // surfaced as an opaque 5-minute Temporal timeout. The label names the
+  // current phase so a stall is attributed in Temporal heartbeat details, and
+  // cancellation stays observable throughout. Safe ONLY because every SDK call
+  // below is itself bounded (agentResolveTimeoutMs, stall watchdog) — an
+  // unbounded hang under a live heartbeat would keep a dead activity alive
+  // forever.
+  let heartbeatPhase = "setup";
+  const taskQueue = Context.current().info.taskQueue;
+  const shutdownSignal = getShutdownSignalForQueue(taskQueue);
+  periodicHeartbeat = startHeartbeat(30_000, () => ({
+    phase: heartbeatPhase,
+    execution: executionId,
+  }), { shutdownSignal });
+
   try {
     // Phase 1: Hydrate execution from DB
     await reportSetupProgress(client, executionId, "Fetching execution");
@@ -270,6 +291,7 @@ async function executeCursorInner(
     const blueprint = await resolveBlueprint(client, session, config.workspaceRootDir);
 
     // Phase 2b: Resolve execution environment (MCP server credentials)
+    heartbeatPhase = "resolving_environment";
     await reportSetupProgress(client, executionId, "Resolving environment");
     const { envVars, secretKeys } = await resolveExecutionEnv(client, executionId);
     heartbeat();
@@ -280,6 +302,7 @@ async function executeCursorInner(
     // disabled the runner must provision the workspace itself, mirroring the
     // native harness. Git provisioning is idempotent across multi-turn and
     // HITL reinvocations.
+    heartbeatPhase = "provisioning_workspace";
     await reportSetupProgress(client, executionId, "Provisioning workspace");
     const workspaceProvision = await provisionCursorWorkspace(
       config, session, envVars, sessionId ?? "",
@@ -554,6 +577,7 @@ async function executeCursorInner(
     );
 
     // Phase 4a: Connect backfill for undiscovered MCP servers
+    heartbeatPhase = "resolving_mcp_servers";
     const sessionOrg = session.metadata?.org ?? "";
     mcpResolution = await backfillMcpServersIfNeeded(
       client, mcpResolution, blueprint.mergedMcpServerUsages, envVars, sessionOrg,
@@ -697,6 +721,11 @@ async function executeCursorInner(
     // absent a git tree keeps gating gitignored writes and a non-git workspace
     // falls back to the deny-gate entirely (no regression).
     const captureIgnored = captureMode && !!artifactStorage;
+    // Unattended approval mode (DD-014): approver-less surfaces (channels,
+    // guest shares) stamp APPROVAL_MODE_UNATTENDED; the hook then records
+    // approval denials with the non-pausing "unattended" kind, so the
+    // first-denial stop never fires and the turn boundary settles the denied
+    // calls as SKIPPED instead of pausing a turn nobody can approve.
     const approvalState = buildApprovalState(
       mergedPolicies,
       globalBypass,
@@ -705,6 +734,7 @@ async function executeCursorInner(
       captureMode,
       captureIgnored,
       gitWorkspace,
+      isUnattendedApprovalMode(execution),
     );
     const hitlGate = await installHitlGate({
       workspaceRoot: primaryWorkspaceDir,
@@ -815,11 +845,31 @@ async function executeCursorInner(
           agents: cursorSubAgents,
         };
 
-    let resolution: AgentResolution = await resolveAgent(
-      threadId,
+    // Agent.create/Agent.resume have no timeout of their own — a degraded
+    // transport (dead proxy connection, stale HTTP/2 session) hangs them
+    // forever, which the periodic heartbeat would happily keep alive. Each
+    // attempt is bounded; on expiry the wrapper resets the proxy transport
+    // and retries once, so a stale-session hang recovers without failing the
+    // execution. A second expiry propagates a plain Error to the generic
+    // catch below, which persists EXECUTION_FAILED (no Temporal retry —
+    // the activity returns rather than throws, and maximumAttempts is 1).
+    heartbeatPhase = "resolving_agent";
+    const resolveTimeoutSeconds = Math.round(config.agentResolveTimeoutMs / 1000);
+    let resolution: AgentResolution = await resolveAgentWithTransportRecovery({
+      harnessStateId: threadId,
       createOptions,
-      agentMode,
-    );
+      mode: agentMode,
+      timeoutMs: config.agentResolveTimeoutMs,
+      buildTimeoutMessage: (finalAttempt) =>
+        `Cursor agent ${threadId ? "resume" : "create"} timed out after ${resolveTimeoutSeconds}s ` +
+        `(${config.proxyEndpoint ? `via proxy ${config.proxyEndpoint}` : "direct Cursor API connection"}). ` +
+        `The transport connection is likely dead. ` +
+        (finalAttempt
+          ? `An automatic retry on a fresh transport connection also timed out. ` +
+            `Retry the message later; if this persists, check proxy and network health.`
+          : `Resetting the transport and retrying automatically.`),
+      resetTransport: closeProxySessions,
+    });
 
     console.log(
       `ExecuteCursor agent resolved: execution=${executionId}, ` +
@@ -878,6 +928,8 @@ async function executeCursorInner(
       appliedToolCallIds,
       interactionMode,
       buildFromPlan,
+      contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
+      senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
     });
 
     // Phase 10a: Inject structured output instruction for Cursor harness
@@ -962,16 +1014,10 @@ async function executeCursorInner(
       maxCostUsd,
     };
 
-    // Periodic heartbeat keeps Temporal informed during silent SDK operations
-    // (e.g. long tool calls, MCP requests, model thinking). Without this,
-    // the 2-minute heartbeat timeout can cancel the activity and mislabel
-    // the execution as "paused by user".
-    const taskQueue = Context.current().info.taskQueue;
-    const shutdownSignal = getShutdownSignalForQueue(taskQueue);
-    periodicHeartbeat = startHeartbeat(30_000, () => ({
-      phase: "cursor_streaming",
-      execution: executionId,
-    }), { shutdownSignal });
+    // The activity-wide periodic heartbeat (started at entry) keeps Temporal
+    // informed during silent SDK operations (long tool calls, MCP requests,
+    // model thinking); relabel it for the streaming phase.
+    heartbeatPhase = "cursor_streaming";
 
     // The Cursor SDK registers abort listeners on the cancellation signal for
     // each concurrent tool call (fetch, MCP, shell). With 10+ parallel tools,
@@ -1460,6 +1506,8 @@ async function executeCursorInner(
             attachmentPaths,
             pendingApprovals: adjudicatedApprovals,
             interactionMode,
+            contextBridge: readContextBridge(blueprint.sessionSpec.metadata),
+            senderIdentity: readSenderIdentity(blueprint.sessionSpec.metadata),
           });
 
           console.log(
@@ -1866,6 +1914,12 @@ async function executeCursorInner(
 
     return slimStatus(status);
   } finally {
+    // Stop the activity-wide periodic heartbeat on EVERY exit path
+    // (idempotent). The epilogue and catch stop it at the pause/shutdown
+    // disambiguation points; this covers early returns (e.g. the
+    // pure-reconcile resume) so no orphaned timer survives the activity.
+    periodicHeartbeat?.stop();
+
     // End the OTel turn span + record metrics with the final token snapshot on
     // EVERY exit path (idempotent). Placed here so the span covers any recovery
     // retry (whose tokens accrue after the primary stream) and never leaks on an
@@ -2019,6 +2073,18 @@ export interface BuildPromptInput {
    * .build_from_plan): both prompt paths carry the implement-plan directive.
    */
   buildFromPlan?: boolean;
+  /**
+   * Rollover context bridge from `SessionSpec.metadata` (cloud DD-013).
+   * Only the enhanced-prompt path consumes it — a resumed agent's native
+   * context IS the previous conversation, so it needs no bridge.
+   */
+  contextBridge?: string;
+  /**
+   * Channel sender identity from `SessionSpec.metadata`. Like the bridge,
+   * only the enhanced-prompt path consumes it — a resumed agent's native
+   * context already carries it from the session's first turn.
+   */
+  senderIdentity?: import("../../shared/sender-identity.js").SenderIdentity;
 }
 
 /**
@@ -2083,7 +2149,8 @@ export function buildPrompt(input: BuildPromptInput): string {
   }
 
   // First execution, or a fresh agent created after a resume failure: there is
-  // no prior conversation to inherit, so start a new turn with full context.
+  // no prior conversation to inherit, so start a new turn with full context —
+  // including the rollover bridge, when the session carries one.
   return buildEnhancedPrompt({
     instructions,
     userMessage,
@@ -2094,6 +2161,8 @@ export function buildPrompt(input: BuildPromptInput): string {
     attachmentPaths,
     interactionMode,
     buildFromPlan,
+    contextBridge: input.contextBridge,
+    senderIdentity: input.senderIdentity,
   });
 }
 

package/src/activities/execute-cursor/message-translator.ts

@@ -36,7 +36,7 @@ import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/a
 import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
-import { MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApprovalPolicySource, MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 import type { MergedToolPolicy } from "./approval-policy.js";
 import { lookupMcpToolPolicy, resolveApprovalMessage, builtInRequiresApproval, getBuiltInApprovalMessage, SALIENT_ARG_FIELDS } from "./approval-policy.js";
@@ -44,6 +44,7 @@ import {
   POLICY_ENGINE_VERSION,
   resolveApprovalProvenance,
   toProtoPolicySource,
+  unattendedSkipMessage,
 } from "../../shared/approval-policy.js";
 import {
   approvalDenials,
@@ -1916,6 +1917,86 @@ export function detectUnattributedHookBlocks(
   return blocks;
 }
 
+/**
+ * Stamp the tool calls the hook denied under UNATTENDED approval mode
+ * (DD-014) as terminal TOOL_CALL_SKIPPED rows with UNATTENDED_SKIP
+ * provenance — the Cursor twin of the native harness's
+ * `reconcileUnattendedSkips`, so both harnesses persist the same honest
+ * shape for a platform-resolved skip.
+ *
+ * An unattended denial never pauses the run (its ledger kind is excluded
+ * from {@link approvalDenials}), so the stream leaves the denied call as a
+ * FAILED row carrying Cursor's generic hook-block error — dishonest ("the
+ * tool broke") and alarming in a transcript an org admin reviews. This pass
+ * correlates the unattended ledger entries to their streamed calls with the
+ * SAME two identities the rest of the file uses — exact token, then
+ * (category, workspace-normalized path) for the abs-vs-rel drift — and
+ * settles each match to SKIPPED with a result explaining the skip.
+ *
+ * Scope: hook-blocked FAILED rows and still-non-terminal (PENDING/RUNNING)
+ * rows only — a COMPLETED row is a real execution and is never rewritten
+ * (an unattended deny cannot produce one). `approval_action`/`approved_by`
+ * stay untouched: server-owned, human-decision-only fields (DD-014 D-e).
+ * Unmatched ledger entries need no synthesis — there is no pause to
+ * surface; the model already saw the deny and adapted in-turn.
+ *
+ * Returns how many tool calls were stamped.
+ */
+export function stampUnattendedSkippedToolCalls(
+  messages: readonly AgentMessage[],
+  subAgentExecutions: readonly SubAgentExecution[],
+  unattendedLedger: readonly DeniedLedgerEntry[],
+  workspaceRoot?: string,
+): number {
+  if (unattendedLedger.length === 0) return 0;
+
+  const ledgerTokens = new Set(unattendedLedger.map((e) => e.token));
+  const ledgerNormalizedSalients = new Set<string>();
+  if (workspaceRoot) {
+    for (const entry of unattendedLedger) {
+      const decoded = decodeIdentityToken(entry.token);
+      if (!decoded) continue;
+      const normalized = normalizedFileSalient(decoded.key, decoded.salient, workspaceRoot);
+      if (normalized) ledgerNormalizedSalients.add(normalized);
+    }
+  }
+
+  const matchesLedger = (tc: ToolCall): boolean => {
+    if (ledgerTokens.has(toolCallIdentityToken(tc))) return true;
+    if (!workspaceRoot) return false;
+    const id = toolIdentity(tc.name, tc.mcpServerSlug, toolCallArgs(tc));
+    const normalized = normalizedFileSalient(id.key, id.salient, workspaceRoot);
+    return !!normalized && ledgerNormalizedSalients.has(normalized);
+  };
+
+  let stamped = 0;
+  const apply = (msgs: readonly AgentMessage[]): void => {
+    for (const msg of msgs) {
+      for (const tc of msg.toolCalls) {
+        const deniedShape =
+          (tc.status === ToolCallStatus.TOOL_CALL_FAILED && isHookBlockError(tc.error)) ||
+          tc.status === ToolCallStatus.TOOL_CALL_PENDING ||
+          tc.status === ToolCallStatus.TOOL_CALL_RUNNING;
+        if (!deniedShape || !matchesLedger(tc)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.error = "";
+        tc.result = unattendedSkipMessage(tc.name);
+        tc.isStreaming = false;
+        if (!tc.completedAt) tc.completedAt = utcTimestamp();
+        stamped++;
+      }
+    }
+  };
+
+  apply(messages);
+  for (const subAgent of subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+  return stamped;
+}
+
 /**
  * Compute a streamed tool call's identity token in the same canonical space the
  * preToolUse hook records denials in (see {@link toolIdentity} / primaryToken).

package/src/activities/execute-cursor/prompt-builder.ts

@@ -20,6 +20,11 @@ import { resolve } from "node:path";
 import type { SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { formatContextBridgeText } from "../../shared/context-bridge.js";
+import {
+  formatSenderIdentityText,
+  type SenderIdentity,
+} from "../../shared/sender-identity.js";
 import { PLAN_MODE_DIRECTIVE } from "../../shared/plan-mode-prompt.js";
 import {
   buildImplementPlanDirective,
@@ -60,6 +65,22 @@ export interface EnhancedPromptOptions {
    * The user message itself is just a short label ("Build from plan").
    */
   buildFromPlan?: boolean;
+  /**
+   * Rollover context bridge (cloud DD-013): a digest of the previous
+   * session's conversation, read from `SessionSpec.metadata`. Lands in the
+   * first message, so it persists in the cursor agent's own conversation
+   * store for the session's lifetime — buildEnhancedPrompt firing only on
+   * first/fresh executions is exactly the right delivery.
+   */
+  contextBridge?: string;
+  /**
+   * Channel sender identity (attribution, not authorization): the
+   * provider-verified identifier of the person on the channel, read from
+   * `SessionSpec.metadata`. Like the bridge, it lands in the first message
+   * and persists in the cursor agent's own conversation store — identity
+   * is constant per conversation (channel sessions are keyed per-sender).
+   */
+  senderIdentity?: SenderIdentity;
 }
 
 /**
@@ -119,6 +140,21 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatResponseRules());
   }
 
+  // The sender identity precedes the bridge: it is standing context about
+  // WHO the conversation is with, which the carried conversation may refer
+  // back to.
+  if (options.senderIdentity) {
+    sections.push(formatSenderIdentitySection(options.senderIdentity));
+  }
+
+  // The rollover context bridge sits directly before the protocol + task so
+  // the carried conversation is the freshest CONTEXT the model reads —
+  // while the approval protocol keeps its pinned last-before-task slot (it
+  // is an INSTRUCTION and must outweigh everything, including this bridge).
+  if (options.contextBridge) {
+    sections.push(formatContextBridgeSection(options.contextBridge));
+  }
+
   // Always last before the task: the platform's tool-approval protocol. Placed
   // here for recency so it outweighs any "ask the user first" guidance Cursor
   // surfaces from a connected MCP server (see formatToolApprovalProtocol).
@@ -252,6 +288,14 @@ export function formatInstructions(instructions: string): string {
   return `<agent_instructions>\n${instructions}\n</agent_instructions>`;
 }
 
+export function formatContextBridgeSection(bridge: string): string {
+  return `<previous_conversation_context>\n${formatContextBridgeText(bridge)}\n</previous_conversation_context>`;
+}
+
+export function formatSenderIdentitySection(identity: SenderIdentity): string {
+  return `<conversation_sender>\n${formatSenderIdentityText(identity)}\n</conversation_sender>`;
+}
+
 export function formatSkillsSection(skills: SkillMetadata[]): string {
   const entries = skills.map(
     (s) => `- **${s.name}**: ${s.description}\n  Path: \`${s.path}\``,

package/src/activities/execute-cursor/session-lifecycle.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 
 import { Agent } from "@cursor/sdk";
 import type { SDKAgent, CursorAgentPlatformOptions, AgentDefinition } from "@cursor/sdk";
+import { withTimeout, TimeoutError } from "../../shared/with-timeout.js";
 import type { CursorMcpServerConfig } from "./mcp-resolver.js";
 
 // ---------------------------------------------------------------------------
@@ -437,6 +438,81 @@ export async function resolveAgent(
   };
 }
 
+// ---------------------------------------------------------------------------
+// Transport-recovery wrapper
+// ---------------------------------------------------------------------------
+
+export interface ResolveWithTransportRecoveryOptions {
+  harnessStateId: string;
+  createOptions: CreateAgentOptions | CreateCloudAgentOptions;
+  mode: "local" | "cloud";
+  /** Bound applied to each attempt independently. */
+  timeoutMs: number;
+  /**
+   * Builds the timeout rejection message. `finalAttempt` is true when no
+   * further automatic retry will follow, so the message can be honest about
+   * whether "retry" means the system or the user.
+   */
+  buildTimeoutMessage: (finalAttempt: boolean) => string;
+  /**
+   * Closes the transport the hung attempt is riding on so the next attempt
+   * dials fresh. Injected (rather than imported from the http2 interceptor)
+   * to keep this module transport-agnostic and the recovery unit-testable.
+   */
+  resetTransport: () => void;
+}
+
+/**
+ * Resolve a Cursor Agent with one automatic recovery from a transport hang.
+ *
+ * Agent.create/Agent.resume have no timeout of their own — a degraded
+ * transport (dead proxy connection, stale HTTP/2 session) hangs them forever.
+ * Each attempt is bounded by `timeoutMs`; when the first attempt expires,
+ * the transport is reset and the full resolveAgent() is retried once. Only
+ * a TimeoutError triggers recovery: deterministic failures (auth, validation)
+ * propagate immediately — resetting the transport cannot fix them.
+ *
+ * The retry re-invokes resolveAgent(), not createAgent() directly: at
+ * resolve time only the transport is suspect, not the agent handle, so a
+ * timed-out resume is retried resume-first and conversation context is
+ * preserved. (This deliberately diverges from the stream-phase recovery in
+ * index.ts, which jumps to a fresh create because there the handle itself
+ * has already failed a run.)
+ *
+ * Orphan semantics: withTimeout bounds the wait, not the work, so the first
+ * attempt's promise survives its expiry. resetTransport() closes the HTTP/2
+ * session that attempt is riding on, so the orphan rejects promptly and
+ * withTimeout's attached catch absorbs the late rejection (settled promise —
+ * no unhandledRejection). In the residual case where the orphan completes
+ * before the reset, it leaves an agent that never receives a prompt: no LLM
+ * cost, no state impact, cleaned up with the sandbox.
+ */
+export async function resolveAgentWithTransportRecovery(
+  opts: ResolveWithTransportRecoveryOptions,
+): Promise<AgentResolution> {
+  const attempt = (finalAttempt: boolean) =>
+    withTimeout(
+      opts.timeoutMs,
+      () => opts.buildTimeoutMessage(finalAttempt),
+      () => resolveAgent(opts.harnessStateId, opts.createOptions, opts.mode),
+    );
+
+  try {
+    return await attempt(false);
+  } catch (err) {
+    if (!(err instanceof TimeoutError)) throw err;
+
+    console.warn(
+      `resolveAgentWithTransportRecovery: agent resolution timed out after ` +
+      `${opts.timeoutMs}ms (sessionId=${opts.createOptions.sessionId}, mode=${opts.mode}, ` +
+      `resume=${!!opts.harnessStateId}) — resetting transport and retrying once`,
+    );
+    opts.resetTransport();
+
+    return attempt(true);
+  }
+}
+
 /**
  * Dispose a Cursor Agent when a session is deleted.
  * Best-effort: logs and swallows errors.

package/src/activities/execute-cursor/turn-boundary.ts

@@ -42,6 +42,7 @@ import {
   denialKindOf,
   primaryToken,
   readDenialLedger,
+  unattendedDenials,
   type ApprovalGrant,
 } from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
@@ -50,6 +51,7 @@ import {
   clearProvisionalPostDenialNarration,
   detectUnattributedHookBlocks,
   reconcileDeniedToolCalls,
+  stampUnattendedSkippedToolCalls,
   type UnattributedHookBlock,
 } from "./message-translator.js";
 
@@ -302,6 +304,27 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     }
   }
 
+  // Unattended approval mode (DD-014): denials the hook resolved with the
+  // non-pausing "unattended" kind never became gates above; settle their
+  // streamed rows (FAILED-with-hook-error or interrupted non-terminal) to
+  // honest TOOL_CALL_SKIPPED + UNATTENDED_SKIP provenance — the same shape
+  // the native harness's reconcileUnattendedSkips persists. Runs before the
+  // #205 attribution pass, which then never sees them as hook-block FAILED
+  // rows (they are in the full ledger regardless, so attribution was safe
+  // either way).
+  const stampedUnattended = stampUnattendedSkippedToolCalls(
+    status.messages,
+    status.subAgentExecutions,
+    unattendedDenials(deniedLedger),
+    primaryWorkspaceDir,
+  );
+  if (stampedUnattended > 0) {
+    console.log(
+      `ExecuteCursor turn boundary: ${stampedUnattended} unattended-mode tool call(s) ` +
+      `settled as SKIPPED (no approver on this surface; execution=${executionId})`,
+    );
+  }
+
   // Issue #205 invariant: a blocked tool must never silently complete. Match
   // this turn's hook-blocked FAILED rows against the FULL ledger (all kinds) —
   // anything left over was denied by a hook that is not ours (or by our hook

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -251,6 +251,7 @@ const httpConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  agentResolveTimeoutMs: 120000,
   workspaceLockTimeoutMs: 900000,
 };
 

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -296,6 +296,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  agentResolveTimeoutMs: 120000,
   workspaceLockTimeoutMs: 900000,
 };
 

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -250,6 +250,7 @@ const baseConfig: Config = {
   checkpointerProxyEndpoint: "http://localhost:7234",
   primaryModel: "claude-sonnet",
   cursorStreamStallTimeoutMs: 180000,
+  agentResolveTimeoutMs: 120000,
   workspaceLockTimeoutMs: 900000,
 };
 

package/src/activities/execute-deep-agent/__tests__/hitl.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { Command } from "@langchain/langgraph";
-import { resolveResumeInput, reconcileNonExecutingDecisions } from "../hitl.js";
-import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { resolveResumeInput, reconcileNonExecutingDecisions, reconcileUnattendedSkips } from "../hitl.js";
+import { ApprovalAction, ApprovalPolicySource, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { create } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
@@ -238,3 +238,104 @@ describe("reconcileNonExecutingDecisions", () => {
     expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });
+
+describe("reconcileUnattendedSkips (DD-014)", () => {
+  function statusWithCalls(
+    toolCalls: Array<{ id: string; status: ToolCallStatus; result?: string }>,
+  ) {
+    return create(AgentExecutionStatusSchema, {
+      messages: [
+        create(AgentMessageSchema, {
+          toolCalls: toolCalls.map(tc =>
+            create(ToolCallSchema, {
+              id: tc.id,
+              name: "gated_tool",
+              status: tc.status,
+              result: tc.result ?? "",
+            }),
+          ),
+        }),
+      ],
+    });
+  }
+
+  it("terminalizes a registry-recorded call to SKIPPED with UNATTENDED_SKIP provenance", () => {
+    // The stream saw the gate's skip ToolMessage as a normal tool result and
+    // marked the call COMPLETED — the reconciler owns the honest terminal shape.
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "was skipped" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+    expect(tc.policyEngineVersion).not.toBe("");
+    // Server-owned human-decision fields stay untouched (DD-014 D-e).
+    expect(tc.approvalAction).toBe(ApprovalAction.UNSPECIFIED);
+    expect(tc.approvedBy).toBe("");
+  });
+
+  it("backfills the skip result on a row whose tool events never fired", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_RUNNING },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.result).toContain("skipped automatically");
+  });
+
+  it("touches only registry entries and no-ops on an empty/absent registry", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "real result" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["other-call"]));
+    reconcileUnattendedSkips(status, new Set());
+    reconcileUnattendedSkips(status, undefined);
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tc.result).toBe("real result");
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNSPECIFIED);
+  });
+
+  it("covers sub-agent transcripts (sub-agent gates share the parent registry)", () => {
+    const status = create(AgentExecutionStatusSchema, {
+      messages: [],
+      subAgentExecutions: [{
+        messages: [
+          create(AgentMessageSchema, {
+            toolCalls: [create(ToolCallSchema, {
+              id: "sub-call-1",
+              name: "gated_tool",
+              status: ToolCallStatus.TOOL_CALL_COMPLETED,
+            })],
+          }),
+        ],
+      }],
+    });
+
+    reconcileUnattendedSkips(status, new Set(["sub-call-1"]));
+
+    const tc = status.subAgentExecutions[0].messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+  });
+
+  it("is idempotent", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+    const after = JSON.stringify(status.messages[0].toolCalls[0]);
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    expect(JSON.stringify(status.messages[0].toolCalls[0])).toBe(after);
+  });
+});