@stigmer/runner 3.40.0 → 3.41.0

package/src/__tests__/history-encryption-e2e.test.ts

@@ -15,8 +15,8 @@
  * converter has no Void special-case — a data-bearing encrypted result
  * would fail its converter lookup.
  *
- * Follows the golden-e2e pattern: tests skip gracefully when the
- * Temporal test server cannot start.
+ * Follows the golden-e2e pattern: the test skips by name only when the
+ * Temporal dev server cannot boot; any later failure fails it.
  */
 
 import { describe, it, expect, beforeAll, afterAll } from "vitest";
@@ -24,9 +24,11 @@ import { randomBytes } from "node:crypto";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { loadWorkflowFromYaml } from "../workflow-engine/loader.js";
+import { IN_TEST_GATE } from "../__test-utils__/test-gate.js";
 import { evaluateExpressionBatch } from "../workflow-engine/expression.js";
 import { EncryptionPayloadCodec } from "@stigmer/temporal-codecs";
-import type { ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
+import type { EngineActivities, ExecuteServerlessWorkflowInput } from "../workflows/engine-core.js";
+import type { HydrateActivities } from "../workflows/execute-from-execution.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const WORKFLOWS_PATH = join(__dirname, "../workflows/index.ts");
@@ -68,7 +70,8 @@ type Worker = import("@temporalio/worker").Worker;
 let env: TestWorkflowEnvironment | null = null;
 let worker: Worker | null = null;
 let workerRunPromise: Promise<void> | null = null;
-let envReady = false;
+/** Why the Temporal dev server could not boot; `null` once it has. */
+let bootError: string | null = "not attempted";
 
 function createMockActivities() {
   return {
@@ -90,6 +93,23 @@ function createMockActivities() {
     EmitWorkflowEvents: async (): Promise<void> => {},
     LoadRecoveryContext: async (): Promise<unknown[]> => [],
     PromoteTaskOutput: async (): Promise<void> => {},
+    CallGrpc: unscheduled("CallGrpc"),
+    CallFunction: unscheduled("CallFunction"),
+    RunScript: unscheduled("RunScript"),
+    RunShell: unscheduled("RunShell"),
+    CallAgent: unscheduled("CallAgent"),
+    UpdateWorkflowTaskApprovalStatus: unscheduled("UpdateWorkflowTaskApprovalStatus"),
+    ClearWorkflowApprovalStatus: unscheduled("ClearWorkflowApprovalStatus"),
+    UpdateWorkflowFileReviewStatus: unscheduled("UpdateWorkflowFileReviewStatus"),
+    GetAwaitingFileReviewChangeSetIds: unscheduled("GetAwaitingFileReviewChangeSetIds"),
+    GetAgentExecutionProgress: unscheduled("GetAgentExecutionProgress"),
+  } satisfies Record<keyof (EngineActivities & HydrateActivities), unknown>;
+}
+
+/** An activity the secret-bearing workflow never schedules; reaching it is a test bug. */
+function unscheduled(name: string): () => Promise<never> {
+  return async () => {
+    throw new Error(`${name} is not scheduled by the secret-bearing workflow`);
   };
 }
 
@@ -110,31 +130,35 @@ function collectByteFields(value: unknown, out: Uint8Array[]): void {
 
 describe("History encryption tripwire — Temporal TestWorkflowEnvironment", () => {
   beforeAll(async () => {
-    try {
-      const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
-      const { Worker: W } = await import("@temporalio/worker");
+    const { TestWorkflowEnvironment: TWE } = await import("@temporalio/testing");
+    const { Worker: W } = await import("@temporalio/worker");
 
+    try {
       env = await TWE.createLocal();
-      worker = await W.create({
-        connection: env.nativeConnection,
-        taskQueue: TASK_QUEUE,
-        workflowsPath: WORKFLOWS_PATH,
-        activities: createMockActivities(),
-        dataConverter: {
-          payloadCodecs: [
-            new EncryptionPayloadCodec({
-              primary: { keyId: "tripwire-key", key: randomBytes(32) },
-            }),
-          ],
-        },
-      });
-      workerRunPromise = worker.run();
-      envReady = true;
     } catch (err: unknown) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.warn(`Temporal test server unavailable (tests will be skipped): ${msg}`);
-      envReady = false;
+      // Inside a gate the test server is a provided dependency: not booting is a failure.
+      if (IN_TEST_GATE) throw err;
+      bootError = err instanceof Error ? err.message : String(err);
+      console.warn(`Temporal dev server cannot boot; the tripwire skips: ${bootError}`);
+      return;
     }
+    bootError = null;
+
+    // Past the boot, a failure is the suite's to report, not to skip.
+    worker = await W.create({
+      connection: env.nativeConnection,
+      taskQueue: TASK_QUEUE,
+      workflowsPath: WORKFLOWS_PATH,
+      activities: createMockActivities(),
+      dataConverter: {
+        payloadCodecs: [
+          new EncryptionPayloadCodec({
+            primary: { keyId: "tripwire-key", key: randomBytes(32) },
+          }),
+        ],
+      },
+    });
+    workerRunPromise = worker.run();
   }, 60_000);
 
   afterAll(async () => {
@@ -145,8 +169,8 @@ describe("History encryption tripwire — Temporal TestWorkflowEnvironment", ()
     if (env) await env.teardown();
   }, 30_000);
 
-  it("records no plaintext secret bytes anywhere in workflow history", async () => {
-    if (!envReady || !env) return;
+  it("records no plaintext secret bytes anywhere in workflow history", async (testCtx) => {
+    if (bootError !== null || !env) return testCtx.skip(`Temporal dev server cannot boot: ${bootError}`);
 
     const workflowId = `tripwire-${Date.now()}`;
     // The starting client has NO codec, mirroring the Java/Go

package/src/__tests__/runner.test.ts

@@ -1,5 +1,5 @@
-import { describe, it, expect } from "vitest";
-import { mapOptionsToConfig } from "../runner.js";
+import { describe, it, expect, vi } from "vitest";
+import { mapOptionsToConfig, releaseAfterDrain } from "../runner.js";
 import type { StigmerRunnerOptions, StigmerRunner } from "../runner.js";
 import type { TokenRef } from "../config.js";
 
@@ -224,3 +224,61 @@ describe("public API exports", () => {
     expect(typeof mod.createStigmerRunner).toBe("function");
   });
 });
+
+describe("releaseAfterDrain", () => {
+  function resources(opts: { harnessFails?: boolean; closeFails?: boolean } = {}) {
+    const order: string[] = [];
+    return {
+      order,
+      value: {
+        shutdownHarnesses: vi.fn(async () => {
+          order.push("harnesses");
+          if (opts.harnessFails) {
+            throw new Error("harness boom");
+          }
+        }),
+        connection: {
+          close: vi.fn(async () => {
+            order.push("connection");
+            if (opts.closeFails) {
+              throw new Error("close boom");
+            }
+          }),
+        },
+      },
+    };
+  }
+
+  it("releases the harnesses, then closes the Temporal connection", async () => {
+    const r = resources();
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).not.toHaveBeenCalled();
+  });
+
+  it("still closes the connection when a harness teardown fails, and logs it", async () => {
+    const r = resources({ harnessFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await releaseAfterDrain(r.value, logError);
+
+    expect(r.order).toEqual(["harnesses", "connection"]);
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Harness shutdown failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("harness boom");
+  });
+
+  it("logs a failed close instead of throwing, so a clean stop stays clean", async () => {
+    const r = resources({ closeFails: true });
+    const logError = vi.fn<(line: string) => void>();
+
+    await expect(releaseAfterDrain(r.value, logError)).resolves.toBeUndefined();
+
+    expect(logError).toHaveBeenCalledTimes(1);
+    expect(logError.mock.calls[0]?.[0]).toContain("Temporal connection close failed after the worker drained");
+    expect(logError.mock.calls[0]?.[0]).toContain("close boom");
+  });
+});

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -727,6 +727,7 @@ function makeConfig() {
     temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
+  mcpPublicEndpoint: null,
     stigmerTokenRef: { current: "test-token" },
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",

package/src/activities/__tests__/discover-mcp-server.hang.test.ts

@@ -14,6 +14,10 @@
  */
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { createServer, type Server } from "node:http";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
+
+/** The runner endpoints discovery fills STIGMER_SERVER_ADDRESS from. */
+const PLATFORM_ENDPOINTS = testConfig();
 
 vi.mock("../../idle-watchdog.js", () => ({
   activityStarted: vi.fn(),
@@ -85,7 +89,7 @@ describe("discovery against a 4xx-then-silent-SSE endpoint (issue #239)", () =>
 
     const promise = discoverMcpServer(
       { mcpServerId: "mcp-monday" },
-      { stigmerClient: stigmerClient as never, transportPosture: "stdio-forbidden" },
+      { stigmerClient: stigmerClient as never, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
     );
     // Attach the rejection expectation BEFORE advancing so the rejection is
     // never momentarily unhandled.

package/src/activities/__tests__/discover-mcp-server.test.ts

@@ -4,6 +4,10 @@ import type {
   DiscoveredToolResult,
   DiscoverMcpServerOutput,
 } from "../discover-mcp-server.js";
+import { testConfig } from "../../__test-utils__/config-fixture.js";
+
+/** The runner endpoints discovery fills STIGMER_SERVER_ADDRESS from. */
+const PLATFORM_ENDPOINTS = testConfig();
 
 vi.mock("../../idle-watchdog.js", () => ({
   activityStarted: vi.fn(),
@@ -221,47 +225,83 @@ describe("DiscoverMcpServer activity", () => {
   });
 
   // ─────────────────────────────────────────────────────────────────────────
-  // injectPlatformEnv
+  // STIGMER_SERVER_ADDRESS — the platform fill (shared/platform-server-address.ts)
   // ─────────────────────────────────────────────────────────────────────────
 
-  describe("injectPlatformEnv", () => {
-    const savedEnv = process.env;
+  describe("the platform STIGMER_SERVER_ADDRESS fill", () => {
+    async function connectionConfigFor(
+      spec: any,
+      executionContext: any,
+      platformEndpoints = PLATFORM_ENDPOINTS,
+    ): Promise<any> {
+      const { discoverMcpServer } = await import("../discover-mcp-server.js");
+      const { MultiServerMCPClient } = await import("@langchain/mcp-adapters");
+      const mockClient = makeMockStigmerClient({
+        mcpServer: makeMcpServer({ metadata: { slug: "stigmer" }, spec }),
+        executionContext,
+      });
+      mockInitializeConnections.mockResolvedValue({});
+      mockGetClient.mockResolvedValue(makeMockMcpClient({ tools: [] }));
+      await discoverMcpServer(
+        { mcpServerId: "mcp-stigmer", executionContextId: "ctx-addr" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints },
+      );
+      return (vi.mocked(MultiServerMCPClient).mock.calls[0][0] as any).stigmer;
+    }
+
+    it("fills a stdio server's required address from the backend endpoint instead of failing closed", async () => {
+      const spec = makeStdioSpec("stigmer", ["mcp-server"]);
+      spec.env = { STIGMER_SERVER_ADDRESS: { description: "gRPC host:port" } };
 
-    afterEach(() => {
-      process.env = savedEnv;
-    });
+      const config = await connectionConfigFor(spec, { spec: { data: {} } });
 
-    it("returns envVars unchanged when no declared keys match", async () => {
-      const { injectPlatformEnv } = await import("../discover-mcp-server.js");
-      const env = { SOME_KEY: "value" };
-      const result = injectPlatformEnv(new Set(["SOME_KEY"]), env);
-      expect(result).toBe(env);
+      // testConfig's backend endpoint is http://127.0.0.1:1.
+      expect(config.env.STIGMER_SERVER_ADDRESS).toBe("127.0.0.1:1");
     });
 
-    it("injects STIGMER_SERVER_ADDRESS from STIGMER_MCP_PUBLIC_ENDPOINT", async () => {
-      const { injectPlatformEnv } = await import("../discover-mcp-server.js");
-      process.env = { ...savedEnv, STIGMER_MCP_PUBLIC_ENDPOINT: "https://mcp.stigmer.ai" };
-      const result = injectPlatformEnv(
-        new Set(["STIGMER_SERVER_ADDRESS"]),
-        { STIGMER_SERVER_ADDRESS: "stale-value" },
+    it("keeps an address the execution context delivered", async () => {
+      const spec = makeStdioSpec("stigmer", ["mcp-server"]);
+      spec.env = { STIGMER_SERVER_ADDRESS: { description: "gRPC host:port" } };
+
+      const config = await connectionConfigFor(
+        spec,
+        { spec: { data: { STIGMER_SERVER_ADDRESS: { value: "other.example:7234" } } } },
+        testConfig({ mcpPublicEndpoint: "https://api.example.com" }),
       );
-      expect(result.STIGMER_SERVER_ADDRESS).toBe("https://mcp.stigmer.ai");
+
+      expect(config.env.STIGMER_SERVER_ADDRESS).toBe("other.example:7234");
     });
 
-    it("does not inject when source env var is not set", async () => {
-      const { injectPlatformEnv } = await import("../discover-mcp-server.js");
-      process.env = { ...savedEnv };
-      delete process.env.STIGMER_MCP_PUBLIC_ENDPOINT;
-      const env = { STIGMER_SERVER_ADDRESS: "original" };
-      const result = injectPlatformEnv(new Set(["STIGMER_SERVER_ADDRESS"]), env);
-      expect(result).toBe(env);
+    it("templates an http server's header from the operator's public endpoint", async () => {
+      const spec = makeHttpSpec("https://mcp.example.com");
+      spec.serverType.value.headers = { "X-Stigmer-Server": "${STIGMER_SERVER_ADDRESS}" };
+      spec.env = { STIGMER_SERVER_ADDRESS: {} };
+
+      const config = await connectionConfigFor(
+        spec,
+        { spec: { data: {} } },
+        testConfig({ mcpPublicEndpoint: "https://api.example.com" }),
+      );
+
+      expect(config.headers["X-Stigmer-Server"]).toBe("api.example.com:443");
     });
 
-    it("returns envVars unchanged when declaredEnvKeys is empty", async () => {
-      const { injectPlatformEnv } = await import("../discover-mcp-server.js");
-      const env = { SOME_KEY: "value" };
-      const result = injectPlatformEnv(new Set(), env);
-      expect(result).toBe(env);
+    it("never hands an http server the backend endpoint: without a public one its required address is a credential the connect flow owes", async () => {
+      const { discoverMcpServer, CredentialResolutionError } = await import("../discover-mcp-server.js");
+      const spec = makeHttpSpec("https://mcp.example.com");
+      spec.env = { STIGMER_SERVER_ADDRESS: {} };
+      const mockClient = makeMockStigmerClient({
+        mcpServer: makeMcpServer({ metadata: { slug: "stigmer" }, spec }),
+        executionContext: { spec: { data: {} } },
+      });
+
+      const promise = discoverMcpServer(
+        { mcpServerId: "mcp-stigmer", executionContextId: "ctx-addr" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
+      );
+
+      await expect(promise).rejects.toThrow(CredentialResolutionError);
+      await expect(promise).rejects.toThrow(/STIGMER_SERVER_ADDRESS/);
     });
   });
 
@@ -291,7 +331,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-123" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.tools).toHaveLength(2);
@@ -320,7 +360,7 @@ describe("DiscoverMcpServer activity", () => {
       await expect(
         discoverMcpServer(
           { mcpServerId: "mcp-123" },
-          { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+          { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
         ),
       ).rejects.toThrow(McpTransportError);
       expect(mockInitializeConnections).not.toHaveBeenCalled();
@@ -348,7 +388,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-456" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.tools).toHaveLength(1);
@@ -369,7 +409,7 @@ describe("DiscoverMcpServer activity", () => {
       });
 
       await expect(
-        discoverMcpServer({ mcpServerId: "mcp-bad" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" }),
+        discoverMcpServer({ mcpServerId: "mcp-bad" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS }),
       ).rejects.toThrow("not found or has no spec");
     });
 
@@ -384,7 +424,7 @@ describe("DiscoverMcpServer activity", () => {
       });
 
       await expect(
-        discoverMcpServer({ mcpServerId: "mcp-noconfig" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" }),
+        discoverMcpServer({ mcpServerId: "mcp-noconfig" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS }),
       ).rejects.toThrow("no valid server type configured");
     });
 
@@ -412,7 +452,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-env", executionContextId: "ctx-abc" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.tools).toEqual([]);
@@ -448,7 +488,7 @@ describe("DiscoverMcpServer activity", () => {
           executionContextId: "ctx-abc",
           executionContextToken: "scoped-ec-token",
         },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(mockClient.getExecutionContextByExecutionId).toHaveBeenCalledWith(
@@ -494,7 +534,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-isc", executionContextId: "ctx-isc" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.tools).toHaveLength(1);
@@ -522,7 +562,7 @@ describe("DiscoverMcpServer activity", () => {
 
       await discoverMcpServer(
         { mcpServerId: "mcp-no-env" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(mockClient.getExecutionContextByExecutionId).not.toHaveBeenCalled();
@@ -548,7 +588,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-no-res" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.tools).toHaveLength(1);
@@ -582,7 +622,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-existing" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.previousToolsFingerprint).not.toBe("");
@@ -617,7 +657,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-fp" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       const expected = toolsFingerprint(result.tools);
@@ -640,7 +680,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-empty" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS },
       );
 
       expect(result.newToolsFingerprint).toBe("");
@@ -665,7 +705,7 @@ describe("DiscoverMcpServer activity", () => {
       await expect(
         discoverMcpServer(
           { mcpServerId: "mcp-monday", executionContextId: "ctx-1" },
-          { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+          { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
         ),
       ).rejects.toThrow(CredentialResolutionError);
       expect(mockInitializeConnections).not.toHaveBeenCalled();
@@ -689,7 +729,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-lenient", executionContextId: "ctx-2" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
       );
       expect(result.tools).toEqual([]);
     });
@@ -714,7 +754,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const result = await discoverMcpServer(
         { mcpServerId: "mcp-optional", executionContextId: "ctx-3" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
       );
       expect(result.tools).toEqual([]);
     });
@@ -731,7 +771,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const promise = discoverMcpServer(
         { mcpServerId: "mcp-monday", executionContextId: "ctx-4" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
       );
       await expect(promise).rejects.toThrow(CredentialResolutionError);
       await expect(promise).rejects.toThrow(/delivered no credentials/);
@@ -755,7 +795,7 @@ describe("DiscoverMcpServer activity", () => {
 
       const promise = discoverMcpServer(
         { mcpServerId: "mcp-monday", executionContextId: "ctx-5" },
-        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden" },
+        { stigmerClient: mockClient as any, transportPosture: "stdio-forbidden", platformEndpoints: PLATFORM_ENDPOINTS },
       );
       await expect(promise).rejects.toThrow(CredentialResolutionError);
       await expect(promise).rejects.toThrow(/MONDAY_ACCESS_TOKEN.*delivered redacted|delivered redacted.*MONDAY_ACCESS_TOKEN/s);
@@ -775,7 +815,7 @@ describe("DiscoverMcpServer activity", () => {
       mockInitializeConnections.mockRejectedValue(new Error("Connection refused"));
 
       await expect(
-        discoverMcpServer({ mcpServerId: "mcp-fail" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed" }),
+        discoverMcpServer({ mcpServerId: "mcp-fail" }, { stigmerClient: mockClient as any, transportPosture: "stdio-allowed", platformEndpoints: PLATFORM_ENDPOINTS }),
       ).rejects.toThrow("Connection refused");
 
       expect(mockClose).toHaveBeenCalled();
@@ -903,6 +943,7 @@ function makeConfig() {
     temporalConnection: {},
     stigmerBackendEndpoint: "http://localhost:7234",
   mcpBridgeEndpoint: null,
+    mcpPublicEndpoint: null,
     stigmerTokenRef: { current: "test-token" },
     cursorApiKey: "",
     workspaceRootDir: "/tmp/test",

package/src/activities/__tests__/workflow-event-activities.test.ts

@@ -4,6 +4,7 @@ import { StigmerClient } from "../../client/stigmer-client.js";
 import { WorkflowEventType } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/event_pb";
 import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
 import { WorkflowTaskStatus } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { WorkflowEventDescriptor } from "../../workflow-engine/types.js";
 
 const mockGetEventLogHighWaterMark = vi.fn<(executionId: string) => Promise<bigint>>();
@@ -648,7 +649,7 @@ describe("toProtoEvent", () => {
       expect(actor!.avatar).toBe("https://example.com/ada.png");
     });
 
-    it("does not map outcome or autoResolved (proto limitation)", () => {
+    it("maps the chosen outcome and a human decision's autoResolved=false", () => {
       const evt = toProtoEvent({
         type: "approval_resolved",
         taskName: "gate",
@@ -657,16 +658,36 @@ describe("toProtoEvent", () => {
         resolvedBy: "bob",
         comment: "",
         waitDurationMs: 1000,
+        autoResolved: false,
+      });
+
+      if (evt.payload.case !== "approvalResolved") throw new Error("unexpected");
+      const p = evt.payload.value;
+      expect(p.outcome).toBe("needs_revision");
+      expect(p.autoResolved).toBe(false);
+      // A human_input gate's outcome is a declared string, never mapped onto
+      // the agent ApprovalAction enum: action stays unset.
+      expect(p.action).toBe(ApprovalAction.UNSPECIFIED);
+    });
+
+    it("maps a timeout auto-resolution: the policy's outcome, autoResolved, no reviewer", () => {
+      const evt = toProtoEvent({
+        type: "approval_resolved",
+        taskName: "gate",
+        occurredAt: NOW,
+        outcome: "escalate",
+        resolvedBy: "",
+        comment: "",
+        waitDurationMs: 5000,
         autoResolved: true,
       });
 
       if (evt.payload.case !== "approvalResolved") throw new Error("unexpected");
-      // action field stays at default (UNSPECIFIED) because toProtoEvent
-      // does not map the string outcome to ApprovalAction enum.
-      // autoResolved has no corresponding proto field.
-      // This documents the current limitation per Finding #2.
-      expect(evt.payload.value.resolvedBy).toBe("bob");
-      expect(evt.payload.value.waitDurationMs).toBe(BigInt(1000));
+      const p = evt.payload.value;
+      expect(p.outcome).toBe("escalate");
+      expect(p.autoResolved).toBe(true);
+      expect(p.resolvedBy).toBe("");
+      expect(p.resolvedByActor).toBeUndefined();
     });
   });
 

package/src/activities/call-agent.ts

@@ -228,7 +228,7 @@ export async function callAgentAction(
   // the author may set is forwarded to a field the runner enforces.
   // model_name replaces the agent's default outright; max_cost_usd feeds
   // the turn runtime's cost guard (shared/cost-guard.ts, both harnesses);
-  // max_tool_rounds feeds resolveRecursionLimit (native
+  // max_tool_rounds feeds resolveToolRoundLimit (native
   // harness only); service_tier and thinking_mode feed the cursor
   // harness's explicit variant selection (issues #357/#772). Zero/unset
   // means "no override" and is omitted.