@stigmer/runner 3.2.2 → 3.3.0

package/src/activities/execute-cursor/index.ts

@@ -39,7 +39,7 @@ import type { Run, ConversationTurn } from "@cursor/sdk";
 
 import type { Config } from "../../config.js";
 import { StigmerClient } from "../../client/stigmer-client.js";
-import { resolveAgent } from "./session-lifecycle.js";
+import { resolveAgentWithTransportRecovery } from "./session-lifecycle.js";
 import type { AgentResolution, CreateAgentOptions, CreateCloudAgentOptions } from "./session-lifecycle.js";
 import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
@@ -55,9 +55,13 @@ import { DeltaEnricher } from "./delta-enricher.js";
 import { TodoTracker } from "./todo-tracker.js";
 import { StreamingUpdateScheduler, loadStreamingConfig } from "../../shared/streaming-scheduler.js";
 import { createCursorEventRecorder } from "./cursor-event-recorder.js";
-import { resolveMcpServers, validateMcpServerEnv } from "./mcp-resolver.js";
+import { resolveMcpServers, toCursorMcpConfig, validateMcpServerEnv } from "./mcp-resolver.js";
+import {
+  injectDatastoreAttachment,
+  synthesizeDatastoreAttachment,
+} from "../../shared/datastore-attachment.js";
 import { mergeApprovalPolicies } from "./approval-policy.js";
-import { deriveActiveLeases } from "../../shared/approval-policy.js";
+import { deriveActiveLeases, isUnattendedApprovalMode } from "../../shared/approval-policy.js";
 import { backfillMcpServersIfNeeded } from "./connect-backfill.js";
 import { resolveExecutionEnv } from "./env-resolver.js";
 import { resolveBlueprint } from "./blueprint-resolver.js";
@@ -117,7 +121,6 @@ import type { ClassifiedError } from "./error-classifier.js";
 import { createAgent, createCloudAgent } from "./session-lifecycle.js";
 import { setMaxListeners } from "node:events";
 import { startHeartbeat } from "../../shared/heartbeat.js";
-import { withTimeout } from "../../shared/with-timeout.js";
 import { getShutdownSignalForQueue } from "../../runner-manager.js";
 
 /**
@@ -584,6 +587,33 @@ async function executeCursorInner(
       client, mcpResolution, blueprint.mergedMcpServerUsages, envVars, sessionOrg,
       heartbeat, secretKeys,
     );
+
+    // Phase 4a2: Synthesize the datastore records attachment (T05).
+    // Deliberately AFTER resolve + backfill: the attachment has no
+    // McpServerUsage and reports discovered capabilities, so the
+    // backfill's destructiveHint tightener can never force-gate
+    // delete_record (which on channels would be silently skipped).
+    // Empty approval maps keep it approval-free by construction.
+    if (blueprint.datastoreUsages.length > 0) {
+      const scopedCredential =
+        (await client.acquireScopedRunnerToken({ agentExecutionId: executionId }))
+        ?? config.stigmerTokenRef?.current
+        ?? config.stigmerToken;
+      const attachment = synthesizeDatastoreAttachment(blueprint.datastoreUsages, {
+        bridgeEndpoint: config.mcpBridgeEndpoint,
+        credential: scopedCredential,
+        backendEndpoint: config.stigmerBackendEndpoint,
+      });
+      if (attachment) {
+        const resolvedServers = injectDatastoreAttachment(
+          mcpResolution.resolvedServers, attachment,
+        );
+        mcpResolution = {
+          resolvedServers,
+          cursorConfig: toCursorMcpConfig(resolvedServers),
+        };
+      }
+    }
     const mcpConfig = mcpResolution.cursorConfig;
 
     // Phase 4b: Merge approval policies from all layers.
@@ -722,6 +752,11 @@ async function executeCursorInner(
     // absent a git tree keeps gating gitignored writes and a non-git workspace
     // falls back to the deny-gate entirely (no regression).
     const captureIgnored = captureMode && !!artifactStorage;
+    // Unattended approval mode (DD-014): approver-less surfaces (channels,
+    // guest shares) stamp APPROVAL_MODE_UNATTENDED; the hook then records
+    // approval denials with the non-pausing "unattended" kind, so the
+    // first-denial stop never fires and the turn boundary settles the denied
+    // calls as SKIPPED instead of pausing a turn nobody can approve.
     const approvalState = buildApprovalState(
       mergedPolicies,
       globalBypass,
@@ -730,6 +765,7 @@ async function executeCursorInner(
       captureMode,
       captureIgnored,
       gitWorkspace,
+      isUnattendedApprovalMode(execution),
     );
     const hitlGate = await installHitlGate({
       workspaceRoot: primaryWorkspaceDir,
@@ -842,21 +878,29 @@ async function executeCursorInner(
 
     // Agent.create/Agent.resume have no timeout of their own — a degraded
     // transport (dead proxy connection, stale HTTP/2 session) hangs them
-    // forever, which the periodic heartbeat would happily keep alive. The
-    // bound converts that hang into an immediate, named transport failure.
-    // The message carries "timed out" so the error classifier's network
-    // patterns mark it retryable.
+    // forever, which the periodic heartbeat would happily keep alive. Each
+    // attempt is bounded; on expiry the wrapper resets the proxy transport
+    // and retries once, so a stale-session hang recovers without failing the
+    // execution. A second expiry propagates a plain Error to the generic
+    // catch below, which persists EXECUTION_FAILED (no Temporal retry —
+    // the activity returns rather than throws, and maximumAttempts is 1).
     heartbeatPhase = "resolving_agent";
     const resolveTimeoutSeconds = Math.round(config.agentResolveTimeoutMs / 1000);
-    let resolution: AgentResolution = await withTimeout(
-      config.agentResolveTimeoutMs,
-      () =>
+    let resolution: AgentResolution = await resolveAgentWithTransportRecovery({
+      harnessStateId: threadId,
+      createOptions,
+      mode: agentMode,
+      timeoutMs: config.agentResolveTimeoutMs,
+      buildTimeoutMessage: (finalAttempt) =>
         `Cursor agent ${threadId ? "resume" : "create"} timed out after ${resolveTimeoutSeconds}s ` +
         `(${config.proxyEndpoint ? `via proxy ${config.proxyEndpoint}` : "direct Cursor API connection"}). ` +
-        `The transport connection is likely dead. Retry the message; if this persists, ` +
-        `check proxy and network health.`,
-      () => resolveAgent(threadId, createOptions, agentMode),
-    );
+        `The transport connection is likely dead. ` +
+        (finalAttempt
+          ? `An automatic retry on a fresh transport connection also timed out. ` +
+            `Retry the message later; if this persists, check proxy and network health.`
+          : `Resetting the transport and retrying automatically.`),
+      resetTransport: closeProxySessions,
+    });
 
     console.log(
       `ExecuteCursor agent resolved: execution=${executionId}, ` +
@@ -907,6 +951,7 @@ async function executeCursorInner(
       instructions: blueprint.instructions,
       userMessage: spec.message,
       skills: skillMetadata,
+      datastoreUsages: blueprint.datastoreUsages,
       subAgents: blueprint.subAgents,
       workspaceDirs: blueprint.workspaceDirs,
       workspaceFileRefs: spec.workspaceFileRefs ?? [],
@@ -1487,6 +1532,7 @@ async function executeCursorInner(
             instructions: blueprint.instructions,
             userMessage: spec.message,
             skills: skillMetadata,
+            datastoreUsages: blueprint.datastoreUsages,
             subAgents: blueprint.subAgents,
             workspaceDirs: blueprint.workspaceDirs,
             workspaceFileRefs: spec.workspaceFileRefs ?? [],
@@ -2043,6 +2089,8 @@ export interface BuildPromptInput {
   instructions: string;
   userMessage: string;
   skills: import("./prompt-builder.js").SkillMetadata[];
+  /** Datastores attached via `datastore_usages` — the `<available_datastores>` section. */
+  datastoreUsages?: import("@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb").DatastoreUsage[];
   subAgents: import("@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb").SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
@@ -2142,6 +2190,7 @@ export function buildPrompt(input: BuildPromptInput): string {
     instructions,
     userMessage,
     skills,
+    datastoreUsages: input.datastoreUsages ?? [],
     subAgents,
     workspaceDirs,
     workspaceFileRefs,

package/src/activities/execute-cursor/message-translator.ts

@@ -36,7 +36,7 @@ import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/a
 import type { AgentMessage, ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { SubAgentExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
 import type { SubAgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/subagent_pb";
-import { MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApprovalPolicySource, MessageType, ToolCallStatus, SubAgentStatus, ToolKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 import type { MergedToolPolicy } from "./approval-policy.js";
 import { lookupMcpToolPolicy, resolveApprovalMessage, builtInRequiresApproval, getBuiltInApprovalMessage, SALIENT_ARG_FIELDS } from "./approval-policy.js";
@@ -44,6 +44,7 @@ import {
   POLICY_ENGINE_VERSION,
   resolveApprovalProvenance,
   toProtoPolicySource,
+  unattendedSkipMessage,
 } from "../../shared/approval-policy.js";
 import {
   approvalDenials,
@@ -1916,6 +1917,86 @@ export function detectUnattributedHookBlocks(
   return blocks;
 }
 
+/**
+ * Stamp the tool calls the hook denied under UNATTENDED approval mode
+ * (DD-014) as terminal TOOL_CALL_SKIPPED rows with UNATTENDED_SKIP
+ * provenance — the Cursor twin of the native harness's
+ * `reconcileUnattendedSkips`, so both harnesses persist the same honest
+ * shape for a platform-resolved skip.
+ *
+ * An unattended denial never pauses the run (its ledger kind is excluded
+ * from {@link approvalDenials}), so the stream leaves the denied call as a
+ * FAILED row carrying Cursor's generic hook-block error — dishonest ("the
+ * tool broke") and alarming in a transcript an org admin reviews. This pass
+ * correlates the unattended ledger entries to their streamed calls with the
+ * SAME two identities the rest of the file uses — exact token, then
+ * (category, workspace-normalized path) for the abs-vs-rel drift — and
+ * settles each match to SKIPPED with a result explaining the skip.
+ *
+ * Scope: hook-blocked FAILED rows and still-non-terminal (PENDING/RUNNING)
+ * rows only — a COMPLETED row is a real execution and is never rewritten
+ * (an unattended deny cannot produce one). `approval_action`/`approved_by`
+ * stay untouched: server-owned, human-decision-only fields (DD-014 D-e).
+ * Unmatched ledger entries need no synthesis — there is no pause to
+ * surface; the model already saw the deny and adapted in-turn.
+ *
+ * Returns how many tool calls were stamped.
+ */
+export function stampUnattendedSkippedToolCalls(
+  messages: readonly AgentMessage[],
+  subAgentExecutions: readonly SubAgentExecution[],
+  unattendedLedger: readonly DeniedLedgerEntry[],
+  workspaceRoot?: string,
+): number {
+  if (unattendedLedger.length === 0) return 0;
+
+  const ledgerTokens = new Set(unattendedLedger.map((e) => e.token));
+  const ledgerNormalizedSalients = new Set<string>();
+  if (workspaceRoot) {
+    for (const entry of unattendedLedger) {
+      const decoded = decodeIdentityToken(entry.token);
+      if (!decoded) continue;
+      const normalized = normalizedFileSalient(decoded.key, decoded.salient, workspaceRoot);
+      if (normalized) ledgerNormalizedSalients.add(normalized);
+    }
+  }
+
+  const matchesLedger = (tc: ToolCall): boolean => {
+    if (ledgerTokens.has(toolCallIdentityToken(tc))) return true;
+    if (!workspaceRoot) return false;
+    const id = toolIdentity(tc.name, tc.mcpServerSlug, toolCallArgs(tc));
+    const normalized = normalizedFileSalient(id.key, id.salient, workspaceRoot);
+    return !!normalized && ledgerNormalizedSalients.has(normalized);
+  };
+
+  let stamped = 0;
+  const apply = (msgs: readonly AgentMessage[]): void => {
+    for (const msg of msgs) {
+      for (const tc of msg.toolCalls) {
+        const deniedShape =
+          (tc.status === ToolCallStatus.TOOL_CALL_FAILED && isHookBlockError(tc.error)) ||
+          tc.status === ToolCallStatus.TOOL_CALL_PENDING ||
+          tc.status === ToolCallStatus.TOOL_CALL_RUNNING;
+        if (!deniedShape || !matchesLedger(tc)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.error = "";
+        tc.result = unattendedSkipMessage(tc.name);
+        tc.isStreaming = false;
+        if (!tc.completedAt) tc.completedAt = utcTimestamp();
+        stamped++;
+      }
+    }
+  };
+
+  apply(messages);
+  for (const subAgent of subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+  return stamped;
+}
+
 /**
  * Compute a streamed tool call's identity token in the same canonical space the
  * preToolUse hook records denials in (see {@link toolIdentity} / primaryToken).

package/src/activities/execute-cursor/prompt-builder.ts

@@ -17,10 +17,11 @@
  */
 
 import { resolve } from "node:path";
-import type { SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
+import type { DatastoreUsage, SubAgent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
 import { ApprovalAction, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { formatContextBridgeText } from "../../shared/context-bridge.js";
+import { formatDatastoresSection } from "../../shared/datastore-attachment.js";
 import {
   formatSenderIdentityText,
   type SenderIdentity,
@@ -53,6 +54,12 @@ export interface EnhancedPromptOptions {
   instructions: string;
   userMessage: string;
   skills: SkillMetadata[];
+  /**
+   * Datastores attached via `datastore_usages` — rendered as the
+   * `<available_datastores>` section (DD-005 SD-5, skills precedent)
+   * pointing the model at the synthesized record tools.
+   */
+  datastoreUsages?: DatastoreUsage[];
   subAgents: SubAgent[];
   workspaceDirs: string[];
   workspaceFileRefs: string[];
@@ -113,6 +120,10 @@ export function buildEnhancedPrompt(options: EnhancedPromptOptions): string {
     sections.push(formatSkillsSection(options.skills));
   }
 
+  if (options.datastoreUsages !== undefined && options.datastoreUsages.length > 0) {
+    sections.push(formatDatastoresSection(options.datastoreUsages));
+  }
+
   if (options.subAgents.length > 0) {
     sections.push(formatSubAgentsSection(options.subAgents));
   }

package/src/activities/execute-cursor/session-lifecycle.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 
 import { Agent } from "@cursor/sdk";
 import type { SDKAgent, CursorAgentPlatformOptions, AgentDefinition } from "@cursor/sdk";
+import { withTimeout, TimeoutError } from "../../shared/with-timeout.js";
 import type { CursorMcpServerConfig } from "./mcp-resolver.js";
 
 // ---------------------------------------------------------------------------
@@ -437,6 +438,81 @@ export async function resolveAgent(
   };
 }
 
+// ---------------------------------------------------------------------------
+// Transport-recovery wrapper
+// ---------------------------------------------------------------------------
+
+export interface ResolveWithTransportRecoveryOptions {
+  harnessStateId: string;
+  createOptions: CreateAgentOptions | CreateCloudAgentOptions;
+  mode: "local" | "cloud";
+  /** Bound applied to each attempt independently. */
+  timeoutMs: number;
+  /**
+   * Builds the timeout rejection message. `finalAttempt` is true when no
+   * further automatic retry will follow, so the message can be honest about
+   * whether "retry" means the system or the user.
+   */
+  buildTimeoutMessage: (finalAttempt: boolean) => string;
+  /**
+   * Closes the transport the hung attempt is riding on so the next attempt
+   * dials fresh. Injected (rather than imported from the http2 interceptor)
+   * to keep this module transport-agnostic and the recovery unit-testable.
+   */
+  resetTransport: () => void;
+}
+
+/**
+ * Resolve a Cursor Agent with one automatic recovery from a transport hang.
+ *
+ * Agent.create/Agent.resume have no timeout of their own — a degraded
+ * transport (dead proxy connection, stale HTTP/2 session) hangs them forever.
+ * Each attempt is bounded by `timeoutMs`; when the first attempt expires,
+ * the transport is reset and the full resolveAgent() is retried once. Only
+ * a TimeoutError triggers recovery: deterministic failures (auth, validation)
+ * propagate immediately — resetting the transport cannot fix them.
+ *
+ * The retry re-invokes resolveAgent(), not createAgent() directly: at
+ * resolve time only the transport is suspect, not the agent handle, so a
+ * timed-out resume is retried resume-first and conversation context is
+ * preserved. (This deliberately diverges from the stream-phase recovery in
+ * index.ts, which jumps to a fresh create because there the handle itself
+ * has already failed a run.)
+ *
+ * Orphan semantics: withTimeout bounds the wait, not the work, so the first
+ * attempt's promise survives its expiry. resetTransport() closes the HTTP/2
+ * session that attempt is riding on, so the orphan rejects promptly and
+ * withTimeout's attached catch absorbs the late rejection (settled promise —
+ * no unhandledRejection). In the residual case where the orphan completes
+ * before the reset, it leaves an agent that never receives a prompt: no LLM
+ * cost, no state impact, cleaned up with the sandbox.
+ */
+export async function resolveAgentWithTransportRecovery(
+  opts: ResolveWithTransportRecoveryOptions,
+): Promise<AgentResolution> {
+  const attempt = (finalAttempt: boolean) =>
+    withTimeout(
+      opts.timeoutMs,
+      () => opts.buildTimeoutMessage(finalAttempt),
+      () => resolveAgent(opts.harnessStateId, opts.createOptions, opts.mode),
+    );
+
+  try {
+    return await attempt(false);
+  } catch (err) {
+    if (!(err instanceof TimeoutError)) throw err;
+
+    console.warn(
+      `resolveAgentWithTransportRecovery: agent resolution timed out after ` +
+      `${opts.timeoutMs}ms (sessionId=${opts.createOptions.sessionId}, mode=${opts.mode}, ` +
+      `resume=${!!opts.harnessStateId}) — resetting transport and retrying once`,
+    );
+    opts.resetTransport();
+
+    return attempt(true);
+  }
+}
+
 /**
  * Dispose a Cursor Agent when a session is deleted.
  * Best-effort: logs and swallows errors.

package/src/activities/execute-cursor/turn-boundary.ts

@@ -42,6 +42,7 @@ import {
   denialKindOf,
   primaryToken,
   readDenialLedger,
+  unattendedDenials,
   type ApprovalGrant,
 } from "./approval-state.js";
 import { deriveTurnCommandProvenance } from "./command-provenance.js";
@@ -50,6 +51,7 @@ import {
   clearProvisionalPostDenialNarration,
   detectUnattributedHookBlocks,
   reconcileDeniedToolCalls,
+  stampUnattendedSkippedToolCalls,
   type UnattributedHookBlock,
 } from "./message-translator.js";
 
@@ -302,6 +304,27 @@ export async function runTurnBoundary(opts: TurnBoundaryOptions): Promise<TurnBo
     }
   }
 
+  // Unattended approval mode (DD-014): denials the hook resolved with the
+  // non-pausing "unattended" kind never became gates above; settle their
+  // streamed rows (FAILED-with-hook-error or interrupted non-terminal) to
+  // honest TOOL_CALL_SKIPPED + UNATTENDED_SKIP provenance — the same shape
+  // the native harness's reconcileUnattendedSkips persists. Runs before the
+  // #205 attribution pass, which then never sees them as hook-block FAILED
+  // rows (they are in the full ledger regardless, so attribution was safe
+  // either way).
+  const stampedUnattended = stampUnattendedSkippedToolCalls(
+    status.messages,
+    status.subAgentExecutions,
+    unattendedDenials(deniedLedger),
+    primaryWorkspaceDir,
+  );
+  if (stampedUnattended > 0) {
+    console.log(
+      `ExecuteCursor turn boundary: ${stampedUnattended} unattended-mode tool call(s) ` +
+      `settled as SKIPPED (no approver on this surface; execution=${executionId})`,
+    );
+  }
+
   // Issue #205 invariant: a blocked tool must never silently complete. Match
   // this turn's hook-blocked FAILED rows against the FULL ledger (all kinds) —
   // anything left over was denied by a hook that is not ours (or by our hook

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -239,6 +239,7 @@ const httpConfig: Config = {
   temporalAddress: "localhost:7233",
   temporalNamespace: "default",
   stigmerBackendEndpoint: "http://localhost:7234",
+  mcpBridgeEndpoint: null,
   stigmerToken: null,
   cursorApiKey: "",
   workspaceRootDir: "/tmp/test",

package/src/activities/execute-deep-agent/__tests__/hitl-resume-approve-all.test.ts

@@ -284,6 +284,7 @@ const baseConfig: Config = {
   temporalAddress: "localhost:7233",
   temporalNamespace: "default",
   stigmerBackendEndpoint: "http://localhost:7234",
+  mcpBridgeEndpoint: null,
   stigmerToken: null,
   cursorApiKey: "",
   workspaceRootDir: "/tmp/test",

package/src/activities/execute-deep-agent/__tests__/hitl-resume-history.test.ts

@@ -238,6 +238,7 @@ const baseConfig: Config = {
   temporalAddress: "localhost:7233",
   temporalNamespace: "default",
   stigmerBackendEndpoint: "http://localhost:7234",
+  mcpBridgeEndpoint: null,
   stigmerToken: null,
   cursorApiKey: "",
   workspaceRootDir: "/tmp/test",

package/src/activities/execute-deep-agent/__tests__/hitl.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect } from "vitest";
 import { Command } from "@langchain/langgraph";
-import { resolveResumeInput, reconcileNonExecutingDecisions } from "../hitl.js";
-import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { resolveResumeInput, reconcileNonExecutingDecisions, reconcileUnattendedSkips } from "../hitl.js";
+import { ApprovalAction, ApprovalPolicySource, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { create } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
@@ -238,3 +238,104 @@ describe("reconcileNonExecutingDecisions", () => {
     expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });
+
+describe("reconcileUnattendedSkips (DD-014)", () => {
+  function statusWithCalls(
+    toolCalls: Array<{ id: string; status: ToolCallStatus; result?: string }>,
+  ) {
+    return create(AgentExecutionStatusSchema, {
+      messages: [
+        create(AgentMessageSchema, {
+          toolCalls: toolCalls.map(tc =>
+            create(ToolCallSchema, {
+              id: tc.id,
+              name: "gated_tool",
+              status: tc.status,
+              result: tc.result ?? "",
+            }),
+          ),
+        }),
+      ],
+    });
+  }
+
+  it("terminalizes a registry-recorded call to SKIPPED with UNATTENDED_SKIP provenance", () => {
+    // The stream saw the gate's skip ToolMessage as a normal tool result and
+    // marked the call COMPLETED — the reconciler owns the honest terminal shape.
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "was skipped" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+    expect(tc.policyEngineVersion).not.toBe("");
+    // Server-owned human-decision fields stay untouched (DD-014 D-e).
+    expect(tc.approvalAction).toBe(ApprovalAction.UNSPECIFIED);
+    expect(tc.approvedBy).toBe("");
+  });
+
+  it("backfills the skip result on a row whose tool events never fired", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_RUNNING },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.result).toContain("skipped automatically");
+  });
+
+  it("touches only registry entries and no-ops on an empty/absent registry", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED, result: "real result" },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["other-call"]));
+    reconcileUnattendedSkips(status, new Set());
+    reconcileUnattendedSkips(status, undefined);
+
+    const tc = status.messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tc.result).toBe("real result");
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNSPECIFIED);
+  });
+
+  it("covers sub-agent transcripts (sub-agent gates share the parent registry)", () => {
+    const status = create(AgentExecutionStatusSchema, {
+      messages: [],
+      subAgentExecutions: [{
+        messages: [
+          create(AgentMessageSchema, {
+            toolCalls: [create(ToolCallSchema, {
+              id: "sub-call-1",
+              name: "gated_tool",
+              status: ToolCallStatus.TOOL_CALL_COMPLETED,
+            })],
+          }),
+        ],
+      }],
+    });
+
+    reconcileUnattendedSkips(status, new Set(["sub-call-1"]));
+
+    const tc = status.subAgentExecutions[0].messages[0].toolCalls[0];
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.approvalPolicySource).toBe(ApprovalPolicySource.UNATTENDED_SKIP);
+  });
+
+  it("is idempotent", () => {
+    const status = statusWithCalls([
+      { id: "call-1", status: ToolCallStatus.TOOL_CALL_COMPLETED },
+    ]);
+
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+    const after = JSON.stringify(status.messages[0].toolCalls[0]);
+    reconcileUnattendedSkips(status, new Set(["call-1"]));
+
+    expect(JSON.stringify(status.messages[0].toolCalls[0])).toBe(after);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/index.test.ts

@@ -35,6 +35,7 @@ describe("ExecuteDeepAgent activity", () => {
     temporalAddress: "localhost:7233",
     temporalNamespace: "default",
     stigmerBackendEndpoint: "http://localhost:7234",
+  mcpBridgeEndpoint: null,
     stigmerToken: null,
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",

package/src/activities/execute-deep-agent/__tests__/sequential-gate-resume.test.ts

@@ -244,6 +244,7 @@ const memoryConfig: Config = {
   temporalAddress: "localhost:7233",
   temporalNamespace: "default",
   stigmerBackendEndpoint: "http://localhost:7234",
+  mcpBridgeEndpoint: null,
   stigmerToken: null,
   cursorApiKey: "",
   workspaceRootDir: "/tmp/test",

package/src/activities/execute-deep-agent/hitl.ts

@@ -17,9 +17,11 @@ import { Command } from "@langchain/langgraph";
 import type { AgentExecution, AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ApprovalAction,
+  ApprovalPolicySource,
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { POLICY_ENGINE_VERSION, unattendedSkipMessage } from "../../shared/approval-policy.js";
 
 // APPROVE_ALL resumes the interrupted tool exactly like APPROVE. Its
 // "auto-approve the rest of the run" effect is realized in setup.ts (the
@@ -233,3 +235,52 @@ export function reconcileNonExecutingDecisions(status: AgentExecutionStatus): vo
     apply(subAgent.messages);
   }
 }
+
+/**
+ * Terminalize every tool call the approval gate auto-skipped under UNATTENDED
+ * approval mode — the sibling of {@link reconcileNonExecutingDecisions} for
+ * skips that have no human decision behind them.
+ *
+ * The gate (the single writer of the registry) records each auto-skipped
+ * tool-call id at the moment it returns the skip ToolMessage; this reconciler
+ * (the single writer of the terminal row) folds each id into:
+ * - `status = TOOL_CALL_SKIPPED` — the tool did not run, whatever transient
+ *   status the stream left behind (COMPLETED from a tool_finished that carried
+ *   the skip message, or RUNNING when no tool events fired);
+ * - `approval_policy_source = UNATTENDED_SKIP` — the resolution layer,
+ *   overriding the gating-layer source stamped at tool-start (the
+ *   AUTO_APPROVE_ALL precedent: layer-4 resolutions own the resolved call);
+ * - a result backfilled from {@link unattendedSkipMessage} when the stream
+ *   delivered none, so the transcript row is never blank.
+ *
+ * `approval_action` / `approved_by` are deliberately NOT touched — those are
+ * server-owned fields recording HUMAN decisions only (DD-014 D-e). No
+ * approval-request event exists for these calls, so the pending-approvals
+ * projection stays empty by construction. Idempotent: re-running re-resolves
+ * identically. Covers sub-agent transcripts because sub-agent gates inherit
+ * the parent's registry instance.
+ */
+export function reconcileUnattendedSkips(
+  status: AgentExecutionStatus,
+  unattendedSkips: ReadonlySet<string> | undefined,
+): void {
+  if (!unattendedSkips || unattendedSkips.size === 0) return;
+
+  const apply = (messages: readonly AgentMessage[]): void => {
+    for (const msg of messages) {
+      for (const tc of msg.toolCalls) {
+        if (!unattendedSkips.has(tc.id)) continue;
+        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        tc.approvalPolicySource = ApprovalPolicySource.UNATTENDED_SKIP;
+        tc.policyEngineVersion = POLICY_ENGINE_VERSION;
+        tc.isStreaming = false;
+        if (!tc.result) tc.result = unattendedSkipMessage(tc.name);
+      }
+    }
+  };
+
+  apply(status.messages);
+  for (const subAgent of status.subAgentExecutions) {
+    apply(subAgent.messages);
+  }
+}