@pensar/apex 2.6.1 → 2.7.0-canary.1572d9a4

package/src/core/api/offesecAgent.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, expectTypeOf, it, vi } from "vitest";
 import type { CreateAgentInput } from "../agents/offSecAgent";
+import { sessions } from "../session";
 import {
   createOffensiveSecurityAgentClient,
   type OffensiveSecurityAgentClientInput,
@@ -80,6 +81,7 @@ function existingSessionInput(overrides: Record<string, unknown> = {}) {
 }
 
 beforeEach(() => {
+  vi.restoreAllMocks();
   Fake.order.length = 0;
   Fake.instances.length = 0;
   Fake.createGate = null;
@@ -88,6 +90,55 @@ beforeEach(() => {
 });
 
 describe("runOffensiveSecurityAgent", () => {
+  it("restores the session's effort only for the matching model", async () => {
+    const session = {
+      id: "ses_existing",
+      config: { modelReasoning: { model: "gpt-6.1-sol", setting: "low" } },
+    };
+    await runOffensiveSecurityAgent(
+      existingSessionInput({ model: "gpt-6.1-sol", session }) as never,
+    );
+    expect(Fake.instances[0].input.reasoning).toBe("low");
+    await runOffensiveSecurityAgent(
+      existingSessionInput({ model: "gemini-3-pro-preview", session }) as never,
+    );
+    expect(Fake.instances[1].input.reasoning).toBeUndefined();
+  });
+
+  it("persists an explicit override before starting the resumed agent", async () => {
+    const session = {
+      id: "ses_existing",
+      config: { modelReasoning: { model: "gpt-6.1-sol", setting: "low" } },
+    };
+    const update = vi
+      .spyOn(sessions, "updateModelReasoning")
+      .mockResolvedValue({
+        ...session,
+        config: { modelReasoning: { model: "gpt-6.1-sol", setting: "high" } },
+      } as never);
+    await runOffensiveSecurityAgent(
+      existingSessionInput({
+        model: "gpt-6.1-sol",
+        session,
+        reasoning: "high",
+      }) as never,
+    );
+    expect(update).toHaveBeenCalledWith("ses_existing", "gpt-6.1-sol", "high");
+    expect(Fake.instances[0].input.reasoning).toBe("high");
+  });
+
+  it("rejects unsupported explicit effort before constructing an agent", async () => {
+    await expect(
+      runOffensiveSecurityAgent(
+        existingSessionInput({
+          model: "gemini-3-pro-preview",
+          reasoning: "max",
+        }) as never,
+      ),
+    ).rejects.toThrow("not supported");
+    expect(Fake.instances).toHaveLength(0);
+  });
+
   it("constructs synchronously for a pre-existing session and fires onSessionReady before consume", async () => {
     const onSessionReady = vi.fn(() => Fake.order.push("onSessionReady"));
     const running = runOffensiveSecurityAgent(

package/src/core/api/offesecAgent.ts

@@ -6,10 +6,15 @@ import {
 } from "../agents/offSecAgent";
 import { startAgentExecution } from "../runtime/agentExecution";
 import type { SessionInfo } from "../session";
+import {
+  persistRootReasoningOverride,
+  resolveRootReasoning,
+} from "./reasoning";
 
 export interface RunAgentResult {
   streamResult: StreamTextResult<ToolSet, never>;
   session: SessionInfo;
+  lance?: import("../agents/lance").LanceMetrics;
 }
 
 /**
@@ -27,6 +32,9 @@ export async function runOffensiveSecurityAgent(
     onSessionReady?: (session: SessionInfo) => void;
   },
 ): Promise<RunAgentResult> {
+  const resolved = resolveRootReasoning(input);
+  const persisted = persistRootReasoningOverride(input);
+  input = persisted ? { ...resolved, session: await persisted } : resolved;
   const agent = input.session
     ? new OffensiveSecurityAgent(input as OffensiveSecurityAgentInput)
     : await OffensiveSecurityAgent.create(input as CreateAgentInput);
@@ -34,7 +42,13 @@ export async function runOffensiveSecurityAgent(
   input.onSessionReady?.(agent.session);
 
   await startAgentExecution(agent).result;
-  return { streamResult: agent.streamResult, session: agent.session };
+  return {
+    streamResult: agent.streamResult,
+    session: agent.session,
+    ...(agent.lanceRuntime
+      ? { lance: agent.lanceRuntime.metrics(input.model) }
+      : {}),
+  };
 }
 
 /** Either agent-input shape, minus the abort signal the client owns. */

package/src/core/api/reasoning.test.ts

@@ -0,0 +1,213 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ReasoningSetting } from "../ai";
+import type { SessionInfo } from "../session";
+import { runOffensiveSecurityAgent } from "./offesecAgent";
+import { startTargetedPentestAgent } from "./targetedPentest";
+
+const mocks = vi.hoisted(() => {
+  const inputs: Array<Record<string, unknown>> = [];
+  const consume = vi.fn(async () => ({ findings: [] }));
+  const update = vi.fn();
+  const abortAndDrain = vi.fn(async () => {});
+  class Agent {
+    session: unknown;
+    streamResult = {};
+    eventBus = { on: vi.fn() };
+    drained = Promise.resolve();
+    consume = consume;
+    abortAndDrain = abortAndDrain;
+    constructor(input: Record<string, unknown>) {
+      inputs.push(input);
+      this.session = input.session;
+    }
+  }
+  return { inputs, consume, update, abortAndDrain, Agent };
+});
+vi.mock("../agents/offSecAgent", () => ({
+  OffensiveSecurityAgent: mocks.Agent,
+}));
+vi.mock("../agents/specialized/pentest/agent", () => ({
+  TargetedPentestAgent: mocks.Agent,
+}));
+vi.mock("../session", () => ({
+  sessions: { updateModelReasoning: mocks.update },
+}));
+
+function session(model = "gpt-6.1-sol", setting: ReasoningSetting = "low") {
+  return {
+    id: "root",
+    config: { modelReasoning: { model, setting } },
+  } as SessionInfo;
+}
+beforeEach(() => {
+  mocks.inputs.length = 0;
+  mocks.consume.mockClear();
+  mocks.abortAndDrain.mockClear();
+  mocks.update
+    .mockReset()
+    .mockImplementation(async (_id, model, setting) => session(model, setting));
+});
+
+describe.each([
+  {
+    name: "generic",
+    run: (input: Record<string, unknown>) =>
+      runOffensiveSecurityAgent(input as never),
+  },
+  {
+    name: "targeted",
+    run: (input: Record<string, unknown>) =>
+      startTargetedPentestAgent(input as never).result,
+  },
+])("$name root reasoning", ({ run }) => {
+  it.each([
+    {
+      name: "matching saved selection",
+      overrides: {},
+      expected: "low",
+      persists: false,
+    },
+    {
+      name: "explicit override",
+      overrides: { reasoning: "high" },
+      expected: "high",
+      persists: true,
+    },
+    {
+      name: "explicit default",
+      overrides: { reasoning: "default" },
+      expected: "default",
+      persists: true,
+    },
+    {
+      name: "saved ahead of legacy",
+      overrides: { openAIReasoningEffort: "high" },
+      expected: "low",
+      persists: false,
+    },
+    {
+      name: "model switch",
+      overrides: { model: "gpt-5" },
+      expected: "medium",
+      persists: false,
+    },
+    {
+      name: "legacy fallback on model switch",
+      overrides: {
+        model: "concentrate:glm-5.3",
+        openAIReasoningEffort: "xhigh",
+      },
+      expected: "max",
+      persists: false,
+    },
+    {
+      name: "explicit none",
+      overrides: { model: "gpt-5.1", reasoning: "none" },
+      expected: "none",
+      persists: true,
+    },
+    {
+      name: "explicit disabled",
+      overrides: { model: "claude-sonnet-4-5", reasoning: "disabled" },
+      expected: "disabled",
+      persists: true,
+    },
+    {
+      name: "child override",
+      overrides: { subagentId: "child", reasoning: "high" },
+      expected: "high",
+      persists: false,
+    },
+    {
+      name: "child with no inherited choice",
+      overrides: { subagentId: "child" },
+      expected: "medium",
+      persists: false,
+    },
+  ])("resolves $name before constructing the agent", async ({
+    overrides,
+    expected,
+    persists,
+  }) => {
+    const saved = session();
+    const input = {
+      session: saved,
+      model: "gpt-6.1-sol",
+      eventBus: {},
+      ...overrides,
+    };
+    await run(input);
+    expect(mocks.inputs).toHaveLength(1);
+    expect(mocks.inputs[0]).toMatchObject({
+      model: input.model,
+      reasoning: expected,
+    });
+    expect(mocks.update).toHaveBeenCalledTimes(persists ? 1 : 0);
+    if (persists) {
+      expect(mocks.update).toHaveBeenCalledWith("root", input.model, expected);
+      expect(
+        (mocks.inputs[0].session as SessionInfo).config?.modelReasoning,
+      ).toEqual({ model: input.model, setting: expected });
+    }
+    expect(saved.config?.modelReasoning).toEqual({
+      model: "gpt-6.1-sol",
+      setting: "low",
+    });
+  });
+
+  it("rejects unsupported explicit settings before construction or persistence", async () => {
+    await expect(async () =>
+      run({ session: session(), model: "gpt-6.1-sol", reasoning: "none" }),
+    ).rejects.toThrow("not supported");
+    expect(mocks.inputs).toHaveLength(0);
+    expect(mocks.update).not.toHaveBeenCalled();
+  });
+});
+
+describe("targeted reasoning persistence lifecycle", () => {
+  function pendingSave() {
+    let resolve!: (session: SessionInfo) => void;
+    mocks.update.mockReturnValue(
+      new Promise<SessionInfo>((done) => {
+        resolve = done;
+      }),
+    );
+    const handle = startTargetedPentestAgent({
+      session: session(),
+      model: "gpt-6.1-sol",
+      reasoning: "high",
+      eventBus: {},
+    } as never);
+    return { handle, resolve };
+  }
+  it("returns a handle immediately and waits for persistence before constructing", async () => {
+    const { handle, resolve } = pendingSave();
+    expect(mocks.inputs).toHaveLength(0);
+    resolve(session("gpt-6.1-sol", "high"));
+    await handle.result;
+    expect(mocks.consume).toHaveBeenCalledOnce();
+    await handle.abortAndDrain();
+    expect(mocks.abortAndDrain).toHaveBeenCalledOnce();
+    await handle.drained;
+  });
+  it("does not start a late agent after teardown while persistence is pending", async () => {
+    const { handle, resolve } = pendingSave();
+    await handle.abortAndDrain();
+    resolve(session("gpt-6.1-sol", "high"));
+    await expect(handle.result).rejects.toMatchObject({ name: "AbortError" });
+    await handle.drained;
+    expect(mocks.inputs).toHaveLength(0);
+    expect(mocks.consume).not.toHaveBeenCalled();
+  });
+  it("propagates persistence failure without starting the agent", async () => {
+    mocks.update.mockRejectedValue(new Error("save failed"));
+    const handle = startTargetedPentestAgent({
+      session: session(),
+      model: "gpt-6.1-sol",
+      reasoning: "high",
+    } as never);
+    await expect(handle.result).rejects.toThrow("save failed");
+    await handle.drained;
+    expect(mocks.inputs).toHaveLength(0);
+  });
+});

package/src/core/api/reasoning.ts

@@ -0,0 +1,44 @@
+import { getModelSettings } from "../ai";
+import type { ReasoningInput } from "../ai/reasoning";
+import type { AIAuthConfig } from "../ai/utils";
+import { type SessionInfo, sessions } from "../session";
+
+type AgentReasoningInput = ReasoningInput & {
+  model: string;
+  authConfig?: AIAuthConfig;
+  session?: SessionInfo;
+  subagentId?: string;
+};
+
+export function resolveRootReasoning<T extends AgentReasoningInput>(
+  input: T,
+): T {
+  const saved = input.session?.config?.modelReasoning;
+  const reasoning = getModelSettings({
+    ...input,
+    reasoning:
+      input.reasoning ??
+      (!input.subagentId && saved?.model === input.model
+        ? saved.setting
+        : undefined),
+  }).reasoning;
+  return reasoning === input.reasoning ? input : { ...input, reasoning };
+}
+
+export function persistRootReasoningOverride(
+  input: AgentReasoningInput,
+): Promise<SessionInfo> | undefined {
+  const saved = input.session?.config?.modelReasoning;
+  if (
+    input.session &&
+    !input.subagentId &&
+    input.reasoning !== undefined &&
+    (saved?.model !== input.model || saved.setting !== input.reasoning)
+  ) {
+    return sessions.updateModelReasoning(
+      input.session.id,
+      input.model,
+      input.reasoning,
+    );
+  }
+}

package/src/core/api/recordedRun.loop.test.ts

@@ -173,7 +173,11 @@ describe("recorded runs through the real agent and SDK loop", () => {
     void running.catch(() => {});
 
     try {
-      await vi.waitFor(() => expect(hits).toEqual(["/first"]));
+      // Booting the agent and reaching the first tool call exceeds waitFor's 1s
+      // default on a loaded machine; the pause assertions below are the contract.
+      await vi.waitFor(() => expect(hits).toEqual(["/first"]), {
+        timeout: 15_000,
+      });
       const client = await openSqliteRunStore(join(root, "runs.sqlite"));
       try {
         const control = await client.getControl(input.runId);

package/src/core/api/targetedPentest.test.ts

@@ -49,6 +49,7 @@ import {
 // Mock ignores everything except __testResult; cast so the real input shape isn't required.
 function run(testResult: unknown) {
   return runTargetedPentestAgent({
+    model: "test-model",
     __testResult: testResult,
     eventBus: {},
   } as never);
@@ -104,6 +105,7 @@ describe("runTargetedPentestAgent result-shape resilience", () => {
 describe("startTargetedPentestAgent handle", () => {
   it("exposes result + abortAndDrain before consume settles", async () => {
     const handle = startTargetedPentestAgent({
+      model: "test-model",
       __testResult: { findings: [] },
       eventBus: {},
     } as never);
@@ -115,6 +117,7 @@ describe("startTargetedPentestAgent handle", () => {
   it("exposes the post-consume drain promise, not the pre-run placeholder", () => {
     const gate = Promise.resolve();
     const handle = startTargetedPentestAgent({
+      model: "test-model",
       __testResult: { findings: [] },
       __drainGate: gate,
       eventBus: {},
@@ -123,13 +126,20 @@ describe("startTargetedPentestAgent handle", () => {
   });
 
   it("passes the caller's input object to the agent untouched", () => {
-    const input = { __testResult: { findings: [] }, eventBus: {} };
+    const input = {
+      model: "test-model",
+      __testResult: { findings: [] },
+      eventBus: {},
+    };
     startTargetedPentestAgent(input as never);
     expect(constructions[0]?.input).toBe(input);
   });
 
   it("wires default logging listeners only when no eventBus is provided", () => {
-    startTargetedPentestAgent({ __testResult: { findings: [] } } as never);
+    startTargetedPentestAgent({
+      model: "test-model",
+      __testResult: { findings: [] },
+    } as never);
     expect(constructions[0]?.on).toEqual([
       "text-delta",
       "tool-call-complete",
@@ -140,6 +150,7 @@ describe("startTargetedPentestAgent handle", () => {
 
   it("leaves the agent bus untouched when the input provides an eventBus", () => {
     startTargetedPentestAgent({
+      model: "test-model",
       __testResult: { findings: [] },
       eventBus: {},
     } as never);
@@ -154,6 +165,7 @@ describe("runTargetedPentestAgent completion boundary", () => {
       settleDrain = resolve;
     });
     const runPromise = runTargetedPentestAgent({
+      model: "test-model",
       __testResult: { findings: [] },
       __drainGate: drainGate,
       eventBus: {},

package/src/core/api/targetedPentest.ts

@@ -7,9 +7,14 @@ import {
   type AgentExecutionHandle,
   startAgentExecution,
 } from "../runtime/agentExecution";
+import {
+  persistRootReasoningOverride,
+  resolveRootReasoning,
+} from "./reasoning";
 
 export type TargetedPentestResult = {
   findings: PentestResult["findings"];
+  reportedFindings?: string[];
   findingsPath?: string;
   pocsPath?: string;
   objectiveResults?: PentestResult["objectiveResults"];
@@ -20,7 +25,10 @@ export type TargetedPentestResult = {
 export type TargetedPentestHandle = AgentExecutionHandle<TargetedPentestResult>;
 
 /** Guard against malformed consume() shapes (don't crash on findings.length). */
-function normalizeResult(result: unknown): TargetedPentestResult {
+function normalizeResult(
+  result: unknown,
+  findingPolicy?: PentestAgentInput["findingPolicy"],
+): TargetedPentestResult {
   const r = result as Partial<PentestResult> | null | undefined;
   if (!r || !Array.isArray(r.findings)) {
     console.error(
@@ -30,12 +38,22 @@ function normalizeResult(result: unknown): TargetedPentestResult {
   }
 
   const findings = Array.isArray(r?.findings) ? r.findings : [];
-  console.log(`\nFound ${findings.length} vulnerabilities`);
-  console.log(`Findings: ${r?.findingsPath}`);
-  console.log(`POCs: ${r?.pocsPath}`);
+  const reportedFindings = Array.isArray(r?.reportedFindings)
+    ? r.reportedFindings
+    : [];
+  if (findingPolicy === "external") {
+    console.log(
+      `\nReported ${reportedFindings.length} finding(s) for external evaluation`,
+    );
+  } else {
+    console.log(`\nFound ${findings.length} vulnerabilities`);
+    console.log(`Findings: ${r?.findingsPath}`);
+    console.log(`POCs: ${r?.pocsPath}`);
+  }
 
   return {
     findings,
+    ...(findingPolicy === "external" ? { reportedFindings } : {}),
     findingsPath: r?.findingsPath,
     pocsPath: r?.pocsPath,
     objectiveResults: r?.objectiveResults,
@@ -47,6 +65,35 @@ function normalizeResult(result: unknown): TargetedPentestResult {
 export function startTargetedPentestAgent(
   input: PentestAgentInput,
 ): TargetedPentestHandle {
+  const resolved = resolveRootReasoning(input);
+  const persisted = persistRootReasoningOverride(input);
+  input = resolved;
+  if (!persisted) return startResolvedAgent(input);
+
+  let execution: TargetedPentestHandle | undefined;
+  let cancelled = false;
+  const started = persisted.then((session) => {
+    // A teardown during persistence must prevent a later agent from starting.
+    if (cancelled)
+      throw new DOMException("Agent aborted before start", "AbortError");
+    input.abortSignal?.throwIfAborted();
+    execution = startResolvedAgent({ ...input, session });
+    return execution;
+  });
+  return {
+    result: started.then((handle) => handle.result),
+    drained: started.then(
+      (handle) => handle.drained,
+      () => {},
+    ),
+    abortAndDrain: async () => {
+      cancelled = true;
+      await execution?.abortAndDrain();
+    },
+  };
+}
+
+function startResolvedAgent(input: PentestAgentInput): TargetedPentestHandle {
   const agent = new TargetedPentestAgent(input);
 
   if (!input.eventBus) {
@@ -62,7 +109,7 @@ export function startTargetedPentestAgent(
 
   const { result, abortAndDrain, drained } = startAgentExecution(agent);
   return {
-    result: result.then(normalizeResult),
+    result: result.then((value) => normalizeResult(value, input.findingPolicy)),
     abortAndDrain,
     drained,
   };

package/src/core/cli/reasoning.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, it } from "vitest";
+import { buildReasoningProviderOptions } from "../ai";
+import type { Config } from "../config/config";
+import { getSavedReasoning, resolveCliReasoning } from "./reasoning";
+
+describe("CLI reasoning selection", () => {
+  it.each([
+    "claude-sonnet-4-5",
+    "claude-opus-5-5",
+    "anthropic/claude-opus-4.6",
+    "anthropic/claude-sonnet-4.5",
+  ])("ignores a leftover GPT preference when switching to %s", (model) => {
+    const reasoning = getSavedReasoning(model, {
+      openAIReasoningEffort: "high",
+    });
+    expect(reasoning).toBe("default");
+    expect(buildReasoningProviderOptions(model, { reasoning })).toEqual(
+      buildReasoningProviderOptions(model, {
+        reasoning: getSavedReasoning(model, {}),
+      }),
+    );
+  });
+  it.each([
+    true,
+    false,
+  ])("ignores a leftover Claude toggle (%s) when switching to GPT", (enabled) => {
+    const model = "gpt-6.1-sol";
+    expect(getSavedReasoning(model, { reasoningEnabled: enabled })).toBe(
+      "default",
+    );
+    expect(
+      getSavedReasoning(model, {
+        reasoningEnabled: enabled,
+        openAIReasoningEffort: "low",
+      }),
+    ).toBe("low");
+  });
+  it.each([
+    ["concentrate:glm-5.3", "none", "low"],
+    ["concentrate:glm-5.3", "minimal", "max"],
+    ["concentrate:glm-5.3", "low", "low"],
+    ["concentrate:glm-5.3", "medium", "high"],
+    ["concentrate:glm-5.3", "high", "high"],
+    ["concentrate:glm-5.3", "xhigh", "max"],
+    ["concentrate:glm-5.3", "max", "max"],
+    ["concentrate:glm-5.3", "ultra", "max"],
+    ["gpt-6.1-sol", "ultra", "max"],
+    ["gpt-5", "xhigh", "medium"],
+  ] as const)("migrates %s / %s to %s identically to the API", (model, legacy, expected) => {
+    const reasoning = getSavedReasoning(model, {
+      openAIReasoningEffort: legacy,
+    });
+    expect(reasoning).toBe(expected);
+    expect(buildReasoningProviderOptions(model, { reasoning })).toEqual(
+      buildReasoningProviderOptions(model, { openAIReasoningEffort: legacy }),
+    );
+  });
+  it.each([
+    "claude-sonnet-4-5",
+    "claude-opus-5-5",
+    "anthropic/claude-opus-4.6",
+  ])("migrates the %s thinking toggle identically to the API", (model) => {
+    for (const enabled of [true, false]) {
+      const reasoning = getSavedReasoning(model, { reasoningEnabled: enabled });
+      expect(buildReasoningProviderOptions(model, { reasoning })).toEqual(
+        buildReasoningProviderOptions(model, { enableThinking: enabled }),
+      );
+    }
+  });
+  it("keeps explicit canonical values ahead of legacy migration and rejects invalid new selections", () => {
+    const model = "concentrate:glm-5.3";
+    const config: Pick<Config, "modelReasoning" | "openAIReasoningEffort"> = {
+      modelReasoning: { [model]: "low" },
+      openAIReasoningEffort: "xhigh",
+    };
+    const reasoning = getSavedReasoning(model, config);
+    expect(reasoning).toBe("low");
+    expect(
+      buildReasoningProviderOptions(model, {
+        reasoning,
+        openAIReasoningEffort: "xhigh",
+      }),
+    ).toEqual(
+      buildReasoningProviderOptions(model, { openAIReasoningEffort: "low" }),
+    );
+    expect(() =>
+      resolveCliReasoning(["--effort", "xhigh"], model, config),
+    ).toThrow("not supported");
+    expect(() =>
+      buildReasoningProviderOptions(model, { reasoning: "xhigh" }),
+    ).toThrow("not supported");
+  });
+  it("gives an invocation precedence over the saved per-model preference", () => {
+    expect(
+      resolveCliReasoning(["--effort", "low"], "claude-opus-5-5", {
+        modelReasoning: { "claude-opus-5-5": "max" },
+      }),
+    ).toBe("low");
+    expect(resolveCliReasoning(["--effort=high"], "gpt-6.1-sol", {})).toBe(
+      "high",
+    );
+  });
+  it("does not carry incompatible settings between models", () => {
+    const config = { modelReasoning: { "gpt-6.1-sol": "max" as const } };
+    expect(getSavedReasoning("gemini-3-pro-preview", config)).toBe("default");
+    expect(getSavedReasoning("gpt-6.1-sol", config)).toBe("max");
+  });
+  it("migrates supported legacy preferences without offering the ultra alias", () => {
+    expect(
+      getSavedReasoning("gpt-6.1-sol", { openAIReasoningEffort: "ultra" }),
+    ).toBe("max");
+    expect(
+      getSavedReasoning("claude-sonnet-4-5", { reasoningEnabled: true }),
+    ).toBe("enabled");
+    expect(
+      getSavedReasoning("anthropic/claude-opus-4.6", {
+        reasoningEnabled: true,
+      }),
+    ).toBe("high");
+    expect(
+      getSavedReasoning("anthropic/claude-opus-4.6", {
+        reasoningEnabled: false,
+      }),
+    ).toBe("none");
+  });
+  it.each([
+    ["--effort"],
+    ["--effort", "--model"],
+    ["--effort", "ultra"],
+    ["--effort", "none"],
+    ["--effort", "low", "--extended-thinking"],
+  ])("rejects invalid flags before execution: %j", (...args) => {
+    expect(() => resolveCliReasoning(args, "gpt-6.1-sol", {})).toThrow();
+  });
+  it("uses a toggle only where the model supports it", () => {
+    expect(
+      resolveCliReasoning(["--extended-thinking"], "claude-sonnet-4-5", {}),
+    ).toBe("enabled");
+    expect(
+      resolveCliReasoning(["--no-extended-thinking"], "gemini-2.5-flash", {}),
+    ).toBe("disabled");
+    expect(() =>
+      resolveCliReasoning(["--no-extended-thinking"], "claude-opus-5-5", {}),
+    ).toThrow();
+    expect(() =>
+      resolveCliReasoning(["--extended-thinking"], "unknown", {}),
+    ).toThrow();
+  });
+});