@librechat/agents 3.4.7 → 3.5.1

package/src/tools/__tests__/directToolHITLResumeScope.test.ts

@@ -1,980 +0,0 @@
-import { z } from 'zod';
-import { tool } from '@langchain/core/tools';
-import { AIMessage, ToolMessage } from '@langchain/core/messages';
-import { describe, it, expect, jest, afterEach } from '@jest/globals';
-import {
-  END,
-  START,
-  StateGraph,
-  MemorySaver,
-  GraphInterrupt,
-  isInterrupted,
-  MessagesAnnotation,
-  Command,
-} from '@langchain/langgraph';
-import type { Runnable, RunnableConfig } from '@langchain/core/runnables';
-import type { StructuredToolInterface } from '@langchain/core/tools';
-import type { ToolCall } from '@langchain/core/messages/tool';
-import type { BaseMessage } from '@langchain/core/messages';
-import type {
-  ReplayableSubagentTool,
-  SettledSubagentToolOutput,
-} from '@/tools/subagent/SubagentReplay';
-import type { PreToolUseHookOutput } from '@/hooks';
-import type * as t from '@/types';
-import {
-  getSubagentResumeManifest,
-  stripSubagentResumeManifest,
-  SUBAGENT_PARENT_BATCH_CONFIG_KEY,
-  SUBAGENT_REPLAY_CONTROLLER,
-} from '@/tools/subagent/SubagentReplay';
-import { HookRegistry } from '@/hooks';
-import { ToolNode } from '../ToolNode';
-
-/**
- * Pins the resume-scope behaviour for direct-path interrupts. The
- * existing JSDoc on `HumanInTheLoopConfig` warned that mixed
- * direct+event batches re-execute the direct half on resume because
- * LangGraph rolls back the entire ToolNode on `interrupt()`. After
- * lifting HITL into the direct path, the same rollback applies — but
- * for direct-only batches too, since `interrupt()` always rewinds to
- * the start of the suspending node.
- *
- * This test makes that concrete: a direct tool whose call is gated
- * by a PreToolUse 'ask' hook fires its execute callback exactly N
- * times, where N == number of resume passes that lead to an
- * 'approve'. Side-effect-bearing tools should be designed
- * idempotent regardless of whether they're direct or event-dispatched.
- */
-
-function aiCall(
-  callId: string | undefined,
-  name: string,
-  args: Record<string, unknown>
-): AIMessage {
-  return new AIMessage({
-    content: '',
-    tool_calls: [{ id: callId, name, args }],
-  });
-}
-
-type MessagesUpdate = { messages: BaseMessage[] };
-type CompiledMessagesGraph = Runnable<unknown, { messages: BaseMessage[] }> & {
-  invoke(input: unknown, config?: RunnableConfig): Promise<unknown>;
-};
-
-function buildGraph(
-  toolNode: ToolNode,
-  toolCalls: Array<{
-    id: string | undefined;
-    name: string;
-    args: Record<string, unknown>;
-  }>
-): CompiledMessagesGraph {
-  let agentInvocations = 0;
-  const builder = new StateGraph(MessagesAnnotation)
-    .addNode('agent', (): MessagesUpdate => {
-      agentInvocations += 1;
-      if (agentInvocations === 1) {
-        return {
-          messages: [
-            aiCall(toolCalls[0].id, toolCalls[0].name, toolCalls[0].args),
-          ],
-        };
-      }
-      return { messages: [] };
-    })
-    .addNode('tools', toolNode)
-    .addEdge(START, 'agent')
-    .addEdge('agent', 'tools')
-    .addEdge('tools', END);
-  return builder.compile({
-    checkpointer: new MemorySaver(),
-  }) as unknown as CompiledMessagesGraph;
-}
-
-describe('direct-path HITL: resume scope', () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('persists a resume manifest beside a primitive child interrupt', async () => {
-    const directTool = tool(
-      async () => {
-        throw new GraphInterrupt([
-          { id: 'primitive-interrupt', value: 'confirm child' },
-        ]);
-      },
-      {
-        name: 'subagent',
-        description: 'primitive interrupt subagent',
-        schema: z.object({ description: z.string() }),
-      }
-    ) as unknown as StructuredToolInterface;
-    const manifest = {
-      version: 1 as const,
-      executions: [
-        {
-          parentToolCallId: 'call_primitive',
-          childRunId: 'child-run',
-          approvalExecutionScope: 'child-approval-attempt',
-          checkpoints: [
-            {
-              threadId: 'child-thread',
-              checkpointId: 'child-checkpoint',
-              checkpointNs: '',
-            },
-          ],
-          graphState: {
-            toolCallSteps: [],
-            toolSessions: [],
-            toolNodes: [],
-            eagerToolUsage: [],
-            eagerToolSuppressions: [],
-          },
-          approvalReplays: [],
-        },
-      ],
-    };
-    const replayableTool = directTool as StructuredToolInterface &
-      ReplayableSubagentTool;
-    const getResumeManifest = jest.fn(
-      async (
-        _parentToolCallIds?: ReadonlySet<string>,
-        _config?: RunnableConfig
-      ) => manifest
-    );
-    const getSettledOutput = jest.fn(
-      async (
-        _call: ToolCall,
-        _config: RunnableConfig
-      ): Promise<SettledSubagentToolOutput | undefined> => undefined
-    );
-    replayableTool[SUBAGENT_REPLAY_CONTROLLER] = {
-      getResumeManifest,
-      getSettledOutput,
-      persistSettledOutput: async () => {},
-    };
-    const node = new ToolNode({
-      tools: [directTool],
-      directToolNames: new Set(['subagent']),
-      interruptingToolNames: new Set(['subagent']),
-    });
-    const graph = buildGraph(node, [
-      {
-        id: 'call_primitive',
-        name: 'subagent',
-        args: { description: 'pause with primitive data' },
-      },
-    ]);
-
-    const interrupted = await graph.invoke(
-      { messages: [] },
-      { configurable: { thread_id: 'parent-thread' } }
-    );
-
-    expect(isInterrupted(interrupted)).toBe(true);
-    if (!isInterrupted(interrupted)) {
-      throw new Error('expected primitive child interrupt');
-    }
-    const internalPayload = interrupted.__interrupt__[0].value;
-    const replayBatchKey =
-      getSettledOutput.mock.calls[0]?.[1].configurable?.[
-        SUBAGENT_PARENT_BATCH_CONFIG_KEY
-      ];
-    expect(replayBatchKey).toEqual(expect.any(String));
-    expect(getResumeManifest).toHaveBeenCalledWith(
-      new Set(['call_primitive']),
-      expect.objectContaining({
-        configurable: expect.objectContaining({
-          thread_id: 'parent-thread',
-          [SUBAGENT_PARENT_BATCH_CONFIG_KEY]: replayBatchKey,
-        }),
-      })
-    );
-    expect(getSubagentResumeManifest(internalPayload)).toEqual(manifest);
-    expect(stripSubagentResumeManifest(internalPayload)).toBe('confirm child');
-  });
-
-  it('preserves a one-shot approval until a reject decision is applied', async () => {
-    const sideEffect = jest.fn(() => 'must not execute');
-    const directTool = tool(async () => sideEffect(), {
-      name: 'echo',
-      description: 'one-shot approval tool',
-      schema: z.object({ command: z.string() }),
-    }) as unknown as StructuredToolInterface;
-    const registry = new HookRegistry();
-    let hookInvocations = 0;
-    registry.register('PreToolUse', {
-      once: true,
-      pattern: '^echo$',
-      hooks: [
-        async (): Promise<PreToolUseHookOutput> => {
-          hookInvocations += 1;
-          return { decision: 'ask', reason: 'review once' };
-        },
-      ],
-    });
-    const node = new ToolNode({
-      tools: [directTool],
-      eventDrivenMode: true,
-      hookRegistry: registry,
-      directToolNames: new Set(['echo']),
-      humanInTheLoop: { enabled: true },
-    });
-    const graph = buildGraph(node, [
-      { id: 'call_once', name: 'echo', args: { command: 'go' } },
-    ]);
-    const config = { configurable: { thread_id: 'thread-once-reject' } };
-
-    const first = await graph.invoke({ messages: [] }, config);
-    expect(isInterrupted<t.HumanInterruptPayload>(first)).toBe(true);
-
-    const resumed = await graph.invoke(
-      new Command({
-        resume: [{ type: 'reject', reason: 'rejected once' }],
-      }),
-      config
-    );
-
-    expect(hookInvocations).toBe(1);
-    expect(sideEffect).not.toHaveBeenCalled();
-    const messages = (resumed as { messages: ToolMessage[] }).messages;
-    const toolMessage = messages.find(
-      (message) => message instanceof ToolMessage
-    );
-    expect(toolMessage?.status).toBe('error');
-    expect(String(toolMessage?.content)).toContain('rejected once');
-  });
-
-  it('truncates direct respond decisions before returning them', async () => {
-    const executeTool = jest.fn(async () => 'must not execute');
-    const directTool = tool(executeTool, {
-      name: 'echo',
-      description: 'approval response tool',
-      schema: z.object({ command: z.string() }),
-    }) as unknown as StructuredToolInterface;
-    const registry = new HookRegistry();
-    registry.register('PreToolUse', {
-      hooks: [async (): Promise<PreToolUseHookOutput> => ({ decision: 'ask' })],
-    });
-    const node = new ToolNode({
-      tools: [directTool],
-      hookRegistry: registry,
-      directToolNames: new Set(['echo']),
-      humanInTheLoop: { enabled: true },
-      maxToolResultChars: 50,
-    });
-    const graph = buildGraph(node, [
-      { id: 'call_respond', name: 'echo', args: { command: 'go' } },
-    ]);
-    const config = { configurable: { thread_id: 'thread-respond-truncate' } };
-
-    const interrupted = await graph.invoke({ messages: [] }, config);
-    expect(isInterrupted(interrupted)).toBe(true);
-
-    const oversized = 'A'.repeat(200);
-    const resumed = await graph.invoke(
-      new Command({
-        resume: [{ type: 'respond', responseText: oversized }],
-      }),
-      config
-    );
-
-    const messages = (resumed as { messages: ToolMessage[] }).messages;
-    const toolMessage = messages.find(
-      (message) => message instanceof ToolMessage
-    );
-    expect(String(toolMessage?.content).length).toBeLessThan(oversized.length);
-    expect(executeTool).not.toHaveBeenCalled();
-  });
-
-  it('stamps distinct assistant batches into subagent replay configs', async () => {
-    const invokedBatchKeys: unknown[] = [];
-    const directTool = tool(
-      async (_input, config) => {
-        invokedBatchKeys.push(
-          config.configurable?.[SUBAGENT_PARENT_BATCH_CONFIG_KEY]
-        );
-        return 'done';
-      },
-      {
-        name: 'subagent',
-        description: 'replayable direct tool',
-        schema: z.object({ description: z.string() }),
-      }
-    ) as unknown as StructuredToolInterface;
-    const replayConfigKeys: unknown[] = [];
-    const replayableTool = directTool as StructuredToolInterface &
-      ReplayableSubagentTool;
-    replayableTool[SUBAGENT_REPLAY_CONTROLLER] = {
-      getSettledOutput: async (_call, config) => {
-        replayConfigKeys.push(
-          config.configurable?.[SUBAGENT_PARENT_BATCH_CONFIG_KEY]
-        );
-        return undefined;
-      },
-      persistSettledOutput: async () => {},
-    };
-    const node = new ToolNode({
-      tools: [directTool],
-      directToolNames: new Set(['subagent']),
-    });
-    const config = {
-      configurable: { run_id: 'run-shared', thread_id: 'thread-shared' },
-    };
-    const input = (assistantMessageId: string): { messages: AIMessage[] } => ({
-      messages: [
-        new AIMessage({
-          id: assistantMessageId,
-          content: '',
-          tool_calls: [
-            {
-              id: 'call_reused',
-              name: 'subagent',
-              args: { description: assistantMessageId },
-            },
-          ],
-        }),
-      ],
-    });
-
-    await node.invoke(input('assistant-1'), config);
-    await node.invoke(input('assistant-2'), config);
-
-    expect(replayConfigKeys).toHaveLength(2);
-    expect(replayConfigKeys[0]).not.toBe(replayConfigKeys[1]);
-    expect(invokedBatchKeys).toEqual(replayConfigKeys);
-  });
-
-  it('stamps the assistant batch into Send-input subagent configs', async () => {
-    const invokedBatchKeys: unknown[] = [];
-    const directTool = tool(
-      async (_input, config) => {
-        invokedBatchKeys.push(
-          config.configurable?.[SUBAGENT_PARENT_BATCH_CONFIG_KEY]
-        );
-        return 'done';
-      },
-      {
-        name: 'subagent',
-        description: 'replayable direct tool',
-        schema: z.object({ description: z.string() }),
-      }
-    ) as unknown as StructuredToolInterface;
-    const replayConfigKeys: unknown[] = [];
-    const replayableTool = directTool as StructuredToolInterface &
-      ReplayableSubagentTool;
-    replayableTool[SUBAGENT_REPLAY_CONTROLLER] = {
-      getSettledOutput: async (_call, config) => {
-        replayConfigKeys.push(
-          config.configurable?.[SUBAGENT_PARENT_BATCH_CONFIG_KEY]
-        );
-        return undefined;
-      },
-      persistSettledOutput: async () => {},
-    };
-    const node = new ToolNode({
-      tools: [directTool],
-      directToolNames: new Set(['subagent']),
-    });
-    const toolCall = {
-      id: 'call_send',
-      name: 'subagent',
-      args: { description: 'send task' },
-    };
-
-    await node.invoke(
-      {
-        messages: [
-          new AIMessage({
-            id: 'assistant-send',
-            content: '',
-            tool_calls: [toolCall],
-          }),
-        ],
-        lg_tool_call: toolCall,
-      },
-      {
-        configurable: {
-          run_id: 'run-send',
-          thread_id: 'thread-send',
-        },
-      }
-    );
-
-    expect(replayConfigKeys).toHaveLength(1);
-    expect(replayConfigKeys[0]).toBeDefined();
-    expect(invokedBatchKeys).toEqual(replayConfigKeys);
-  });
-
-  it('fails closed when an id-less direct call requires approval', async () => {
-    const sideEffect = jest.fn(() => 'must not execute');
-    const directTool = tool(async () => sideEffect(), {
-      name: 'echo',
-      description: 'id-less approval tool',
-      schema: z.object({ command: z.string() }),
-    }) as unknown as StructuredToolInterface;
-    const registry = new HookRegistry();
-    registry.register('PreToolUse', {
-      pattern: '^echo$',
-      hooks: [
-        async (): Promise<PreToolUseHookOutput> => ({
-          decision: 'ask',
-          reason: 'review id-less call',
-        }),
-      ],
-    });
-    const node = new ToolNode({
-      tools: [directTool],
-      eventDrivenMode: true,
-      hookRegistry: registry,
-      directToolNames: new Set(['echo']),
-      humanInTheLoop: { enabled: true },
-    });
-    const graph = buildGraph(node, [
-      { id: undefined, name: 'echo', args: { command: 'go' } },
-    ]);
-
-    const result = await graph.invoke(
-      { messages: [] },
-      { configurable: { thread_id: 'thread-id-less-approval' } }
-    );
-
-    expect(isInterrupted(result)).toBe(false);
-    expect(sideEffect).not.toHaveBeenCalled();
-    const messages = (result as { messages: ToolMessage[] }).messages;
-    const toolMessage = messages.find(
-      (message) => message instanceof ToolMessage
-    );
-    expect(toolMessage?.status).toBe('error');
-    expect(String(toolMessage?.content)).toContain(
-      'requires a non-empty tool call ID'
-    );
-  });
-
-  it('reruns ordinary hooks while replaying a consumed one-shot approval', async () => {
-    const sideEffect = jest.fn(() => 'must not execute');
-    const directTool = tool(async () => sideEffect(), {
-      name: 'echo',
-      description: 'mixed replay hook tool',
-      schema: z.object({ command: z.string() }),
-    }) as unknown as StructuredToolInterface;
-    const registry = new HookRegistry();
-    let onceCalls = 0;
-    let ordinaryCalls = 0;
-    registry.register('PreToolUse', {
-      once: true,
-      pattern: '^echo$',
-      hooks: [
-        async (): Promise<PreToolUseHookOutput> => {
-          onceCalls += 1;
-          return { decision: 'ask', reason: 'review once' };
-        },
-      ],
-    });
-    registry.register('PreToolUse', {
-      pattern: '^echo$',
-      hooks: [
-        async (): Promise<PreToolUseHookOutput> => {
-          ordinaryCalls += 1;
-          return ordinaryCalls === 1
-            ? { decision: 'allow' }
-            : { decision: 'deny', reason: 'policy changed on resume' };
-        },
-      ],
-    });
-    const node = new ToolNode({
-      tools: [directTool],
-      eventDrivenMode: true,
-      hookRegistry: registry,
-      directToolNames: new Set(['echo']),
-      humanInTheLoop: { enabled: true },
-    });
-    const graph = buildGraph(node, [
-      { id: 'call_mixed_hooks', name: 'echo', args: { command: 'go' } },
-    ]);
-    const config = { configurable: { thread_id: 'thread-mixed-hooks' } };
-
-    const first = await graph.invoke({ messages: [] }, config);
-    expect(isInterrupted(first)).toBe(true);
-    const resumed = await graph.invoke(
-      new Command({ resume: [{ type: 'approve' }] }),
-      config
-    );
-
-    expect(onceCalls).toBe(1);
-    expect(ordinaryCalls).toBe(2);
-    expect(sideEffect).not.toHaveBeenCalled();
-    const messages = (resumed as { messages: ToolMessage[] }).messages;
-    const toolMessage = messages.find(
-      (message) => message instanceof ToolMessage
-    );
-    expect(toolMessage?.status).toBe('error');
-    expect(String(toolMessage?.content)).toContain('policy changed on resume');
-  });
-
-  it('re-executes the direct tool body on resume when interrupt() fires from the direct path', async () => {
-    const sideEffect = jest.fn(() => 'EXECUTED');
-    const directTool = tool(async () => sideEffect(), {
-      name: 'echo',
-      description: 'direct tool that records every body invocation',
-      schema: z.object({ command: z.string().optional() }).passthrough(),
-    }) as unknown as StructuredToolInterface;
-
-    const registry = new HookRegistry();
-    let hookInvocations = 0;
-    // Realistic shape: ask the FIRST time the hook sees a tool call,
-    // allow on subsequent invocations. A real policy hook would key
-    // off persistent state (an "approved paths" set, a session
-    // approval token, etc.); we just count.
-    registry.register('PreToolUse', {
-      hooks: [
-        async (): Promise<PreToolUseHookOutput> => {
-          hookInvocations += 1;
-          if (hookInvocations === 1) {
-            return { decision: 'ask', reason: 'first-time-ask' };
-          }
-          return { decision: 'allow' };
-        },
-      ],
-    });
-
-    const node = new ToolNode({
-      tools: [directTool],
-      eventDrivenMode: true,
-      hookRegistry: registry,
-      directToolNames: new Set(['echo']),
-      humanInTheLoop: { enabled: true },
-    });
-
-    const graph = buildGraph(node, [
-      { id: 'call_1', name: 'echo', args: { command: 'go' } },
-    ]);
-    const config = { configurable: { thread_id: 'thread-resume-1' } };
-
-    const first = await graph.invoke({ messages: [] }, config);
-    expect(isInterrupted<t.HumanInterruptPayload>(first)).toBe(true);
-
-    // Body should NOT have run yet — the hook intercepted before
-    // the tool executed.
-    expect(sideEffect).not.toHaveBeenCalled();
-    // Hook fires once per attempt; the first interrupt is attempt #1.
-    expect(hookInvocations).toBe(1);
-
-    // Resume with approve. LangGraph re-enters the ToolNode body,
-    // PreToolUse fires again (the "idempotency" caveat — see the
-    // HumanInTheLoopConfig JSDoc).
-    const second = await graph.invoke(
-      { resume: [{ tool_call_id: 'call_1', type: 'approve' }] },
-      config
-    );
-
-    // PreToolUse fired a SECOND time on the resume re-entry.
-    expect(hookInvocations).toBe(2);
-    // Body executed exactly once — only on the resume pass, after
-    // the hook returned 'allow'. The interrupted first pass never
-    // reached the body. This pins the resume scope: LangGraph
-    // restarts the ToolNode at the top, but the body itself only
-    // runs once because the first pass interrupted before the
-    // body, not after.
-    expect(sideEffect).toHaveBeenCalledTimes(1);
-
-    // Result should carry the executed output.
-    const messages = (second as { messages: ToolMessage[] }).messages;
-    const toolMsg = messages.find(
-      (m) => m instanceof ToolMessage
-    ) as ToolMessage;
-    expect(String(toolMsg.content)).toBe('EXECUTED');
-  });
-
-  it('re-runs sibling tools that already executed in the same batch when a later tool interrupts', async () => {
-    // Two direct tools in the same batch. Tool A is a no-op the
-    // hook always allows; tool B asks the first time. On resume,
-    // LangGraph rewinds the entire ToolNode — meaning tool A's
-    // body runs twice (once per pass). This pins the side-effect
-    // caveat: tools called BEFORE an interrupting sibling MUST be
-    // idempotent regardless of whether they're direct or
-    // event-dispatched.
-    const aSideEffect = jest.fn(() => 'A-OK');
-    const bSideEffect = jest.fn(() => 'B-OK');
-    const a = tool(async () => aSideEffect(), {
-      name: 'tool_a',
-      description: 'allowed direct tool',
-      schema: z.object({}).passthrough(),
-    }) as unknown as StructuredToolInterface;
-    const b = tool(async () => bSideEffect(), {
-      name: 'tool_b',
-      description: 'asks first time, allows after',
-      schema: z.object({}).passthrough(),
-    }) as unknown as StructuredToolInterface;
-
-    let bHookInvocations = 0;
-    const registry = new HookRegistry();
-    registry.register('PreToolUse', {
-      hooks: [
-        async ({ toolName }): Promise<PreToolUseHookOutput> => {
-          if (toolName === 'tool_b') {
-            bHookInvocations += 1;
-            if (bHookInvocations === 1) {
-              return { decision: 'ask', reason: 'b-first-ask' };
-            }
-          }
-          return { decision: 'allow' };
-        },
-      ],
-    });
-
-    const node = new ToolNode({
-      tools: [a, b],
-      eventDrivenMode: true,
-      hookRegistry: registry,
-      directToolNames: new Set(['tool_a', 'tool_b']),
-      humanInTheLoop: { enabled: true },
-    });
-
-    const builder = new StateGraph(MessagesAnnotation)
-      .addNode(
-        'agent',
-        (): MessagesUpdate => ({
-          messages: [
-            new AIMessage({
-              content: '',
-              tool_calls: [
-                { id: 'a1', name: 'tool_a', args: {} },
-                { id: 'b1', name: 'tool_b', args: {} },
-              ],
-            }),
-          ],
-        })
-      )
-      .addNode('tools', node)
-      .addEdge(START, 'agent')
-      .addEdge('agent', 'tools')
-      .addEdge('tools', END);
-    const graph = builder.compile({
-      checkpointer: new MemorySaver(),
-    }) as unknown as CompiledMessagesGraph;
-
-    const config = { configurable: { thread_id: 'thread-mixed-batch' } };
-    const first = await graph.invoke({ messages: [] }, config);
-    expect(isInterrupted<t.HumanInterruptPayload>(first)).toBe(true);
-
-    // First pass: A ran (allowed), B asked.
-    expect(aSideEffect).toHaveBeenCalledTimes(1);
-    expect(bSideEffect).not.toHaveBeenCalled();
-    expect(bHookInvocations).toBe(1);
-
-    await graph.invoke(
-      { resume: [{ tool_call_id: 'b1', type: 'approve' }] },
-      config
-    );
-
-    // Resume: LangGraph rewinds the ToolNode and re-enters from the
-    // start. A's body runs AGAIN. B's body runs once now that the
-    // hook allowed.
-    expect(aSideEffect).toHaveBeenCalledTimes(2);
-    expect(bSideEffect).toHaveBeenCalledTimes(1);
-    expect(bHookInvocations).toBe(2);
-  });
-
-  describe('edit decision (Codex P1 #16)', () => {
-    it('applies decision.updatedInput (the documented field) to the executed tool args', async () => {
-      const receivedArgs: Array<Record<string, unknown>> = [];
-      const directTool = tool(
-        async (input) => {
-          receivedArgs.push(input as Record<string, unknown>);
-          return JSON.stringify(input);
-        },
-        {
-          name: 'echo',
-          description: 'records the args it actually executed with',
-          schema: z.object({ command: z.string() }),
-        }
-      ) as unknown as StructuredToolInterface;
-
-      // Pattern: hook ALWAYS asks. interrupt() throws on the first
-      // pass (sends the host the askEntry payload) and RETURNS the
-      // resume value on the second pass — the resume value is what
-      // actually carries the approve/edit/reject decision.
-      const registry = new HookRegistry();
-      registry.register('PreToolUse', {
-        hooks: [
-          async (): Promise<PreToolUseHookOutput> => ({
-            decision: 'ask',
-            allowedDecisions: ['approve', 'edit'],
-          }),
-        ],
-      });
-
-      const node = new ToolNode({
-        tools: [directTool],
-        eventDrivenMode: true,
-        hookRegistry: registry,
-        directToolNames: new Set(['echo']),
-        humanInTheLoop: { enabled: true },
-      });
-
-      const graph = buildGraph(node, [
-        { id: 'call_1', name: 'echo', args: { command: 'original' } },
-      ]);
-      const config = { configurable: { thread_id: 'thread-edit-1' } };
-
-      const first = await graph.invoke({ messages: [] }, config);
-      expect(isInterrupted<t.HumanInterruptPayload>(first)).toBe(true);
-      // Body did not run yet.
-      expect(receivedArgs).toEqual([]);
-
-      const second = await graph.invoke(
-        new Command({
-          resume: [
-            { type: 'edit', updatedInput: { command: 'edited-by-host' } },
-          ],
-        }),
-        config
-      );
-
-      // The whole point of the fix: the edited input flows through.
-      // Pre-fix the direct path read `decision.args` (wrong field) so
-      // updatedInput was silently dropped and the tool ran with
-      // `{ command: 'original' }`.
-      expect(receivedArgs).toHaveLength(1);
-      expect(receivedArgs[0]).toEqual({ command: 'edited-by-host' });
-
-      const messages = (second as { messages: ToolMessage[] }).messages;
-      const toolMsg = messages.find(
-        (m) => m instanceof ToolMessage
-      ) as ToolMessage;
-      expect(String(toolMsg.content)).toContain('edited-by-host');
-    });
-
-    it('fails closed when updatedInput is missing or wrong-shaped', async () => {
-      const directTool = tool(async () => 'should-not-execute', {
-        name: 'echo',
-        description: 'must not execute on malformed edit',
-        schema: z.object({ command: z.string().optional() }).passthrough(),
-      }) as unknown as StructuredToolInterface;
-
-      const registry = new HookRegistry();
-      registry.register('PreToolUse', {
-        hooks: [
-          async (): Promise<PreToolUseHookOutput> => ({
-            decision: 'ask',
-            allowedDecisions: ['approve', 'edit'],
-          }),
-        ],
-      });
-
-      const node = new ToolNode({
-        tools: [directTool],
-        eventDrivenMode: true,
-        hookRegistry: registry,
-        directToolNames: new Set(['echo']),
-        humanInTheLoop: { enabled: true },
-      });
-
-      const graph = buildGraph(node, [
-        { id: 'call_1', name: 'echo', args: { command: 'original' } },
-      ]);
-      const config = { configurable: { thread_id: 'thread-edit-2' } };
-
-      await graph.invoke({ messages: [] }, config);
-
-      // Send `{ type: 'edit' }` with no updatedInput at all (simulates
-      // a host that misnamed the field, e.g. used `args` like the old
-      // bug expected). Must fail closed instead of executing.
-      const second = await graph.invoke(
-        new Command({
-          resume: [
-            {
-              type: 'edit',
-              args: { command: 'this-field-name-is-wrong' },
-            } as unknown as t.ToolApprovalDecision,
-          ],
-        }),
-        config
-      );
-
-      const messages = (second as { messages: ToolMessage[] }).messages;
-      const toolMsg = messages.find(
-        (m) => m instanceof ToolMessage
-      ) as ToolMessage;
-      expect(toolMsg.status).toBe('error');
-      expect(String(toolMsg.content)).toContain(
-        'Decision "edit" missing object updatedInput'
-      );
-      expect(String(toolMsg.content)).not.toContain('should-not-execute');
-    });
-  });
-
-  describe('untrusted resume decisions', () => {
-    it.each([
-      [
-        { type: 'respond' },
-        'Approval payload `respond` was missing a string `responseText`',
-      ],
-      [
-        { type: 'aproved' },
-        'Unknown approval decision type "aproved" — failing closed',
-      ],
-    ])(
-      'blocks and persists malformed direct decision %#',
-      async (rawDecision, expectedError) => {
-        const executeTool = jest.fn(async () => 'should-not-execute');
-        const directTool = tool(executeTool, {
-          name: 'subagent',
-          description: 'replayable direct tool',
-          schema: z.object({ description: z.string() }),
-        }) as unknown as StructuredToolInterface;
-        const persistSettledOutput = jest.fn(
-          async (
-            _call: ToolCall,
-            _config: RunnableConfig,
-            _settled: SettledSubagentToolOutput
-          ): Promise<void> => {}
-        );
-        const replayableTool = directTool as StructuredToolInterface &
-          ReplayableSubagentTool;
-        replayableTool[SUBAGENT_REPLAY_CONTROLLER] = {
-          getSettledOutput: async () => undefined,
-          persistSettledOutput,
-        };
-        const registry = new HookRegistry();
-        registry.register('PreToolUse', {
-          hooks: [
-            async (): Promise<PreToolUseHookOutput> => ({ decision: 'ask' }),
-          ],
-        });
-        const node = new ToolNode({
-          tools: [directTool],
-          hookRegistry: registry,
-          directToolNames: new Set(['subagent']),
-          humanInTheLoop: { enabled: true },
-        });
-        const graph = buildGraph(node, [
-          {
-            id: 'call_malformed',
-            name: 'subagent',
-            args: { description: 'inspect' },
-          },
-        ]);
-        const config = {
-          configurable: { thread_id: `thread-malformed-${rawDecision.type}` },
-        };
-
-        await graph.invoke({ messages: [] }, config);
-        const resumed = await graph.invoke(
-          new Command({
-            resume: [rawDecision as unknown as t.ToolApprovalDecision],
-          }),
-          config
-        );
-
-        const messages = (resumed as { messages: ToolMessage[] }).messages;
-        const toolMessage = messages.find(
-          (message) => message instanceof ToolMessage
-        );
-        expect(toolMessage?.status).toBe('error');
-        expect(String(toolMessage?.content)).toContain(expectedError);
-        expect(executeTool).not.toHaveBeenCalled();
-        expect(persistSettledOutput).toHaveBeenCalledTimes(1);
-        expect(persistSettledOutput.mock.calls[0]?.[2].output.status).toBe(
-          'error'
-        );
-      }
-    );
-  });
-
-  describe('usage counter stability across resume (Codex P2 #30)', () => {
-    it('turn stays the same across an interrupt + resume — does not double-increment', async () => {
-      // Pre-fix the P2 #27 turn-race fix incremented before the
-      // hook fired, and never rolled back on `ask`. LangGraph
-      // re-runs ToolNode from the start on resume, so a single
-      // call that asks once before approval got turn=1 instead of
-      // turn=0. Now turns are cached per call.id and re-used on
-      // re-entry.
-      const observed: number[] = [];
-      const directTool = tool(
-        async (_, config) => {
-          const tc = (config as { toolCall?: { turn?: number } } | undefined)
-            ?.toolCall;
-          if (typeof tc?.turn === 'number') observed.push(tc.turn);
-          return 'EXECUTED';
-        },
-        {
-          name: 'echo',
-          description: 'records the turn it ran under',
-          schema: z.object({ command: z.string() }),
-        }
-      ) as unknown as StructuredToolInterface;
-
-      // Hook ALWAYS asks. The resume value is what unblocks.
-      const registry = new HookRegistry();
-      registry.register('PreToolUse', {
-        hooks: [
-          async (): Promise<PreToolUseHookOutput> => ({
-            decision: 'ask',
-            allowedDecisions: ['approve'],
-          }),
-        ],
-      });
-
-      const node = new ToolNode({
-        tools: [directTool],
-        eventDrivenMode: true,
-        hookRegistry: registry,
-        directToolNames: new Set(['echo']),
-        humanInTheLoop: { enabled: true },
-      });
-
-      const graph = buildGraph(node, [
-        { id: 'call_1', name: 'echo', args: { command: 'go' } },
-      ]);
-      const config = { configurable: { thread_id: 'thread-turn-stable' } };
-
-      const first = await graph.invoke({ messages: [] }, config);
-      expect(isInterrupted<t.HumanInterruptPayload>(first)).toBe(true);
-
-      await graph.invoke(
-        new Command({ resume: [{ type: 'approve' }] }),
-        config
-      );
-
-      // Body ran once. The turn it observed must be 0 (the slot
-      // assigned on the FIRST entry, reused on resume), not 1
-      // (which is what pre-fix produced because the second entry
-      // re-incremented).
-      expect(observed).toEqual([0]);
-    });
-
-    it('clearDirectPathTurns() empties the per-Run cache (Codex P2 #33)', () => {
-      // The resume-stable map must be cleared at end-of-Run so it
-      // doesn't grow unbounded across long runs and doesn't return
-      // stale slots if a provider reuses call IDs across turns.
-      // Graph.clearHeavyState calls this on every compiled
-      // ToolNode; pin the method directly so a regression here
-      // doesn't slip past the integration boundary.
-      const echo = tool(async () => 'EXECUTED', {
-        name: 'echo',
-        description: 'noop',
-        schema: z.object({}).passthrough(),
-      }) as unknown as StructuredToolInterface;
-      const node = new ToolNode({
-        tools: [echo],
-        eventDrivenMode: true,
-        directToolNames: new Set(['echo']),
-      });
-      // Synthesise an entry by reaching into the private map via
-      // the internal accessor we just exposed. Use a simple
-      // call-shape trick: invoke and assert clearDirectPathTurns
-      // produces a no-op on a fresh map (sanity), then on a
-      // populated one it empties.
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const internal = node as any;
-      internal.directPathTurns.set('call_x', 7);
-      expect(internal.directPathTurns.size).toBe(1);
-      node.clearDirectPathTurns();
-      expect(internal.directPathTurns.size).toBe(0);
-    });
-  });
-});