@koda-sl/baker-bridge 0.109.0-dev.afb6a264b → 0.109.0-dev.f7ef4c7e1

package/dist/hono/bridge-job.test.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { mkdir, mkdtemp, rm, utimes, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -16,8 +17,10 @@ vi.mock("./runtime-files.ts", async (importOriginal) => {
     };
 });
 import { AVATAR_CASTING_TOOL_NAME } from "./avatar-casting.js";
+import { FACE_PICK_QUESTION } from "./avatar-face-question.js";
 import { BridgeJobExecutor, createStallDetector, isContextOverflowRefusal, isControlChannelDeny, parsePlanDecision, remapAnswersToQuestionText, } from "./bridge-job.js";
 import { CONNECTION_INPUT_TOOL_NAME } from "./connection-input.js";
+import { CREDENTIAL_INPUT_TOOL_NAME } from "./credential-input.js";
 import { FLOW_INPUT_TOOL_NAME } from "./flow-input.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { TAG_INPUT_TOOL_NAME } from "./tag-input.js";
@@ -49,6 +52,7 @@ function activeControls() {
         pendingTagInputs: new Map(),
         pendingFlowInputs: new Map(),
         pendingConnectionInputs: new Map(),
+        pendingCredentialInputs: new Map(),
         pendingVoiceCasts: new Map(),
         pendingAvatarCastings: new Map(),
         isActive: () => active,
@@ -82,6 +86,8 @@ function recordingRelay() {
         flowInputResolved: () => Promise.resolve(),
         connectionInputRequest: () => Promise.resolve(true),
         connectionInputResolved: () => Promise.resolve(),
+        credentialInputRequest: () => Promise.resolve(true),
+        credentialInputResolved: () => Promise.resolve(),
         avatarCastingRequest: () => Promise.resolve(true),
         avatarCastingResolved: () => Promise.resolve(),
         assistantEvent: (target, event, model) => {
@@ -222,6 +228,8 @@ function createExecutor(options) {
         stallTimeoutMs: options.stallTimeoutMs,
         stallCheckIntervalMs: options.stallCheckIntervalMs,
         turnEndSettleMs: options.turnEndSettleMs,
+        // A test that ends on a silent settle waits no longer than its settle window.
+        turnEndWakeMs: options.turnEndWakeMs ?? options.turnEndSettleMs,
         turnEndExitGuardMs: options.turnEndExitGuardMs,
         settleWorkspace: options.settleWorkspace ?? (() => Promise.resolve()),
         ...(options.turnEvents
@@ -321,7 +329,7 @@ describe("isControlChannelDeny", () => {
         // Its block arrives as an is_error tool_result, so an envelope-substring
         // match counted it as a deny — three blocked spawns in one turn would have
         // tripped the breaker and errored a perfectly healthy turn.
-        expect(isControlChannelDeny(controlChannelDenyMessage("PreToolUse:Agent hook error: [node __tooling__/hooks/base/guard-background-commands.mjs]: " +
+        expect(isControlChannelDeny(controlChannelDenyMessage("PreToolUse:Agent hook error: [node __tooling__/checks/base/guard-background-commands/guard-background-commands.mjs]: " +
             "✗ guard-background-commands — blocked: subagent spawned in the background.\n" +
             "  A subagent that outlives the turn loses its permission channel and orphans\n" +
             "  any work it started (a render inside it fails 'Tool permission request failed')."))).toBe(false);
@@ -1097,7 +1105,10 @@ describe("BridgeJobExecutor", () => {
         // web-plugin opt-out at their integration point: all must actually reach the
         // subprocess body via CLAUDE_CODE_EXTRA_BODY.
         expect(JSON.parse(env?.CLAUDE_CODE_EXTRA_BODY ?? "{}")).toEqual({
-            provider: { order: ["amazon-bedrock"], allow_fallbacks: true },
+            provider: {
+                order: ["amazon-bedrock", "amazon-bedrock/eu-west-1", "amazon-bedrock/us-east-1"],
+                allow_fallbacks: true,
+            },
             session_id: "thread_env",
             plugins: [{ id: "web", enabled: false }],
         });
@@ -1125,7 +1136,31 @@ describe("BridgeJobExecutor", () => {
             NO_COLOR: "1",
         });
     });
-    // The three shared subagents pin themselves to Sonnet 5 in their own
+    // Without the wrapper, a burst of parallel commands can fill the sandbox's
+    // memory and the OOM killer takes the agent or the credential broker instead.
+    it("runs every agent command through the kill-first wrapper, whatever started the bridge", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_wrapped"))],
+        });
+        await executor.execute({ threadId: "thread_wrapped", turnId: "turn_wrapped", prompt: "Research competitors", history: history([]) }, activeControls());
+        const prefix = queryInputs[0]?.options.env?.CLAUDE_CODE_SHELL_PREFIX ?? "";
+        expect(readFileSync(prefix, "utf8")).toContain("oom_score_adj");
+    });
+    // The CLI clamps a Bash call's timeout to 10 minutes by default, so the
+    // workspace hook's 30 minutes for `baker canvas run` became 600 s and a
+    // render with a repair round was moved to the background (dev, Oct 2026).
+    it("lets a Bash call run the 30 minutes the workspace's timeout hook gives a render", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_long"))],
+        });
+        await executor.execute({ threadId: "thread_long", turnId: "turn_long", prompt: "Render the ad", history: history([]) }, activeControls());
+        expect(Number(queryInputs[0]?.options.env?.BASH_MAX_TIMEOUT_MS)).toBeGreaterThanOrEqual(30 * 60_000);
+    });
+    // The four shared subagents pin themselves to Sonnet 5.5 in their own
     // frontmatter. Since CLI 2.1.251 CLAUDE_CODE_SUBAGENT_MODEL is only the default
     // under that pin, so the override needs the FORCE flag to outrank it.
     it("sends the Runtime's model override down to the fan-out workers", async () => {
@@ -1142,7 +1177,7 @@ describe("BridgeJobExecutor", () => {
         });
     });
     // Production pins nothing, and the variable must then be absent rather than
-    // empty: sending it would strip every worker's own Sonnet 5 pin.
+    // empty: sending it would strip every worker's own Sonnet 5.5 pin.
     it("leaves the workers on their own pinned model when nothing is overridden", async () => {
         vi.stubEnv("BAKER_AGENT_MODEL", "");
         const queryInputs = [];
@@ -1373,6 +1408,24 @@ describe("BridgeJobExecutor", () => {
         await executor.execute({ threadId: "thread_uw", turnId: "turn_uw", prompt: "Hi", history: history([]) }, activeControls());
         expect((queryInputs[0]?.options.settings ?? {})).not.toHaveProperty("autoCompactWindow");
     });
+    it("asks for manual approvals outside plan mode, so canUseTool decides every tool call instead of auto mode", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_permission_mode"))],
+        });
+        await executor.execute({ threadId: "thread_pm", turnId: "turn_pm", prompt: "Hi", history: history([]) }, activeControls());
+        expect(queryInputs[0]?.options.permissionMode).toBe("default");
+    });
+    it("keeps subagent prompt caches for an hour, so a subagent outliving a long render still reads its cache", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_subagent_ttl"))],
+        });
+        await executor.execute({ threadId: "thread_ttl", turnId: "turn_ttl", prompt: "Hi", history: history([]) }, activeControls());
+        expect(queryInputs[0]?.options.settings).toMatchObject({ subagentPromptCacheTtl: "1h" });
+    });
     // No output style is sent. `Concise` was pinned against Opus 5's preamble; on
     // Opus 5.5 it suppressed the one-line progress notes a marketer reads while a
     // long turn works. The voice rules live in the scaffold CLAUDE.md instead.
@@ -1385,20 +1438,6 @@ describe("BridgeJobExecutor", () => {
         await executor.execute({ threadId: "thread_style", turnId: "turn_style_1", prompt: "Hi", history: history([]) }, activeControls());
         expect((queryInputs[0]?.options.settings ?? {})).not.toHaveProperty("outputStyle");
     });
-    // Nothing to put in the settings tier (unknown model window, no chat id for the
-    // memory directory) means no `settings` key at all: the SDK forwards even `{}`
-    // to the CLI as a `--settings` flag tier.
-    it("omits the settings tier when nothing in it applies", async () => {
-        vi.stubEnv("BAKER_CHAT_ID", "");
-        const queryInputs = [];
-        const executor = createExecutor({
-            queryInputs,
-            model: "claude-unknown",
-            queryResults: [scriptedMessages(resultMessage(0, "session_no_settings"))],
-        });
-        await executor.execute({ threadId: "thread_ns", turnId: "turn_ns", prompt: "Hi", history: history([]) }, activeControls());
-        expect(queryInputs[0]?.options).not.toHaveProperty("settings");
-    });
     it("runs exact publish commands with the prompt passed through verbatim", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -1443,6 +1482,24 @@ describe("BridgeJobExecutor", () => {
         expect(queryInputs[0]?.prompt).toBe("make the headline bigger");
         expect(queryInputs[0]?.reminder).toContain('landing "Homepage" (slug: homepage)');
     });
+    it("explains a credential the message names beside it, together with the viewing reference", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_credential"))],
+        });
+        await executor.execute({
+            threadId: "thread_credential",
+            turnId: "turn_credential",
+            prompt: "log in with user admin and password {{credential:password}}",
+            history: history([]),
+            currentReference: { type: "landing", slug: "homepage", title: "Homepage" },
+            credentials: [{ name: "password", label: "Login password", allowedHosts: [] }],
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).toBe("log in with user admin and password {{credential:password}}");
+        expect(queryInputs[0]?.reminder).toContain('landing "Homepage"');
+        expect(queryInputs[0]?.reminder).toContain("`{{credential:password}}` is a credential the user saved");
+    });
     it("strips newlines from the viewing reference so a crafted title can't inject instructions", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -2114,6 +2171,224 @@ describe("BridgeJobExecutor", () => {
         expect(connectionRequests).toHaveLength(1);
         expect(decision).toMatchObject({ behavior: "allow" });
     });
+    it("loads a server the user connected from the card into this same turn, and tells the agent it is ready", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        const acme = { type: "http", url: "https://acme.dev/mcp" };
+        const asks = [];
+        const loaded = [];
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ server: { name: "acme", url: "https://acme.dev/mcp", auth: "none" }, reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", server: "acme", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_connect");
+                    },
+                    setMcpServers: (servers) => {
+                        loaded.push(servers);
+                        return Promise.resolve({ added: ["acme"], removed: [], errors: {} });
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: (_threadId, _actor, options) => {
+                asks.push(options ?? {});
+                const servers = options?.fresh ? { acme } : {};
+                return Promise.resolve(servers);
+            },
+        });
+        await executor.execute({ threadId: "thread_mcp", turnId: "turn_mcp", prompt: "Connect Acme" }, controls);
+        expect(asks).toEqual([{}, { fresh: true }]);
+        expect(Object.keys(loaded[0] ?? {}).sort()).toEqual(["acme", "baker_ui"]);
+        expect(decision).toMatchObject({ behavior: "allow", updatedInput: { resolution: { toolsReady: true } } });
+    });
+    it("names a server that would not start, so the agent does not promise it for the next message", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ server: { name: "acme", url: "https://acme.dev/mcp" }, reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", server: "acme", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_failed_load");
+                    },
+                    setMcpServers: () => Promise.resolve({ added: [], removed: [], errors: { acme: "401 Unauthorized" } }),
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: () => Promise.resolve({ acme: { type: "http", url: "https://acme.dev/mcp" } }),
+        });
+        await executor.execute({ threadId: "thread_bad", turnId: "turn_bad", prompt: "Connect Acme" }, controls);
+        expect(decision).toMatchObject({
+            updatedInput: { resolution: { toolsReady: false, failedToLoad: ["acme"] } },
+        });
+    });
+    it("does not call an app ready when the reloaded tools do not include it", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ app: "notion", reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", app: "notion", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_missing_app");
+                    },
+                    setMcpServers: () => Promise.resolve({ added: [], removed: [], errors: {} }),
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: () => Promise.resolve({}),
+        });
+        await executor.execute({ threadId: "thread_app", turnId: "turn_app", prompt: "Connect Notion" }, controls);
+        expect(decision).toMatchObject({
+            updatedInput: { resolution: { toolsReady: false, failedToLoad: ["notion"] } },
+        });
+    });
+    it("leaves the turn's tools alone when only a platform was connected", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let reloads = 0;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ platform: "hubspot", reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", platform: "hubspot", selected: [] }] });
+                        }
+                        await asked;
+                        yield resultMessage(0, "session_after_platform");
+                    },
+                    setMcpServers: () => {
+                        reloads += 1;
+                        return Promise.resolve({ added: [], removed: [], errors: {} });
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_pl", turnId: "turn_pl", prompt: "Connect HubSpot" }, controls);
+        expect(reloads).toBe(0);
+    });
+    it("turns request_credential away in a Runtime without Credentials", async () => {
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        decision = await input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        yield resultMessage(0, "session_credential_off");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_co", turnId: "turn_co", prompt: "Fix my theme" }, activeControls());
+        expect(requests).toEqual([]);
+        expect(decision).toMatchObject({ behavior: "deny", message: expect.stringContaining("not available") });
+    });
+    it("parks a credential request and hands the agent only the placeholder the user's answer stored", async () => {
+        vi.stubEnv("BAKER_CREDENTIALS", "1");
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingCredentialInputs) {
+                            pending.resolve({
+                                status: "stored",
+                                name: "shopify-admin-token",
+                                placeholder: "{{credential:shopify-admin-token}}",
+                                allowedHosts: ["acme.myshopify.com"],
+                            });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_credential");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_cr", turnId: "turn_cr", prompt: "Fix my theme" }, controls);
+        expect(requests).toEqual([
+            {
+                toolUseId: "t1",
+                label: "Shopify admin token",
+                reason: "so I can update the theme",
+                allowedHosts: ["acme.myshopify.com"],
+            },
+        ]);
+        expect(decision).toMatchObject({
+            behavior: "allow",
+            updatedInput: { resolution: { status: "stored", placeholder: "{{credential:shopify-admin-token}}" } },
+        });
+    });
     it("refuses to ask for an avatar's face in a tool that renders only text", async () => {
         // Shipped three times, in both modes, after the agent had just read the doc saying
         // not to: "Elige el rostro para Clara, tu presentadora de placas solares" with
@@ -2154,6 +2429,8 @@ describe("BridgeJobExecutor", () => {
             model: "claude-test",
             sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
             relay,
+            // The decision model reads it as a face pick, and not as a question about a page.
+            judge: async (questions) => questions.map(({ instructions }) => (instructions.question === FACE_PICK_QUESTION ? 0.95 : 0.02)),
         });
         await executor.execute({ threadId: "thread_face", turnId: "turn_face", prompt: "Make a TikTok ad" }, controls);
         expect(decision).toMatchObject({ behavior: "deny" });
@@ -2970,6 +3247,30 @@ describe("createStallDetector", () => {
             h.detector.dispose();
         }
     });
+    // Claude Code 2.1.287+ delivers a background task's heartbeats while the model's
+    // stream is stalled; they say nothing about the model, so they must not disarm it.
+    it("still stalls when a background task's heartbeat arrives during the model's silence", async () => {
+        vi.useFakeTimers();
+        const h = harness();
+        try {
+            await h.advance(20);
+            h.detector.observeMessage({
+                type: "tool_progress",
+                tool_use_id: "toolu_bg",
+                tool_name: "Bash",
+                parent_tool_use_id: null,
+                elapsed_time_seconds: 20,
+                heartbeat: true,
+                uuid: "uuid_hb",
+                session_id: "session_a",
+            });
+            await h.advance(30);
+            expect(h.stalls).toHaveLength(1);
+        }
+        finally {
+            h.detector.dispose();
+        }
+    });
     it("does not stall while the silence is still inside the window", async () => {
         vi.useFakeTimers();
         const h = harness();
@@ -3375,6 +3676,24 @@ describe("BridgeJobExecutor turn end with background tasks", () => {
         expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.1 });
         expect(endInputAt.count).toBe(3);
     });
+    // Dev chat, Oct 2026: an auto-backgrounded render settled, input ended one
+    // settle window later, and the model woke ~3 s after the settle on a closed
+    // channel; it started a second render in the background, and the CLI's exit
+    // at its result killed it. The CLI streams nothing between a settle and the
+    // woken turn's first token, so only a longer wait after a settle covers it.
+    it("keeps input open for the model a settled background command wakes, though nothing streams for a while", async () => {
+        const endInputAt = { count: -1 };
+        const executor = createExecutor({
+            turnEndSettleMs: 20,
+            turnEndWakeMs: 5_000,
+            queryResults: [
+                cliLikeQuery(endInputAt, backgroundTasksChanged(["bash_render"]), resultMessage(0.1, "session_bg"), backgroundTasksChanged([]), { pauseMs: 60 }, assistantMessage("msg_wake", "The third render is ready", "session_bg"), resultMessage(0.3, "session_bg")),
+            ],
+        });
+        const outcome = await executor.execute({ threadId: "thread_wake_late", turnId: "turn_wake_late", prompt: "Render three", history: history([]) }, activeControls());
+        expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.3 });
+        expect(endInputAt.count).toBe(5);
+    });
     // The production shape: the model refused, the CLI answered with an error
     // result and then waited on stdin like after any other result. The error was
     // no longer thrown, and only a clean result ended input, so the turn sat idle
@@ -3489,7 +3808,10 @@ describe("BridgeJobExecutor review mode", () => {
         const queryInputs = [];
         const executor = createExecutor({ queryInputs });
         await executor.execute(reviewJob(), activeControls());
-        expect((queryInputs[0]?.options).outputFormat).toEqual({
+        const [reviewQuery] = queryInputs;
+        if (!reviewQuery)
+            throw new Error("expected the review to start one query");
+        expect(reviewQuery.options.outputFormat).toEqual({
             type: "json_schema",
             schema: review.outputSchema,
         });
@@ -3526,7 +3848,9 @@ describe("BridgeJobExecutor review mode", () => {
         const options = queryInputs[0]?.options;
         expect(options.model).toBe("claude-session-model");
         expect(options.outputFormat).toBeUndefined();
-        expect(options.hooks).toBeUndefined();
+        // Only the credential scrub, which every turn runs; none of the review's hooks.
+        expect(Object.keys(options.hooks ?? {})).toEqual(["PostToolUse"]);
+        expect(options.hooks?.PostToolUse).toHaveLength(1);
         expect(options.env?.MAX_STRUCTURED_OUTPUT_RETRIES).toBeUndefined();
         expect(options.disallowedTools).not.toContain("Write");
         expect(options.env?.BAKER_DEBUG_LOG).toBeUndefined();