@stigmer/runner 3.2.2 → 3.2.3

package/src/activities/execute-cursor/index.ts

@@ -39,7 +39,7 @@ import type { Run, ConversationTurn } from "@cursor/sdk";
 
 import type { Config } from "../../config.js";
 import { StigmerClient } from "../../client/stigmer-client.js";
-import { resolveAgent } from "./session-lifecycle.js";
+import { resolveAgentWithTransportRecovery } from "./session-lifecycle.js";
 import type { AgentResolution, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
@@ -57,7 +57,7 @@ import { StreamingUpdateScheduler, loadStreamingConfig } from "../../shared/stre
 import { createCursorEventRecorder } from "./cursor-event-recorder.js";
 import { resolveMcpServers, validateMcpServerEnv } from "./mcp-resolver.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
-import { deriveActiveLeases } from "../../shared/approval-policy.js";
+import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
 import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
@@ -117,7 +117,6 @@ import type { ClassifiedError } from "./error-classifier.js";
 import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
-import { withTimeout } from "../../shared/with-timeout.js";
 import { getShutdownSignalForQueue } from "../../runner-manager.js";
 
 /**
@@ -722,6 +721,11 @@ async function executeCursorInner(
     // absent a git tree keeps gating gitignored writes and a non-git workspace
     // falls back to the deny-gate entirely (no regression).
     const captureIgnored = captureMode && !!artifactStorage;
+    // Unattended approval mode (DD-014): approver-less surfaces (channels,
+    // guest shares) stamp APPROVAL_MODE_UNATTENDED; the hook then records
+    // approval denials with the non-pausing "unattended" kind, so the
+    // first-denial stop never fires and the turn boundary settles the denied
+    // calls as SKIPPED instead of pausing a turn nobody can approve.
     const approvalState = buildApprovalState(
       mergedPolicies,
       globalBypass,
@@ -730,6 +734,7 @@ async function executeCursorInner(
       captureMode,
       captureIgnored,
       gitWorkspace,
+      isUnattendedApprovalMode(execution),
     );
     const hitlGate = await installHitlGate({
       workspaceRoot: primaryWorkspaceDir,
@@ -842,21 +847,29 @@ async function executeCursorInner(
 
     // Agent.create/Agent.resume have no timeout of their own — a degraded
     // transport (dead proxy connection, stale HTTP/2 session) hangs them
-    // forever, which the periodic heartbeat would happily keep alive. The
-    // bound converts that hang into an immediate, named transport failure.
-    // The message carries "timed out" so the error classifier's network
-    // patterns mark it retryable.
+    // forever, which the periodic heartbeat would happily keep alive. Each
+    // attempt is bounded; on expiry the wrapper resets the proxy transport
+    // and retries once, so a stale-session hang recovers without failing the
+    // execution. A second expiry propagates a plain Error to the generic
+    // catch below, which persists EXECUTION_FAILED (no Temporal retry —
+    // the activity returns rather than throws, and maximumAttempts is 1).
     heartbeatPhase = "resolving_agent";
     const resolveTimeoutSeconds = Math.round(config.agentResolveTimeoutMs / 1000);
-    let resolution: AgentResolution = await withTimeout(
-      config.agentResolveTimeoutMs,
-      () =>
+    let resolution: AgentResolution = await resolveAgentWithTransportRecovery({
+      harnessStateId: threadId,
+      createOptions,
+      mode: agentMode,
+      timeoutMs: config.agentResolveTimeoutMs,
+      buildTimeoutMessage: (finalAttempt) =>
         `Cursor agent ${threadId ? "resume" : "create"} timed out after ${resolveTimeoutSeconds}s ` +
         `(${config.proxyEndpoint ? `via proxy ${config.proxyEndpoint}` : "direct Cursor API connection"}). ` +
-        `The transport connection is likely dead. Retry the message; if this persists, ` +
-        `check proxy and network health.`,
-      () => resolveAgent(threadId, createOptions, agentMode),
-    );
+        `The transport connection is likely dead. ` +
+        (finalAttempt
+          ? `An automatic retry on a fresh transport connection also timed out. ` +
+            `Retry the message later; if this persists, check proxy and network health.`
+          : `Resetting the transport and retrying automatically.`),
+      resetTransport: closeProxySessions,
+    });
 
     console.log(
       `ExecuteCursor agent resolved: execution=${executionId}, ` +

package/src/activities/execute-cursor/message-translator.ts

@@ -36,7 +36,7 @@ import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/a
 import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
-import { MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApprovalPolicySource, MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 import type { MergedToolPolicy } from "./approval-policy.js";
 import { lookupMcpToolPolicy, resolveApprovalMessage, builtInRequiresApproval, getBuiltInApprovalMessage, SALIENT_ARG_FIELDS } from "./approval-policy.js";
@@ -44,6 +44,7 @@ import {
   POLICY_ENGINE_VERSION,
   resolveApprovalProvenance,
   toProtoPolicySource,
+  unattendedSkipMessage,
 } from "../../shared/approval-policy.js";
 import {
   approvalDenials,
@@ -1916,6 +1917,86 @@ export function detectUnattributedHookBlocks(
   return blocks;
 }
 
+/**
+ * Stamp the tool calls the hook denied under UNATTENDED approval mode
+ * (DD-014) as terminal TOOL_CALL_SKIPPED rows with UNATTENDED_SKIP
+ * provenance — the Cursor twin of the native harness's
+ * `reconcileUnattendedSkips`, so both harnesses persist the same honest
+ * shape for a platform-resolved skip.
+ *
+ * An unattended denial never pauses the run (its ledger kind is excluded
+ * from {@link approvalDenials}), so the stream leaves the denied call as a
+ * FAILED row carrying Cursor's generic hook-block error — dishonest ("the
+ * tool broke") and alarming in a transcript an org admin reviews. This pass
+ * correlates the unattended ledger entries to their streamed calls with the
+ * SAME two identities the rest of the file uses — exact token, then
+ * (category, workspace-normalized path) for the abs-vs-rel drift — and
+ * settles each match to SKIPPED with a result explaining the skip.
+ *
+ * Scope: hook-blocked FAILED rows and still-non-terminal (PENDING/RUNNING)
+ * rows only — a COMPLETED row is a real execution and is never rewritten
+ * (an unattended deny cannot produce one). `approval_action`/`approved_by`
+ * stay untouched: server-owned, human-decision-only fields (DD-014 D-e).
+ * Unmatched ledger entries need no synthesis — there is no pause to
+ * surface; the model already saw the deny and adapted in-turn.
+ *
+ * Returns how many tool calls were stamped.
+ */
+export function stampUnattendedSkippedToolCalls(
+  messages: readonly AgentMessage[],
+  subAgentExecutions: readonly SubAgentExecution[],
+  unattendedLedger: readonly DeniedLedgerEntry[],
+  workspaceRoot?: string,
+): number {
+  if (unattendedLedger.length === 0) return 0;
+
+  const ledgerTokens = new Set(unattendedLedger.map((e) => e.token));
+  const ledgerNormalizedSalients = new Set<string>();
+  if (workspaceRoot) {
+    for (const entry of unattendedLedger) {
+      const decoded = decodeIdentityToken(entry.token);
+      if (!decoded) continue;
+      const normalized = normalizedFileSalient(decoded.key, decoded.salient, workspaceRoot);
+      if (normalized) ledgerNormalizedSalients.add(normalized);
+    }
+  }
+
+  const matchesLedger = (tc: ToolCall): boolean => {
+    if (ledgerTokens.has(toolCallIdentityToken(tc))) return true;
+    if (!workspaceRoot) return false;
+    const id = toolIdentity(tc.name, tc.mcpServerSlug, toolCallArgs(tc));
+    const normalized = normalizedFileSalient(id.key, id.salient, workspaceRoot);
+    return !!normalized && ledgerNormalizedSalients.has(normalized);
+  };
+
+  let stamped = 0;
+  const apply = (msgs: readonly AgentMessage[]): void => {
+    for (const msg of msgs) {
+      for (const tc of msg.toolCalls) {
+        const deniedShape =
+          (tc.status === ToolCallStatus.TOOL_CALL_FAILED && isHookBlockError(tc.error)) ||
+          tc.status === ToolCallStatus.TOOL_CALL_PENDING ||
+          tc.status === ToolCallStatus.TOOL_CALL_RUNNING;
+        if (!deniedShape || !matchesLedger(tc)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.error = "";
+        tc.result = unattendedSkipMessage(tc.name);
+        tc.isStreaming = false;
+        if (!tc.completedAt) tc.completedAt = utcTimestamp();
+        stamped++;
+      }
+    }
+  };
+
+  apply(messages);
+  for (const subAgent of subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+  return stamped;
+}
+
 /**
  * Compute a streamed tool call's identity token in the same canonical space the
  * preToolUse hook records denials in (see {@link toolIdentity} / primaryToken).

package/src/activities/execute-cursor/session-lifecycle.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 
 import { Agent } from "@cursor/sdk";
 import type { SDKAgent, CursorAgentPlatformOptions, AgentDefinition } from "@cursor/sdk";
+import { withTimeout, TimeoutError } from "../../shared/with-timeout.js";
 import type { CursorMcpServerConfig } from "./mcp-resolver.js";
 
 // ---------------------------------------------------------------------------
@@ -437,6 +438,81 @@ export async function resolveAgent(
   };
 }
 
+// ---------------------------------------------------------------------------
+// Transport-recovery wrapper
+// ---------------------------------------------------------------------------
+
+export interface ResolveWithTransportRecoveryOptions {
+  harnessStateId: string;
+  createOptions: CreateAgentOptions | CreateCloudAgentOptions;
+  mode: "local" | "cloud";
+  /** Bound applied to each attempt independently. */
+  timeoutMs: number;
+  /**
+   * Builds the timeout rejection message. `finalAttempt` is true when no
+   * further automatic retry will follow, so the message can be honest about
+   * whether "retry" means the system or the user.
+   */
+  buildTimeoutMessage: (finalAttempt: boolean) => string;
+  /**
+   * Closes the transport the hung attempt is riding on so the next attempt
+   * dials fresh. Injected (rather than imported from the http2 interceptor)
+   * to keep this module transport-agnostic and the recovery unit-testable.
+   */
+  resetTransport: () => void;
+}
+
+/**
+ * Resolve a Cursor Agent with one automatic recovery from a transport hang.
+ *
+ * Agent.create/Agent.resume have no timeout of their own — a degraded
+ * transport (dead proxy connection, stale HTTP/2 session) hangs them forever.
+ * Each attempt is bounded by `timeoutMs`; when the first attempt expires,
+ * the transport is reset and the full resolveAgent() is retried once. Only
+ * a TimeoutError triggers recovery: deterministic failures (auth, validation)
+ * propagate immediately — resetting the transport cannot fix them.
+ *
+ * The retry re-invokes resolveAgent(), not createAgent() directly: at
+ * resolve time only the transport is suspect, not the agent handle, so a
+ * timed-out resume is retried resume-first and conversation context is
+ * preserved. (This deliberately diverges from the stream-phase recovery in
+ * index.ts, which jumps to a fresh create because there the handle itself
+ * has already failed a run.)
+ *
+ * Orphan semantics: withTimeout bounds the wait, not the work, so the first
+ * attempt's promise survives its expiry. resetTransport() closes the HTTP/2
+ * session that attempt is riding on, so the orphan rejects promptly and
+ * withTimeout's attached catch absorbs the late rejection (settled promise —
+ * no unhandledRejection). In the residual case where the orphan completes
+ * before the reset, it leaves an agent that never receives a prompt: no LLM
+ * cost, no state impact, cleaned up with the sandbox.
+ */
+export async function resolveAgentWithTransportRecovery(
+  opts: ResolveWithTransportRecoveryOptions,
+): Promise<AgentResolution> {
+  const attempt = (finalAttempt: boolean) =>
+    withTimeout(
+      opts.timeoutMs,
+      () => opts.buildTimeoutMessage(finalAttempt),
+      () => resolveAgent(opts.harnessStateId, opts.createOptions, opts.mode),
+    );
+
+  try {
+    return await attempt(false);
+  } catch (err) {
+    if (!(err instanceof TimeoutError)) throw err;
+
+    console.warn(
+      `resolveAgentWithTransportRecovery: agent resolution timed out after ` +
+      `${opts.timeoutMs}ms (sessionId=${opts.createOptions.sessionId}, mode=${opts.mode}, ` +
+      `resume=${!!opts.harnessStateId}) — resetting transport and retrying once`,
+    );
+    opts.resetTransport();
+
+    return attempt(true);
+  }
+}
+
 /**
  * Dispose a Cursor Agent when a session is deleted.
  * Best-effort: logs and swallows errors.

package/src/activities/execute-cursor/turn-boundary.ts

@@ -42,6 +42,7 @@ import {
   denialKindOf,
   primaryToken,
   readDenialLedger,
+  unattendedDenials,
   type ApprovalGrant,
 } from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
@@ -50,6 +51,7 @@ import {
   clearProvisionalPostDenialNarration,
   detectUnattributedHookBlocks,
   reconcileDeniedToolCalls,
+  stampUnattendedSkippedToolCalls,
   type UnattributedHookBlock,
 } from "./message-translator.js";
 
@@ -302,6 +304,27 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     }
   }
 
+  // Unattended approval mode (DD-014): denials the hook resolved with the
+  // non-pausing "unattended" kind never became gates above; settle their
+  // streamed rows (FAILED-with-hook-error or interrupted non-terminal) to
+  // honest TOOL_CALL_SKIPPED + UNATTENDED_SKIP provenance — the same shape
+  // the native harness's reconcileUnattendedSkips persists. Runs before the
+  // #205 attribution pass, which then never sees them as hook-block FAILED
+  // rows (they are in the full ledger regardless, so attribution was safe
+  // either way).
+  const stampedUnattended = stampUnattendedSkippedToolCalls(
+    status.messages,
+    status.subAgentExecutions,
+    unattendedDenials(deniedLedger),
+    primaryWorkspaceDir,
+  );
+  if (stampedUnattended > 0) {
+    console.log(
+      `ExecuteCursor turn boundary: ${stampedUnattended} unattended-mode tool call(s) ` +
+      `settled as SKIPPED (no approver on this surface; execution=${executionId})`,
+    );
+  }
+
   // Issue #205 invariant: a blocked tool must never silently complete. Match
   // this turn's hook-blocked FAILED rows against the FULL ledger (all kinds) —
   // anything left over was denied by a hook that is not ours (or by our hook

package/src/activities/execute-deep-agent/__tests__/hitl.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { Command } from "@langchain/langgraph";
-import { resolveResumeInput, reconcileNonExecutingDecisions } from "../hitl.js";
-import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { resolveResumeInput, reconcileNonExecutingDecisions, reconcileUnattendedSkips } from "../hitl.js";
+import { ApprovalAction, ApprovalPolicySource, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { create } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
@@ -238,3 +238,104 @@ describe("reconcileNonExecutingDecisions", () => {
     expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });
+
+describe("reconcileUnattendedSkips (DD-014)", () => {
+  function statusWithCalls(
+    toolCalls: Array<{ id: string; status: ToolCallStatus; result?: string }>,
+  ) {
+    return create(AgentExecutionStatusSchema, {
+      messages: [
+        create(AgentMessageSchema, {
+          toolCalls: toolCalls.map(tc =>
+            create(ToolCallSchema, {
+              id: tc.id,
+              name: "gated_tool",
+              status: tc.status,
+              result: tc.result ?? "",
+            }),
+          ),
+        }),
+      ],
+    });
+  }
+
+  it("terminalizes a registry-recorded call to SKIPPED with UNATTENDED_SKIP provenance", () => {
+    // The stream saw the gate's skip ToolMessage as a normal tool result and
+    // marked the call COMPLETED — the reconciler owns the honest terminal shape.
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "was skipped" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+    expect(tc.policyEngineVersion).not.toBe("");
+    // Server-owned human-decision fields stay untouched (DD-014 D-e).
+    expect(tc.approvalAction).toBe(ApprovalAction.UNSPECIFIED);
+    expect(tc.approvedBy).toBe("");
+  });
+
+  it("backfills the skip result on a row whose tool events never fired", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_RUNNING },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.result).toContain("skipped automatically");
+  });
+
+  it("touches only registry entries and no-ops on an empty/absent registry", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "real result" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["other-call"]));
+    reconcileUnattendedSkips(status, new Set());
+    reconcileUnattendedSkips(status, undefined);
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tc.result).toBe("real result");
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNSPECIFIED);
+  });
+
+  it("covers sub-agent transcripts (sub-agent gates share the parent registry)", () => {
+    const status = create(AgentExecutionStatusSchema, {
+      messages: [],
+      subAgentExecutions: [{
+        messages: [
+          create(AgentMessageSchema, {
+            toolCalls: [create(ToolCallSchema, {
+              id: "sub-call-1",
+              name: "gated_tool",
+              status: ToolCallStatus.TOOL_CALL_COMPLETED,
+            })],
+          }),
+        ],
+      }],
+    });
+
+    reconcileUnattendedSkips(status, new Set(["sub-call-1"]));
+
+    const tc = status.subAgentExecutions[0].messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+  });
+
+  it("is idempotent", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+    const after = JSON.stringify(status.messages[0].toolCalls[0]);
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    expect(JSON.stringify(status.messages[0].toolCalls[0])).toBe(after);
+  });
+});

package/src/activities/execute-deep-agent/hitl.ts

@@ -17,9 +17,11 @@ import { Command } from "@langchain/langgraph";
 import type { AgentExecution, AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ApprovalAction,
+  ApprovalPolicySource,
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { POLICY_ENGINE_VERSION, unattendedSkipMessage } from "../../shared/approval-policy.js";
 
 // APPROVE_ALL resumes the interrupted tool exactly like APPROVE. Its
 // "auto-approve the rest of the run" effect is realized in setup.ts (the
@@ -233,3 +235,52 @@ export function reconcileNonExecutingDecisions(status: AgentExecutionStatus): vo
     apply(subAgent.messages);
   }
 }
+
+/**
+ * Terminalize every tool call the approval gate auto-skipped under UNATTENDED
+ * approval mode — the sibling of {@link reconcileNonExecutingDecisions} for
+ * skips that have no human decision behind them.
+ *
+ * The gate (the single writer of the registry) records each auto-skipped
+ * tool-call id at the moment it returns the skip ToolMessage; this reconciler
+ * (the single writer of the terminal row) folds each id into:
+ * - `status = TOOL_CALL_SKIPPED` — the tool did not run, whatever transient
+ *   status the stream left behind (COMPLETED from a tool_finished that carried
+ *   the skip message, or RUNNING when no tool events fired);
+ * - `approval_policy_source = UNATTENDED_SKIP` — the resolution layer,
+ *   overriding the gating-layer source stamped at tool-start (the
+ *   AUTO_APPROVE_ALL precedent: layer-4 resolutions own the resolved call);
+ * - a result backfilled from {@link unattendedSkipMessage} when the stream
+ *   delivered none, so the transcript row is never blank.
+ *
+ * `approval_action` / `approved_by` are deliberately NOT touched — those are
+ * server-owned fields recording HUMAN decisions only (DD-014 D-e). No
+ * approval-request event exists for these calls, so the pending-approvals
+ * projection stays empty by construction. Idempotent: re-running re-resolves
+ * identically. Covers sub-agent transcripts because sub-agent gates inherit
+ * the parent's registry instance.
+ */
+export function reconcileUnattendedSkips(
+  status: AgentExecutionStatus,
+  unattendedSkips: ReadonlySet<string> | undefined,
+): void {
+  if (!unattendedSkips || unattendedSkips.size === 0) return;
+
+  const apply = (messages: readonly AgentMessage[]): void => {
+    for (const msg of messages) {
+      for (const tc of msg.toolCalls) {
+        if (!unattendedSkips.has(tc.id)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.isStreaming = false;
+        if (!tc.result) tc.result = unattendedSkipMessage(tc.name);
+      }
+    }
+  };
+
+  apply(status.messages);
+  for (const subAgent of status.subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+}

package/src/activities/execute-deep-agent/index.ts

@@ -47,7 +47,7 @@ import { StatusBuilder } from "./status-builder.js";
 import { InlinePublisher } from "./inline-publisher.js";
 import { WriteBackCoordinator } from "../../shared/workspace/writeback-coordinator.js";
 import { processPostStream } from "./post-stream.js";
-import { resolveResumeInput, reconcileNonExecutingDecisions, type GraphStateSnapshot } from "./hitl.js";
+import { resolveResumeInput, reconcileNonExecutingDecisions, reconcileUnattendedSkips, type GraphStateSnapshot } from "./hitl.js";
 import { captureApprovalArtifacts } from "./approval-file-change.js";
 import {
   applyCaptureDecisions,
@@ -144,6 +144,7 @@ export function createDeepAgentActivities(config: Config) {
           toolServerMap: setup.toolServerMap,
           leasedCategories: setup.leasedCategories,
           globalBypass: setup.globalBypass,
+          unattended: setup.unattended,
         });
 
         const resume = resolveResumeInput(
@@ -408,6 +409,7 @@ export function createDeepAgentActivities(config: Config) {
             toolServerMap: setup.toolServerMap,
             leasedCategories: setup.leasedCategories,
             globalBypass: setup.globalBypass,
+            unattended: setup.unattended,
           },
           streamVersion: setup.streamVersion,
           // Mid-run live capture (DD-32 / DD-33): attach file_change_progress
@@ -465,6 +467,14 @@ export function createDeepAgentActivities(config: Config) {
         // completion persists below so the terminal status is what is persisted.
         reconcileNonExecutingDecisions(initialStatus);
 
+        // Terminalize every tool call the gate auto-skipped under UNATTENDED
+        // approval mode (DD-014): the skip has no human decision behind it, so
+        // reconcileNonExecutingDecisions cannot see it — this sibling folds the
+        // gate's registry into terminal SKIPPED rows with UNATTENDED_SKIP
+        // provenance, whatever transient status the stream left behind. No-op
+        // for interactive executions (empty registry).
+        reconcileUnattendedSkips(initialStatus, setup.unattendedSkips);
+
         // Turn boundary (capture mode): capture the candidate change set from the
         // git diff and author CANDIDATE_CAPTURED, then stamp the flowed file-edit
         // rows with the change set id — they stay visible in place as

package/src/activities/execute-deep-agent/setup.ts

@@ -59,6 +59,7 @@ import {
 import {
   mergeApprovalPolicies,
   deriveActiveLeases,
+  isUnattendedApprovalMode,
   type MergedToolPolicy,
 } from "../../shared/approval-policy.js";
 import type { ToolApprovalCategory } from "../../shared/tool-kind.js";
@@ -125,6 +126,20 @@ export interface SetupResult {
    * the gate (see ActiveLeases / deriveActiveLeases).
    */
   readonly globalBypass: boolean;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED,
+   * stamped by approver-less surfaces — channels, guest shares). The gate
+   * resolves gated tools as automatic skips instead of interrupting; the
+   * builders never seed WAITING_APPROVAL. See isUnattendedApprovalMode.
+   */
+  readonly unattended: boolean;
+  /**
+   * Tool-call ids the gate auto-skipped under {@link unattended} this turn.
+   * Written ONLY by the approval gate (parent + inherited sub-agent gates
+   * share this instance); read by reconcileUnattendedSkips after the stream
+   * to stamp terminal SKIPPED rows. Empty set when not unattended.
+   */
+  readonly unattendedSkips: Set<string>;
   readonly hasStructuredOutput: boolean;
   readonly streamVersion: "v2" | "v3";
   /**
@@ -440,6 +455,14 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       leases,
     );
 
+    // Unattended approval mode (DD-014): approver-less surfaces (channels,
+    // guest shares) stamp APPROVAL_MODE_UNATTENDED, and the gate resolves
+    // gated tools as automatic skips instead of interrupting. The registry is
+    // the gate→reconciler channel for the skipped tool-call ids; one instance
+    // is shared with sub-agent gates via the inherited config.
+    const unattended = isUnattendedApprovalMode(execution);
+    const unattendedSkips = new Set<string>();
+
     // The approval gate config is the single source of truth for HITL gating,
     // built once and inherited verbatim by sub-agents (so a mutating tool inside
     // a sub-agent is gated identically to one in the parent). Null under the
@@ -476,6 +499,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           isCapturablePath,
           captureIgnored: captureMode && !!artifactStorage,
           recordBlockedSecret: (rawPath: string) => casObserver.recordBlockedSecret(rawPath),
+          unattended,
+          unattendedSkips,
         }
       : null;
 
@@ -648,6 +673,8 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       toolServerMap,
       leasedCategories: leases.categories,
       globalBypass,
+      unattended,
+      unattendedSkips,
       hasStructuredOutput: !!outputSchema,
       streamVersion,
       casObserver,

package/src/activities/execute-deep-agent/status-builder-shared.ts

@@ -157,6 +157,14 @@ export interface ApprovalProvenanceInputs {
   readonly leasedCategories?: ReadonlySet<ToolApprovalCategory>;
   /** Pre-armed spec.auto_approve_all — the one whole-run global bypass. */
   readonly globalBypass: boolean;
+  /**
+   * Unattended approval mode (ExecutionConfig.approval_mode = UNATTENDED):
+   * the gate auto-skips gated calls instead of interrupting, so the builders
+   * must NOT seed WAITING_APPROVAL rows or flip the phase to
+   * WAITING_FOR_APPROVAL — the row streams as RUNNING and the post-stream
+   * `reconcileUnattendedSkips` stamps the terminal SKIPPED + provenance.
+   */
+  readonly unattended?: boolean;
 }
 
 /** Shared empty set so a provider without leases allocates nothing per call. */

package/src/activities/execute-deep-agent/status-builder.ts

@@ -319,6 +319,13 @@ export class StatusBuilder {
       return { requiresApproval: false, message: "", serverSlug };
     }
 
+    // Unattended mode: the gate auto-skips instead of interrupting, so no row
+    // is ever WAITING_APPROVAL and the phase never flips — the streamed row
+    // runs to its skip result and reconcileUnattendedSkips terminalizes it.
+    if (this.approvalProvider.unattended) {
+      return { requiresApproval: false, message: "", serverSlug };
+    }
+
     if (serverSlug) {
       const key = `${serverSlug}/${toolName}`;
       const policy = this.approvalProvider.policies.get(key);

package/src/activities/execute-deep-agent/v3-status-builder.ts

@@ -419,6 +419,13 @@ export class V3StatusBuilder implements ExecutionStatusWriter {
       return { requiresApproval: false, message: "", serverSlug };
     }
 
+    // Unattended mode: the gate auto-skips instead of interrupting, so no row
+    // is ever WAITING_APPROVAL and the phase never flips — the streamed row
+    // runs to its skip result and reconcileUnattendedSkips terminalizes it.
+    if (this.approvalProvider.unattended) {
+      return { requiresApproval: false, message: "", serverSlug };
+    }
+
     if (serverSlug) {
       const key = `${serverSlug}/${toolName}`;
       const policy = this.approvalProvider.policies.get(key);