@stigmer/runner 3.4.0 → 3.5.0

package/src/activities/execute-cursor/index.ts

@@ -45,6 +45,7 @@ import { CursorMode } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_p
 import { determineCursorMode, isCloudMode } from "./cursor-mode.js";
 import { MessageAccumulator, cancelInProgressSubAgentProtos, collapseRedundantToolCallTwins } from "./message-translator.js";
 import { utcTimestamp, persistStatus, reportSetupProgress, slimStatus } from "../../shared/status.js";
+import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
 import { readContextBridge } from "../../shared/context-bridge.js";
 import { readSenderIdentity } from "../../shared/sender-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
@@ -57,6 +58,7 @@ import { TodoTracker } from "./todo-tracker.js";
 import { StreamingUpdateScheduler, loadStreamingConfig } from "../../shared/streaming-scheduler.js";
 import { createCursorEventRecorder } from "./cursor-event-recorder.js";
 import { resolveMcpServers, toCursorMcpConfig, validateMcpServerEnv } from "./mcp-resolver.js";
+import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
 import {
   injectDatastoreAttachment,
   synthesizeDatastoreAttachment,
@@ -189,6 +191,12 @@ async function executeCursorInner(
     startedAt: utcTimestamp(),
   });
 
+  // Cold-start timeline of this turn's setup (warm-agent-surfaces Phase 0):
+  // one mark after each phase, emitted as a single structured log line once
+  // the Cursor agent is resolved (early returns skip it — partial setups are
+  // not comparable cold-start samples).
+  const setupTiming = new TimingRecorder();
+
   // Artifact storage for offloading oversized tool outputs (screenshots, giant
   // dumps) out of the persisted status, and for publishing the plan artifact.
   // Resolved once here so it is available to EVERY persist below. Best-effort via
@@ -198,6 +206,7 @@ async function executeCursorInner(
   // the aggregate size cap) and flips capture mode off (deny-gate fallback).
   const artifactStorage: ArtifactStorage | undefined =
     await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
+  setupTiming.mark("resolve_artifact_storage");
   const statusOffload = artifactStorage
     ? { artifactStorage, executionId }
     : undefined;
@@ -289,17 +298,20 @@ async function executeCursorInner(
     const execution = await client.getExecution(executionId);
     const spec = execution.spec!;
     sessionId = spec.sessionId;
+    setupTiming.mark("fetch_execution");
 
     // Phase 2: Load session and resolve full agent blueprint
     await reportSetupProgress(client, executionId, "Resolving agent blueprint");
     session = await client.getSession(sessionId);
     const blueprint = await resolveBlueprint(client, session, config.workspaceRootDir);
+    setupTiming.mark("resolve_blueprint");
 
     // Phase 2b: Resolve execution environment (MCP server credentials)
     heartbeatPhase = "resolving_environment";
     await reportSetupProgress(client, executionId, "Resolving environment");
     const { envVars, secretKeys } = await resolveExecutionEnv(client, executionId);
     heartbeat();
+    setupTiming.mark("resolve_environment");
 
     // Phase 2c: Provision the workspace (clone git repos / mount local paths)
     // so the LOCAL Cursor agent operates on the actual repo. Cursor previously
@@ -314,6 +326,7 @@ async function executeCursorInner(
     );
     blueprint.workspaceDirs = workspaceProvision.workspaceDirs;
     heartbeat();
+    setupTiming.mark("provision_workspace");
 
     // Git write-back: pushes the session's APPROVED tree to the session
     // branch (stigmer/<session-id>) and keeps one PR open — the same
@@ -404,6 +417,7 @@ async function executeCursorInner(
       }
     }
     heartbeat();
+    setupTiming.mark("acquire_workspace_lock");
 
     // Set OTel baggage so downstream calls carry execution context.
     try {
@@ -577,17 +591,20 @@ async function executeCursorInner(
 
     // Phase 4: Resolve MCP servers with approval policies
     await reportSetupProgress(client, executionId, "Resolving MCP servers");
+    const transportPosture = resolveMcpTransportPosture(config.mode);
     let mcpResolution = await resolveMcpServers(
-      client, blueprint.mergedMcpServerUsages, envVars,
+      client, blueprint.mergedMcpServerUsages, envVars, transportPosture,
     );
+    setupTiming.mark("resolve_mcp_servers");
 
     // Phase 4a: Connect backfill for undiscovered MCP servers
     heartbeatPhase = "resolving_mcp_servers";
     const sessionOrg = session.metadata?.org ?? "";
     mcpResolution = await backfillMcpServersIfNeeded(
       client, mcpResolution, blueprint.mergedMcpServerUsages, envVars, sessionOrg,
-      heartbeat, secretKeys,
+      transportPosture, heartbeat, secretKeys,
     );
+    setupTiming.mark("backfill_mcp");
 
     // Phase 4a2: Synthesize the datastore records attachment (T05).
     // Deliberately AFTER resolve + backfill: the attachment has no
@@ -657,6 +674,7 @@ async function executeCursorInner(
       primaryWorkspaceDir,
     });
     heartbeat();
+    setupTiming.mark("resolve_skills");
 
     // Phase 5b: Resolve attachments (fail-hard — explicit user inputs; see
     // attachment-resolver.ts). Downloads by storage key through the same
@@ -668,6 +686,7 @@ async function executeCursorInner(
       storage: artifactStorage,
     });
     const attachmentPaths = attachmentResults.map((a) => a.relativePath);
+    setupTiming.mark("resolve_attachments");
 
     // Phase 5b3: Exact-apply approved whole-file writes (HITL "what you approve
     // is what gets applied"). The Cursor deny-only harness reinvokes the model,
@@ -797,6 +816,7 @@ async function executeCursorInner(
     stopDenialWatcher = watchDenialLedger(hitlDir, () => {
       turnState.denialLedgerDirty = true;
     });
+    setupTiming.mark("install_hitl_gate");
 
     // Mid-run live capture (DD-32 / DD-33): choose the progress substrate for this
     // turn's workspace shape ONCE (git / non-git CAS / hybrid). It owns its own
@@ -815,6 +835,7 @@ async function executeCursorInner(
 
     // Phase 5d: Ensure model pricing registry is populated before validation
     await ensurePricingLoaded();
+    setupTiming.mark("load_pricing");
 
     // Phase 6: Validate model selection
     const requestedModel = spec.executionConfig?.modelName || "default";
@@ -887,6 +908,12 @@ async function executeCursorInner(
     // the activity returns rather than throws, and maximumAttempts is 1).
     heartbeatPhase = "resolving_agent";
     const resolveTimeoutSeconds = Math.round(config.agentResolveTimeoutMs / 1000);
+    // Close the span since load_pricing here so the resolve_agent segment
+    // below measures the SDK Agent.create/resume call alone, not the
+    // progress-report gRPC + options assembly above (issue #209: resolve_agent
+    // is the largest user-visible setup segment; this split keeps its
+    // historical meaning — the SDK call was already 98%+ of it).
+    setupTiming.mark("prepare_agent");
     let resolution: AgentResolution = await resolveAgentWithTransportRecovery({
       harnessStateId: threadId,
       createOptions,
@@ -909,6 +936,17 @@ async function executeCursorInner(
       `agentId=${resolution.agentId}, resumed=${resolution.resumed}` +
       (resolution.resumeFailureDetail ? `, failureDetail=${resolution.resumeFailureDetail}` : ""),
     );
+    setupTiming.mark("resolve_agent");
+    emitTimingLog("execution_setup", {
+      execution_id: executionId,
+      session_id: sessionId,
+      harness: "cursor",
+      agent_resumed: resolution.resumed,
+      cursor_mode: agentMode,
+      mcp_server_count: blueprint.mergedMcpServerUsages.length,
+      skill_count: blueprint.mergedSkillRefs.length,
+      workspace_entry_count: session.spec?.workspaceEntries?.length ?? 0,
+    }, setupTiming);
 
     errorContext = { model: validatedModel, mode: agentMode, agentId: resolution.agentId };
 
@@ -1068,12 +1106,43 @@ async function executeCursorInner(
       // (e.g. older SDK), the warning is harmless — ignore.
     }
 
+    // Issue #209 forensics: the SDK acquires the local executor — the piece
+    // that actually spawns stdio MCP servers — inside send(), AFTER the
+    // execution_setup timeline above has already been emitted. This one-shot
+    // timeline makes that previously invisible window measurable:
+    // `send_returned` covers the send() call itself, `first_delta` the wait
+    // until the SDK's first delta. Primary send only — the recovery retries
+    // below rebuild the agent and would skew the user-perceived turn start
+    // this measures. No delta (immediate pause/failure) → no line.
+    const turnStartTiming = new TimingRecorder();
+    let turnFirstEventEmitted = false;
+    const primaryOnDelta = makeCursorTurnOnDelta(onDeltaDeps);
+
     // The stall watchdog is armed inside consumeCursorTurnStream (it needs the
     // run to cancel), stored on turnState.stallWatchdog so this shared onDelta can
     // reset it and the activity's finally can stop it as a backstop.
     const run = await resolution.agent.send(effectivePrompt, {
-      onDelta: makeCursorTurnOnDelta(onDeltaDeps),
+      onDelta: (event) => {
+        if (!turnFirstEventEmitted) {
+          turnFirstEventEmitted = true;
+          turnStartTiming.mark("first_delta");
+          emitTimingLog("turn_first_event", {
+            execution_id: executionId,
+            session_id: sessionId,
+            harness: "cursor",
+            agent_resumed: resolution.resumed,
+            mcp_server_count: blueprint.mergedMcpServerUsages.length,
+          }, turnStartTiming);
+        }
+        primaryOnDelta(event);
+      },
     });
+    // Normally send() resolves before any delta arrives, making send_returned
+    // the first segment; if a delta beat it, the line is already emitted and
+    // adding a mark now would be meaningless.
+    if (!turnFirstEventEmitted) {
+      turnStartTiming.mark("send_returned");
+    }
 
     // Everything at an index >= this was produced by THIS turn's stream — the
     // positional turn boundary the approved-command provenance (DD-28) scopes

package/src/activities/execute-cursor/mcp-resolver.ts

@@ -18,6 +18,11 @@ import type { McpServerUsage } from "@stigmer/protos/ai/stigmer/agentic/agent/v1
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { ToolApprovalPolicy } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
 import type { StigmerClient } from "../../client/stigmer-client.js";
+import {
+  assertTransportAllowed,
+  McpTransportError,
+  type McpTransportPosture,
+} from "../../shared/mcp-transport-guard.js";
 import {
   resolveHeaders,
   resolvePlaceholders,
@@ -85,11 +90,17 @@ export interface McpResolutionResult {
  * 2. Extract connection config (stdio or http) from McpServerSpec
  * 3. Extract approval policies from McpServerStatus + McpServerSpec
  * 4. Transform into Cursor SDK's mcpServers config
+ *
+ * @param transportPosture Whether stdio servers may run here (derive via
+ *        resolveMcpTransportPosture(config.mode)). A stdio server under a
+ *        forbidding posture throws {@link McpTransportError} and fails the
+ *        whole resolution — never degraded to a skipped server.
  */
 export async function resolveMcpServers(
   client: StigmerClient,
   usages: McpServerUsage[],
-  envVars: Record<string, string> = {},
+  envVars: Record<string, string>,
+  transportPosture: McpTransportPosture,
 ): Promise<McpResolutionResult> {
   const resolved: ResolvedMcpServer[] = [];
 
@@ -105,8 +116,16 @@ export async function resolveMcpServers(
         ref.slug,
       );
       const server = mcpServerToResolved(mcpServer, ref.slug, serverEnv);
-      if (server) resolved.push(server);
+      if (server) {
+        assertTransportAllowed(server.slug, server.connectionType, transportPosture);
+        resolved.push(server);
+      }
     } catch (err) {
+      if (err instanceof McpTransportError) {
+        // Policy rejection, not a resolution hiccup: swallowing it here
+        // would mean the agent silently loses tools. Fail the execution.
+        throw err;
+      }
       if (err instanceof PlaceholderResolutionError) {
         console.error(
           `MCP server ${ref.org}/${ref.slug}: ${err.message}`,

package/src/activities/execute-cursor/sdk-warmup.ts

@@ -0,0 +1,68 @@
+/**
+ * Cursor SDK state-store warm-up for pool members.
+ *
+ * The first `Agent.create` in a pod pays the SDK's platform construction:
+ * four SQLite-backed stores (run/checkpoint/event stores + notifier) whose
+ * first use loads the sqlite native binding and compiles the schema
+ * migrations. The 2026-07-30 instrumented baseline (issue #209) measured
+ * this at ~1.2s of the ~2.4s `resolve_agent` segment, with a 624ms floor —
+ * roughly half the cost is per-process warm-up, not per-session work.
+ *
+ * Pool members idle between boot and claim, so constructing one throwaway
+ * platform there moves that per-process cost off the user-visible path.
+ * This respects the pool's pre-warm boundary (warm-agent-surfaces DD-C:
+ * image caches only, nothing per-agent): the throwaway store is
+ * org-agnostic, credential-free, and keyed to a synthetic workspace ref.
+ *
+ * Deliberately NOT run on session-mode boots: those pods receive their
+ * execution the moment the worker polls, so a concurrent warm-up would
+ * compete with the real `Agent.create` for the same CPU instead of running
+ * in idle time.
+ */
+
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+export interface SdkWarmupResult {
+  readonly warmed: boolean;
+  readonly durationMs: number;
+  readonly error?: string;
+}
+
+/**
+ * Construct (and abandon) one SDK agent platform on a throwaway temp-dir
+ * state root, forcing the sqlite native binding + store schema work to
+ * happen now instead of inside the first user-facing `Agent.create`.
+ *
+ * Total by construction — warm-up is an optimization and must never affect
+ * the member's ability to serve. The throwaway state root is a few KB on
+ * the pod's ephemeral disk and is intentionally NOT deleted: the SDK memoizes
+ * the platform (with open SQLite handles) for the process lifetime, and
+ * unlinking files under live handles buys nothing on a pod that vanishes
+ * with its disk anyway.
+ *
+ * The `@cursor/sdk` import is dynamic so this module never adds the SDK
+ * bundle to any boot path that doesn't already carry it — by the time the
+ * warm-up runs (after the worker starts polling), the activities have
+ * already loaded the SDK and the import resolves from the module cache.
+ */
+export async function warmCursorSdkStateStores(): Promise<SdkWarmupResult> {
+  const startMs = performance.now();
+  try {
+    const stateRoot = mkdtempSync(join(tmpdir(), "cursor-sdk-warm-"));
+    const { createAgentPlatform } = await import("@cursor/sdk");
+    await createAgentPlatform({ workspaceRef: "stigmer-warm:boot", stateRoot });
+    return { warmed: true, durationMs: elapsed(startMs) };
+  } catch (err) {
+    return {
+      warmed: false,
+      durationMs: elapsed(startMs),
+      error: err instanceof Error ? err.message : String(err),
+    };
+  }
+}
+
+function elapsed(startMs: number): number {
+  return Math.round((performance.now() - startMs) * 10) / 10;
+}

package/src/activities/execute-deep-agent/__tests__/subagent-transformer.test.ts

@@ -121,6 +121,14 @@ describe("createBuiltinSubagents", () => {
     }
   });
 
+  it("gives web_fetch to general-purpose only, when a guard posture is supplied", () => {
+    const result = createBuiltinSubagents(true, [], "strict");
+    for (const sa of result) {
+      const hasWebFetch = sa.tools.some((t) => t.name === "web_fetch");
+      expect(hasWebFetch).toBe(sa.name === "general-purpose");
+    }
+  });
+
   it("built-in subagents have no model override", () => {
     const result = createBuiltinSubagents(true);
     for (const sa of result) {
@@ -140,6 +148,7 @@ describe("transformSingleSubagent", () => {
     parentMcpUsages: [] as McpServerUsage[],
     parentHasNativeThinking: true,
     parentModelName: "claude-sonnet-4-6",
+    webFetchPosture: "strict" as const,
   };
 
   beforeEach(() => {
@@ -202,6 +211,17 @@ describe("transformSingleSubagent", () => {
     expect(hasThinkTool).toBe(false);
   });
 
+  it("always injects web_fetch, regardless of thinking support", async () => {
+    for (const parentHasNativeThinking of [true, false]) {
+      const result = await transformSingleSubagent(mockSubAgentProto(), {
+        ...baseOpts,
+        parentHasNativeThinking,
+      });
+      const hasWebFetch = result!.tools.some((t) => t.name === "web_fetch");
+      expect(hasWebFetch).toBe(true);
+    }
+  });
+
   it("injects think tool when parent lacks native thinking", async () => {
     const proto = mockSubAgentProto();
     const result = await transformSingleSubagent(proto, {
@@ -433,6 +453,7 @@ describe("transformAndCompileSubagents", () => {
     approvalGate: null,
     parentModelName: "claude-sonnet-4-6",
     parentHasNativeThinking: true,
+    webFetchPosture: "strict" as const,
     costCap: undefined,
   };
 
@@ -639,6 +660,7 @@ describe("subagent-transformer edge cases", () => {
       parentMcpUsages: [],
       parentHasNativeThinking: true,
       parentModelName: "claude-sonnet-4-6",
+      webFetchPosture: "strict",
     });
 
     expect(result).not.toBeNull();
@@ -664,6 +686,7 @@ describe("subagent-transformer edge cases", () => {
       approvalGate: null,
       parentModelName: "claude-sonnet-4-6",
       parentHasNativeThinking: true,
+      webFetchPosture: "strict",
       costCap: undefined,
     } as Parameters<typeof transformAndCompileSubagents>[0]);
 
@@ -687,6 +710,7 @@ describe("subagent-transformer edge cases", () => {
       approvalGate: null,
       parentModelName: "claude-sonnet-4-6",
       parentHasNativeThinking: true,
+      webFetchPosture: "strict",
       costCap: undefined,
     } as Parameters<typeof transformAndCompileSubagents>[0]);
 

package/src/activities/execute-deep-agent/setup.ts

@@ -22,12 +22,14 @@ import type { DynamicStructuredTool } from "@langchain/core/tools";
 
 import type { Config } from "../../config.js";
 import type { StigmerClient } from "../../client/stigmer-client.js";
+import { TimingRecorder, emitTimingLog } from "../../shared/cold-start-timing.js";
 import { createCheckpointer } from "../../shared/checkpointer/factory.js";
 import { readContextBridge } from "../../shared/context-bridge.js";
 import { readSenderIdentity } from "../../shared/sender-identity.js";
 import { readSessionContext } from "../../shared/session-context.js";
 import { connectMcpServers, type McpConnectionResult } from "../../shared/mcp-manager.js";
 import { resolveMcpServers } from "../../shared/mcp-resolver.js";
+import { resolveMcpTransportPosture } from "../../shared/mcp-transport-guard.js";
 import { backfillMcpServersIfNeeded } from "../../shared/connect-backfill.js";
 import {
   formatDatastoresSection,
@@ -49,8 +51,9 @@ import { buildWorkspaceFileTree } from "../../shared/workspace/file-tree.js";
 import { reportSetupProgress } from "../../shared/status.js";
 import { resolveEnvironment, type EnvironmentResult } from "./environment.js";
 import { buildEnhancedSystemPrompt } from "./prompt-builder.js";
-import { buildMiddlewareStack, createThinkTool } from "../../middleware/index.js";
+import { buildMiddlewareStack } from "../../middleware/index.js";
 import type { GracefulStopMiddleware } from "../../middleware/index.js";
+import { createThinkTool, createWebFetchTool, resolveGuardPosture } from "../../tools/index.js";
 import type { ApprovalGateConfig } from "../../middleware/approval-gate.js";
 import { deriveExecutionFingerprintKey } from "../../shared/approval-fingerprint.js";
 import { getRunnerHitlMasterSecret } from "../../shared/fingerprint-secret.js";
@@ -194,12 +197,16 @@ export interface SetupDependencies {
 export async function performSetup(deps: SetupDependencies): Promise<SetupResult> {
   const { config, client, executionId, threadId } = deps;
   let mcpConnection: McpConnectionResult | null = null;
+  // Cold-start timeline of this setup (warm-agent-surfaces Phase 0): one mark
+  // after each phase, emitted as a single structured log line before return.
+  const timing = new TimingRecorder();
 
   try {
     // Step 1: Hydrate execution
     await reportSetupProgress(client, executionId, "Fetching execution…");
     const execution = await client.getExecution(executionId);
     console.log(`[setup] Execution fetched: agent_id=${execution.spec?.agentId}`);
+    timing.mark("fetch_execution");
 
     // Step 2: Resolve chain — execution → session → agentInstance → agent
     await reportSetupProgress(client, executionId, "Resolving agent…");
@@ -220,6 +227,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       `[setup] Chain resolved: session=${sessionId}, ` +
       `agent=${agent.metadata!.name}`,
     );
+    timing.mark("resolve_chain");
 
     // Step 3: Resolve model
     const modelName = execution.spec!.executionConfig?.modelName
@@ -237,10 +245,12 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         ? await ensureCheckpointDbPath(sessionId)
         : undefined,
     });
+    timing.mark("create_checkpointer");
 
     // Step 5: Resolve environment
     await reportSetupProgress(client, executionId, "Resolving environment…");
     const envResult: EnvironmentResult = await resolveEnvironment(client, executionId);
+    timing.mark("resolve_environment");
 
     // Step 6: Resolve a usable artifact store (shared with the Cursor harness so
     // both degrade identically). Returns `undefined` — never throws — when there
@@ -250,6 +260,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     // disables offload, instead of flowing writes then crashing at the boundary.
     const artifactStorage: ArtifactStorage | undefined =
       await resolveUsableArtifactStorage(loadArtifactStorageConfig(config), { executionId });
+    timing.mark("resolve_artifact_storage");
 
     // Step 7: Provision workspace
     await reportSetupProgress(client, executionId, "Initializing workspace…");
@@ -259,6 +270,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       envResult.mergedEnvVars,
       sessionId,
     );
+    timing.mark("provision_workspace");
 
     // Apply-then-review is the file-review model whenever there is a capture
     // SUBSTRATE (DD-21 D2, Slice 2b): file edits flow during the turn and are
@@ -325,9 +337,11 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
     let resolvedMcpServers: Awaited<ReturnType<typeof resolveMcpServers>> | null = null;
     if (mcpServerUsages.length > 0 || datastoreUsages.length > 0) {
       await reportSetupProgress(client, executionId, "Connecting tools…");
+      const transportPosture = resolveMcpTransportPosture(config.mode);
       resolvedMcpServers = await resolveMcpServers(
-        client, mcpServerUsages, envResult.mergedEnvVars,
+        client, mcpServerUsages, envResult.mergedEnvVars, transportPosture,
       );
+      timing.mark("resolve_mcp_servers");
 
       const sessionOrg = session.metadata?.org ?? "";
       let backfilledServers = await backfillMcpServersIfNeeded(
@@ -336,6 +350,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         mcpServerUsages,
         envResult.mergedEnvVars,
         sessionOrg,
+        transportPosture,
         undefined,
         envResult.secretKeys,
       );
@@ -359,11 +374,12 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         }
       }
       resolvedMcpServers = { resolvedServers: backfilledServers };
+      timing.mark("backfill_mcp");
 
-      mcpConnection = await connectMcpServers(
-        resolvedMcpServers.resolvedServers,
-        { isCloudMode: config.cloudModeEnabled },
-      );
+      // connect_mcp covers the whole fan-out: stdio servers spawn npx/uvx
+      // subprocesses here, so on-demand package installs land in this span.
+      mcpConnection = await connectMcpServers(resolvedMcpServers.resolvedServers);
+      timing.mark("connect_mcp");
     }
 
     // Step 7b: Resolve and write skills
@@ -407,6 +423,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
           `[setup] Skills loaded: ${skills.length} total, prompt section ${skillsPromptSection.length} chars`,
         );
       }
+      timing.mark("resolve_skills");
     }
 
     // Step 7c: Inject attachments
@@ -417,6 +434,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       storage: artifactStorage,
       isLocalMode: config.mode === "local",
     });
+    timing.mark("inject_attachments");
 
     // Step 8: Build enhanced system prompt
     const systemPrompt = buildEnhancedSystemPrompt({
@@ -449,6 +467,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       headerScope: { executionId },
       timeoutMs: requestTimeoutMs,
     });
+    timing.mark("build_model");
 
     // Step 10: Build middleware stack
     await ensurePricingLoaded();
@@ -563,11 +582,22 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       otelSpans: { toolServerMap },
       approvalGate: approvalGateConfig,
     });
+    timing.mark("build_middleware");
 
-    // Step 11: Build tools list (MCP tools + think tool)
+    // Step 11: Build tools list (MCP tools + native built-in tools).
+    //
+    // web_fetch is always-on for every native run — the same posture as the
+    // Cursor harness, whose WebFetch is a CLI built-in that no configuration
+    // removes (issue #214 parity). It is auto-approved by design (see
+    // toolApprovalCategory in shared/tool-kind.ts), so its URL guard posture
+    // — strict on managed cloud runners, relaxed on user-owned machines — is
+    // the entire safety boundary. Derived from config.mode, NOT the
+    // cloudModeEnabled Cursor feature flag.
+    const webFetchPosture = resolveGuardPosture(config.mode);
     const tools = [
       ...(mcpConnection?.tools as DynamicStructuredTool[] ?? []),
       createThinkTool(),
+      createWebFetchTool({ posture: webFetchPosture }),
     ];
 
     // Step 11b: Transform and compile subagents
@@ -599,6 +629,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         casObserver,
         parentModelName: modelName,
         parentHasNativeThinking: _modelHasNativeThinking(modelName),
+        webFetchPosture,
         costCap: costCapMiddleware ?? undefined,
         modelFactory: async (m: string) =>
           (await buildChatModel({
@@ -611,6 +642,7 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
         // backends too (undefined in plan mode; see buildShellEnv above).
         shellEnv,
       });
+      timing.mark("compile_subagents");
     }
 
     // Step 12: Create the agent graph with middleware
@@ -682,6 +714,15 @@ export async function performSetup(deps: SetupDependencies): Promise<SetupResult
       `tools=${tools.length}, middleware=${middleware.length}, ` +
       `thread_id=${threadId}, streamVersion=${streamVersion}`,
     );
+    timing.mark("create_agent_graph");
+    emitTimingLog("execution_setup", {
+      execution_id: executionId,
+      session_id: sessionId,
+      harness: "native",
+      mcp_server_count: mcpServerUsages.length,
+      skill_count: skillRefs.length,
+      workspace_entry_count: session.spec!.workspaceEntries?.length ?? 0,
+    }, timing);
 
     return {
       agentGraph,

package/src/activities/execute-deep-agent/subagent-transformer.ts

@@ -33,7 +33,7 @@ import type { ApprovalGateConfig } from "../../middleware/approval-gate.js";
 import { createCasCaptureBackend } from "./cas-capture-backend.js";
 import type { CasCaptureObserver } from "./cas-capture-observer.js";
 import type { CostCapMiddleware, StigmerMiddleware } from "../../middleware/index.js";
-import { createThinkTool } from "../../middleware/index.js";
+import { createThinkTool, createWebFetchTool, type GuardPosture } from "../../tools/index.js";
 import { buildSubAgentMiddleware } from "./subagent-wiring.js";
 import { SubAgentGate } from "../../shared/subagent-gate.js";
 import { isModelRegistered } from "../../shared/model-registry.js";
@@ -158,6 +158,12 @@ export interface SubagentTransformOptions {
   readonly casObserver?: CasCaptureObserver;
   readonly parentModelName: string;
   readonly parentHasNativeThinking: boolean;
+  /**
+   * URL-guard posture for the native `web_fetch` tool, inherited from the
+   * parent (resolveGuardPosture(config.mode) in setup.ts) so a sub-agent
+   * fetch is bounded exactly like a parent fetch.
+   */
+  readonly webFetchPosture: GuardPosture;
   readonly costCap?: CostCapMiddleware;
   /**
    * Builds a configured chat-model instance for a given model name. When
@@ -203,6 +209,7 @@ export interface SubagentTransformOptions {
 export function createBuiltinSubagents(
   hasWorkspace: boolean,
   parentMcpTools: readonly StructuredTool[] = [],
+  webFetchPosture?: GuardPosture,
 ): TransformedSubagent[] {
   if (!hasWorkspace) {
     return [];
@@ -216,7 +223,15 @@ export function createBuiltinSubagents(
         name: "general-purpose",
         description: DEFAULT_GENERAL_PURPOSE_DESCRIPTION,
         systemPrompt: DEFAULT_SUBAGENT_PROMPT + RESPONSE_RULES,
-        tools: [...parentMcpTools],
+        // Parent-parity tool set: MCP tools plus the native web_fetch the
+        // parent always carries. explore/shell stay web-less on purpose —
+        // their prompts scope them to the workspace, not the internet.
+        tools: [
+          ...parentMcpTools,
+          ...(webFetchPosture
+            ? [createWebFetchTool({ posture: webFetchPosture }) as unknown as StructuredTool]
+            : []),
+        ],
       });
       continue;
     }
@@ -257,6 +272,7 @@ export async function transformSingleSubagent(
     readonly parentMcpUsages: readonly McpServerUsage[];
     readonly parentHasNativeThinking: boolean;
     readonly parentModelName: string;
+    readonly webFetchPosture: GuardPosture;
   },
 ): Promise<TransformedSubagent | null> {
   const name = subAgent.name;
@@ -290,6 +306,12 @@ export async function transformSingleSubagent(
     tools.push(createThinkTool() as unknown as StructuredTool);
   }
 
+  // web_fetch is unconditional — unlike think, it is a capability, not a
+  // reasoning aid, and the parent always has it (setup.ts Step 11). A
+  // sub-agent silently lacking web access the parent has would recreate the
+  // harness-parity gap of issue #214 one level down.
+  tools.push(createWebFetchTool({ posture: opts.webFetchPosture }) as unknown as StructuredTool);
+
   // Append response rules
   systemPrompt += RESPONSE_RULES;
 
@@ -597,6 +619,7 @@ export async function transformAndCompileSubagents(
     casObserver,
     parentModelName,
     parentHasNativeThinking,
+    webFetchPosture,
     costCap,
     modelFactory,
     shellEnv,
@@ -615,6 +638,7 @@ export async function transformAndCompileSubagents(
   const builtins = createBuiltinSubagents(
     !!workspaceBackend.rootDir,
     parentMcpTools,
+    webFetchPosture,
   );
 
   // Step 1b: Batch fetch all skills referenced by subagents
@@ -665,6 +689,7 @@ export async function transformAndCompileSubagents(
         parentMcpUsages,
         parentHasNativeThinking,
         parentModelName,
+        webFetchPosture,
       });
 
       if (result) {