@stigmer/runner 0.1.0-dev.20261017020314.g644422724c27

package/src/activities/execute-cursor/__tests__/hitl-resume-history.test.ts

@@ -0,0 +1,431 @@
+/**
+ * Regression test: resuming a Cursor execution after an approval must emit an
+ * APPEND-ONLY transcript that the backend's append-only-at-identity guard
+ * accepts.
+ *
+ * This is the precise, deterministic reproduction of the production stall traced
+ * to `aex_01kvz3pw20j6t0hw80wpevnztb` (open-computer-use "send a Slack self-DM"):
+ *
+ *   1. The agent gated two MCP tools (list_apps, get_app_state); the user
+ *      approved BOTH. The persisted run-1 transcript holds them as
+ *      WAITING_APPROVAL / approval_action=APPROVE.
+ *   2. On resume the Cursor SDK re-issues those approved tools with BRAND-NEW
+ *      call ids and the agent advances to a third tool (click) which gets gated.
+ *   3. Before the fix, the resume rebuilt the transcript from empty, so the new
+ *      status carried only the fresh ids and DROPPED the two committed ids. The
+ *      backend guard (nonTerminalTranscriptRegression / transcriptRegressionReason)
+ *      rejects "would drop a previously-committed tool call", so the new `click`
+ *      pending was never persisted, pending_approvals stayed 0, and the workflow
+ *      watchdog failed the run ("approval propagation is broken").
+ *
+ * The fix (seed the transcript on resume + reconcile re-runs by canonical
+ * identity in the Cursor translator) makes the resume status a strict superset:
+ * the committed ids survive, the re-runs reconcile in place, and the genuinely
+ * new gated tool is appended. The guard then accepts it.
+ *
+ * The test asserts both directions against a local mirror of the Go guard
+ * (nonTerminalTranscriptRegression): a from-empty rebuild is REJECTED (the bug),
+ * a seeded rebuild is ACCEPTED (the fix).
+ *
+ * This exercises the translator + builder + denial-reconciliation directly — the
+ * unit that owns the resume emitter — rather than the full Temporal activity,
+ * keeping the reproduction hermetic and pinned to the exact code under change.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create, clone } from "@bufbuild/protobuf";
+import type { SDKMessage } from "@cursor/sdk";
+import { reconcileDeniedToolCalls, clearProvisionalPostDenialNarration } from "../boundary-rows.js";
+import { CursorFold, builderOver } from "../__test-utils__/fold.js";
+import { TranscriptBuilder } from "../../../harness/transcript/builder.js";
+import {
+  grantToken,
+  buildApprovalGrants,
+  buildApprovalState,
+  reconstructAdjudicatedApprovals,
+} from "../approval-state.js";
+import type { DeniedLedgerEntry } from "../approval-state.js";
+import {
+  setupCursorHookHarness,
+  hasBash,
+  hookWrite,
+  hookShell,
+  hookMcp,
+  NO_MCP_DEFAULT,
+} from "../__test-utils__/cursor-hook-harness.js";
+import { loggedApprovalsFor } from "../../../__test-utils__/approval-log.js";
+import { AgentMessageSchema, ToolCallSchema, type AgentMessage, SubAgentRunSchema, TurnRowsSchema } from "../../../gen/turn/ai/stigmer/runner/turn/v1/rows_pb.js";
+import { ApprovalAction, MessageType, ToolCallStatus, SubAgentStatus } from "../../../gen/turn/ai/stigmer/runner/turn/v1/enum_pb.js";
+import { RunStatusSchema } from "@stigmer/apis/ai/stigmer/agentic/run/v1/api_pb";
+
+/** The run the logged answers belong to. */
+const RUN_ID = "run_resume_history";
+
+const MCP_SLUG = "open-computer-use";
+
+// The two approved tools' ORIGINAL committed ids (as they appear in the
+// persisted run-1 transcript). The resume re-issues them with the *_RESUME ids.
+const LIST_APPS_ID = "tool_de9b3cd7";
+const GET_STATE_ID = "tool_1c47c984";
+
+const RUN1_AI_TEXT = "I'll inspect the open apps first.";
+const RUN2_AI_TEXT = "Now I'll click the compose button.";
+const RUN2_TRAILING_NARRATION = "Done — the message was sent.";
+
+/** A Cursor MCP tool_call event (name="mcp", details nested in args). */
+function mcpToolCallEvent(
+  callId: string,
+  toolName: string,
+  status: "running" | "completed" | "error",
+  runId: string,
+  opts?: { result?: unknown; innerArgs?: Record<string, unknown> },
+): Extract<SDKMessage, { type: "tool_call" }> {
+  return {
+    type: "tool_call",
+    agent_id: "agent-1",
+    run_id: runId,
+    call_id: callId,
+    name: "mcp",
+    status,
+    result: opts?.result,
+    args: {
+      providerIdentifier: MCP_SLUG,
+      toolName,
+      args: opts?.innerArgs ?? {},
+    },
+  };
+}
+
+function assistantEvent(
+  runId: string,
+  text: string,
+): Extract<SDKMessage, { type: "assistant" }> {
+  return {
+    type: "assistant",
+    agent_id: "agent-1",
+    run_id: runId,
+    message: { role: "assistant" as const, content: [{ type: "text" as const, text }] },
+  };
+}
+
+/**
+ * The persisted run-1 transcript: an AI message bearing the two MCP tools the
+ * user already approved (status WAITING_APPROVAL, approval_action APPROVE — the
+ * exact shape the backend keeps for a decided-but-not-yet-resumed tool call).
+ */
+function persistedRunOneMessages(): AgentMessage[] {
+  return [
+    create(AgentMessageSchema, {
+      type: MessageType.MESSAGE_AI,
+      content: RUN1_AI_TEXT,
+      timestamp: "2026-06-24T00:00:01.000Z",
+      toolCalls: [
+        create(ToolCallSchema, {
+          id: LIST_APPS_ID,
+          name: "list_apps",
+          mcpServerSlug: MCP_SLUG,
+          status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+          requiresApproval: true,
+          approvalAction: ApprovalAction.APPROVE,
+        }),
+        create(ToolCallSchema, {
+          id: GET_STATE_ID,
+          name: "get_app_state",
+          mcpServerSlug: MCP_SLUG,
+          status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+          requiresApproval: true,
+          approvalAction: ApprovalAction.APPROVE,
+        }),
+      ],
+    }),
+  ];
+}
+
+/**
+ * The events the SDK re-emits on resume: the two approved tools re-run with
+ * FRESH ids and complete, the agent narrates and calls a new tool (click) which
+ * is gated (emitted running, then cut off by the first-denial stop), followed by
+ * trailing provisional narration.
+ */
+function resumeEvents(): SDKMessage[] {
+  return [
+    assistantEvent("r2", RUN2_AI_TEXT),
+    mcpToolCallEvent(`${LIST_APPS_ID}_RESUME`, "list_apps", "running", "r2"),
+    mcpToolCallEvent(`${LIST_APPS_ID}_RESUME`, "list_apps", "completed", "r2", {
+      result: "Slack, Mail, Safari",
+    }),
+    mcpToolCallEvent(`${GET_STATE_ID}_RESUME`, "get_app_state", "running", "r2"),
+    mcpToolCallEvent(`${GET_STATE_ID}_RESUME`, "get_app_state", "completed", "r2", {
+      result: "Slack focused",
+    }),
+    // The genuinely-new gated tool: emitted running, never completes (the hook
+    // denies it and the turn is cut off at the first denial).
+    mcpToolCallEvent("tool_click_RESUME", "click", "running", "r2"),
+    // Trailing provisional narration in a NEW turn (separate run id) — the kind
+    // clearProvisionalPostDenialNarration must blank for the CURRENT turn only.
+    assistantEvent("r3", RUN2_TRAILING_NARRATION),
+  ];
+}
+
+/** The denial ledger after resume holds only the freshly-gated `click`. */
+function clickDenialLedger(): DeniedLedgerEntry[] {
+  return [{ toolName: "click", token: grantToken(`${MCP_SLUG}/click`, "") }];
+}
+
+/**
+ * Local mirror of the backend's nonTerminalTranscriptRegression (Go) /
+ * transcriptRegressionReason (Java): for a non-terminal execution, an incoming
+ * transcript must neither shrink nor drop a previously-committed tool-call id.
+ * Returns the rejection reason, or undefined if the update would be accepted.
+ */
+function guardRejectionReason(
+  existing: AgentMessage[],
+  incoming: AgentMessage[],
+): string | undefined {
+  if (incoming.length < existing.length) return "would shrink the message transcript";
+  const incomingIds = new Set<string>();
+  for (const m of incoming) for (const tc of m.toolCalls) if (tc.id) incomingIds.add(tc.id);
+  for (const m of existing) {
+    for (const tc of m.toolCalls) {
+      if (tc.id && !incomingIds.has(tc.id)) return "would drop a previously-committed tool call";
+    }
+  }
+  return undefined;
+}
+
+function allToolCalls(messages: AgentMessage[]) {
+  return messages.flatMap((m) => m.toolCalls);
+}
+
+describe("Cursor HITL resume — append-only transcript", () => {
+  it("BUG (no seeding): a from-empty rebuild drops committed ids and the guard rejects it", () => {
+    const committed = persistedRunOneMessages();
+
+    // Pre-fix behavior: the rows start empty on resume, so the translator
+    // can never reconcile onto the committed calls.
+    const fromEmpty: AgentMessage[] = [];
+    new CursorFold({ messages: fromEmpty }).events(...resumeEvents()).finalize();
+
+    // The committed ids are absent — exactly what trips the backend guard.
+    const ids = new Set(allToolCalls(fromEmpty).map((tc) => tc.id));
+    expect(ids.has(LIST_APPS_ID)).toBe(false);
+    expect(ids.has(GET_STATE_ID)).toBe(false);
+
+    expect(guardRejectionReason(committed, fromEmpty)).toBe(
+      "would drop a previously-committed tool call",
+    );
+  });
+
+  it("FIX (seeding + identity reconciliation): the resume is a strict superset the guard accepts", async () => {
+    const committed = persistedRunOneMessages();
+
+    // Post-fix behavior: the resume seeds the turn's rows (cloned) before
+    // constructing the translator and the builder.
+    const seeded = committed.map((m) => clone(AgentMessageSchema, m));
+    new CursorFold({ messages: seeded }).events(...resumeEvents()).finalize();
+
+    // Post-stream denial overlay (the activity's Phase 12): only `click` is in
+    // the ledger, so only it flips to WAITING_APPROVAL.
+    const denied = await reconcileDeniedToolCalls(seeded, builderOver(seeded), clickDenialLedger());
+    const redacted = clearProvisionalPostDenialNarration(seeded, denied);
+
+    const tools = allToolCalls(seeded);
+
+    // 1. The committed ids are preserved (reconciled in place, not re-keyed).
+    const byId = new Map(tools.map((tc) => [tc.id, tc]));
+    expect(byId.has(LIST_APPS_ID)).toBe(true);
+    expect(byId.has(GET_STATE_ID)).toBe(true);
+
+    // 2. No duplicate rows: the fresh *_RESUME ids never produced new tool calls.
+    expect(tools.filter((tc) => tc.name === "list_apps")).toHaveLength(1);
+    expect(tools.filter((tc) => tc.name === "get_app_state")).toHaveLength(1);
+    expect(tools.some((tc) => tc.id === `${LIST_APPS_ID}_RESUME`)).toBe(false);
+    expect(tools.some((tc) => tc.id === `${GET_STATE_ID}_RESUME`)).toBe(false);
+
+    // 3. The approved re-runs reconciled onto the seeded calls and completed.
+    expect(byId.get(LIST_APPS_ID)!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(byId.get(LIST_APPS_ID)!.result).toContain("Slack");
+    expect(byId.get(GET_STATE_ID)!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+
+    // 4. The genuinely-new gated tool is appended and surfaced as pending.
+    const click = tools.find((tc) => tc.name === "click");
+    expect(click).toBeDefined();
+    expect(click!.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+
+    // 5. Provisional post-denial narration is redacted for the CURRENT turn only:
+    //    the trailing "Done" message is blanked, while the seeded run-1 text and
+    //    the gated turn's own narration are preserved.
+    expect(redacted).toHaveLength(1);
+    const allText = seeded.map((m) => m.content).join("\n");
+    expect(allText).toContain(RUN1_AI_TEXT);
+    expect(allText).toContain(RUN2_AI_TEXT);
+    expect(allText).not.toContain(RUN2_TRAILING_NARRATION);
+
+    // 6. The decisive invariant: the seeded resume passes the backend guard.
+    expect(guardRejectionReason(committed, seeded)).toBeUndefined();
+  });
+
+  it("FIX: a sub-agent's gated tool also survives resume (the seeded sub-agent rows are wrapped by reference and indexed)", () => {
+    // Sub-agent parity: a resume seeds the sub-agent rows that hold an ask
+    // (`harness/transcript/resume-seed.ts`, through the builder's `seed()`)
+    // and the builder holds that very array, exactly as it holds the
+    // messages, so the seeded row is retained, indexed by id, and a resumed
+    // update lands on it in place. This arm hands the seeded status
+    // to the constructor, which indexes by the same routine `seed()` does.
+    const seededSub = create(SubAgentRunSchema, {
+      id: "sub_1",
+      name: "researcher",
+      status: SubAgentStatus.SUB_AGENT_IN_PROGRESS,
+    });
+    const statusRows = [seededSub];
+
+    const status = create(TurnRowsSchema, {});
+    status.subAgentRuns = statusRows;
+    new TranscriptBuilder("exec-resume", status, create(RunStatusSchema)).finalize();
+
+    expect(status.subAgentRuns, "the status's own array, not a copy").toBe(statusRows);
+    expect(status.subAgentRuns.some((s) => s.id === "sub_1")).toBe(true);
+  });
+
+  // The transcript-superset fix keeps the run off the watchdog, but the OTHER
+  // half of "no loop" is that the approved tools' grants actually let the hook
+  // ALLOW the re-issued calls. Drive the real bash hook with the grants the
+  // resume mints from the persisted run-1 decisions and prove the two approved
+  // MCP tools pass while the genuinely-new `click` is still gated. The hook
+  // needs bash, mirroring the d() guard.
+  it.skipIf(!hasBash)("FIX: the approved tools are ALLOWED by the hook on resume — not re-denied (the loop's source)", () => {
+    const runOne = persistedRunOneMessages();
+    const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(runOne, loggedApprovalsFor(RUN_ID, runOne));
+    const grants = buildApprovalGrants(pendingApprovals, decisions);
+    const state = buildApprovalState(NO_MCP_DEFAULT, false, new Set(), grants);
+
+    const harness = setupCursorHookHarness({
+      grants: state.approvedGrants,
+      destructiveMcpTools: ["list_apps", "get_app_state", "click"],
+      destructiveMcpServer: MCP_SLUG,
+    });
+
+    // Both approved tools are allowed on the resumed turn (fresh ids, same name).
+    expect(harness.decide(hookMcp("list_apps", {}, MCP_SLUG)).permission).toBe("allow");
+    expect(harness.decide(hookMcp("get_app_state", {}, MCP_SLUG)).permission).toBe("allow");
+    // The brand-new gated tool is NOT covered by any grant -> still denied.
+    expect(harness.decide(hookMcp("click", {}, MCP_SLUG)).permission).toBe("deny");
+  });
+});
+
+/**
+ * The exact "two co-pending approvals -> resume -> both allowed -> COMPLETE"
+ * scenario, on the built-in edit+shell path (the file-diff case from the bug
+ * report). This is the success terminus the production loop never reached: when
+ * every gated tool was approved and the agent has nothing new to gate, the resume
+ * must re-run both approved tools, complete, and leave ZERO tools waiting — a
+ * legitimate zero-pending because the run is TERMINAL, not because the guard
+ * dropped a pending (the watchdog's failure mode). Asserting "no WAITING_APPROVAL
+ * survives a clean completion" is what distinguishes the two zero-pending states.
+ */
+describe("Cursor HITL resume — two approvals then clean completion (no loop)", () => {
+  const NOTES_PATH = "/work/notes.md";
+  const WRITE_ID = "tool_write_notes";
+  const SHELL_CMD = "cat >> notes.md << 'EOF'\nappended\nEOF";
+  const SHELL_ID = "tool_append_notes";
+
+  /** Persisted run-1: an edit and a shell, both gated, both APPROVED. */
+  function committedBuiltInApprovals(): AgentMessage[] {
+    const edit = create(ToolCallSchema, {
+      id: WRITE_ID,
+      name: "edit",
+      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+      requiresApproval: true,
+      approvalAction: ApprovalAction.APPROVE,
+      argsPreview: JSON.stringify({ path: NOTES_PATH, content: "# Notes" }),
+    });
+    const shell = create(ToolCallSchema, {
+      id: SHELL_ID,
+      name: "shell",
+      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+      requiresApproval: true,
+      approvalAction: ApprovalAction.APPROVE,
+      argsPreview: JSON.stringify({ command: SHELL_CMD }),
+    });
+    return [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        content: "I'll create and append to the notes file.",
+        timestamp: "2026-06-24T00:00:01.000Z",
+        toolCalls: [edit, shell],
+      }),
+    ];
+  }
+
+  /** Resume re-issues both approved tools (fresh ids) and they COMPLETE; no new gate. */
+  function builtInResumeEvents(): SDKMessage[] {
+    const editArgs = { path: NOTES_PATH, content: "# Notes" };
+    const shellArgs = { command: SHELL_CMD };
+    return [
+      assistantEvent("r2", "Applying the approved file changes."),
+      {
+        type: "tool_call", agent_id: "agent-1", run_id: "r2",
+        call_id: `${WRITE_ID}_RESUME`, name: "edit", status: "running", args: editArgs,
+      } as SDKMessage,
+      {
+        type: "tool_call", agent_id: "agent-1", run_id: "r2",
+        call_id: `${WRITE_ID}_RESUME`, name: "edit", status: "completed",
+        result: "wrote notes.md", args: editArgs,
+      } as SDKMessage,
+      {
+        type: "tool_call", agent_id: "agent-1", run_id: "r2",
+        call_id: `${SHELL_ID}_RESUME`, name: "shell", status: "running", args: shellArgs,
+      } as SDKMessage,
+      {
+        type: "tool_call", agent_id: "agent-1", run_id: "r2",
+        call_id: `${SHELL_ID}_RESUME`, name: "shell", status: "completed",
+        result: "appended", args: shellArgs,
+      } as SDKMessage,
+      assistantEvent("r2", "Done — the notes file is ready."),
+    ];
+  }
+
+  it("re-runs both approved tools in place and completes with ZERO tools waiting", async () => {
+    const committed = committedBuiltInApprovals();
+    const seeded = committed.map((m) => clone(AgentMessageSchema, m));
+
+    new CursorFold({ messages: seeded }).events(...builtInResumeEvents()).finalize();
+
+    // The hook allowed both (no denials this turn), so the overlay adds nothing.
+    const denied = await reconcileDeniedToolCalls(seeded, builderOver(seeded), []);
+    expect(denied).toHaveLength(0);
+
+    const tools = allToolCalls(seeded);
+    const byId = new Map(tools.map((tc) => [tc.id, tc]));
+
+    // In-place reconcile: the committed ids survive and carry the completion;
+    // the fresh *_RESUME ids never spawned duplicate rows.
+    expect(tools.filter((tc) => tc.name === "edit")).toHaveLength(1);
+    expect(tools.filter((tc) => tc.name === "shell")).toHaveLength(1);
+    expect(byId.get(WRITE_ID)!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(byId.get(SHELL_ID)!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+
+    // The decisive no-loop property: nothing is left WAITING_APPROVAL, so the
+    // run can reach a terminal status. Zero pending here is CORRECT (the run is
+    // done), unlike the watchdog's zero-pending-while-WAITING failure mode.
+    expect(tools.some((tc) => tc.status === ToolCallStatus.TOOL_CALL_WAITING_APPROVAL)).toBe(false);
+
+    // And the transcript is still a strict superset the backend guard accepts.
+    expect(guardRejectionReason(committed, seeded)).toBeUndefined();
+  });
+
+  it.skipIf(!hasBash)("the built-in grants actually let the hook allow both re-issues (full closure)", () => {
+    const committed = committedBuiltInApprovals();
+    const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(committed, loggedApprovalsFor(RUN_ID, committed));
+    const grants = buildApprovalGrants(pendingApprovals, decisions);
+    const state = buildApprovalState(NO_MCP_DEFAULT, false, new Set(), grants);
+
+    const harness = setupCursorHookHarness({ grants: state.approvedGrants });
+    // Exactly the two approved resources are allowed on resume...
+    expect(harness.decide(hookWrite(NOTES_PATH)).permission).toBe("allow");
+    expect(harness.decide(hookShell(SHELL_CMD)).permission).toBe("allow");
+    // ...and an unrelated write/shell of the same category is still gated.
+    expect(harness.decide(hookWrite("/work/secret.env")).permission).toBe("deny");
+    expect(harness.decide(hookShell("rm -rf /")).permission).toBe("deny");
+  });
+});

package/src/activities/execute-cursor/__tests__/hook-refusal-rows.test.ts

@@ -0,0 +1,95 @@
+/**
+ * Pins the turn boundary's settle of calls the hook layer refused before
+ * they ran (`boundary-rows.ts` `stampHookRefusedToolCalls`, ledger kind
+ * `hook`): each entry settles the first row of its call (the exact identity,
+ * its coarse identity, then the workspace-normalized path), in the turn's
+ * messages or a sub-agent this turn started; the row is FAILED with the very
+ * text the model read, names the hook that refused, and names none for a
+ * person's earlier refusal; an earlier turn's row, a row that ran, and an
+ * entry with no refusal text are left alone. Two refusals of one command in a
+ * turn stamp two rows, and the terminal twin collapse that runs after the
+ * stamp keeps both (#1967).
+ */
+
+import { create, type JsonObject } from "@bufbuild/protobuf";
+import { describe, expect, it } from "vitest";
+import { contentToken, grantToken, type DeniedLedgerEntry } from "../approval-state.js";
+import { collapseRedundantToolCallTwins, stampHookRefusedToolCalls } from "../boundary-rows.js";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+  type ToolCall,
+  SubAgentRunSchema,
+} from "../../../gen/turn/ai/stigmer/runner/turn/v1/rows_pb.js";
+import { ApprovalPolicySource, ToolCallStatus } from "../../../gen/turn/ai/stigmer/runner/turn/v1/enum_pb.js";
+
+const BLOCKED = "Blocked by a hook";
+
+const row = (id: string, name: string, args: JsonObject, status = ToolCallStatus.TOOL_CALL_FAILED): ToolCall =>
+  create(ToolCallSchema, { id, name, args, status, error: status === ToolCallStatus.TOOL_CALL_FAILED ? BLOCKED : "" });
+
+const message = (...toolCalls: ToolCall[]) => create(AgentMessageSchema, { toolCalls });
+
+describe("stampHookRefusedToolCalls", () => {
+  it("settles each refused call's row with the model's text, naming the hook that refused or none for a person", () => {
+    const shell = row("c-shell", "shell", { command: "rm -rf x" });
+    const edit = row("c-edit", "edit", { path: "/w/a.txt", old_string: "a", new_string: "b" });
+    const read = row("c-read", "read", { path: "notes.md" }, ToolCallStatus.TOOL_CALL_RUNNING);
+    const inSubAgent = row("c-sub", "shell", { command: "curl x" });
+    const ran = row("c-ran", "shell", { command: "ls" }, ToolCallStatus.TOOL_CALL_COMPLETED);
+    const listing = row("c-ls", "ls", { path: "src" });
+    const earlier = row("c-earlier", "shell", { command: "rm -rf x" });
+    const ledger: DeniedLedgerEntry[] = [
+      { toolName: "Shell", token: grantToken("shell", "rm -rf x"), kind: "hook", message: "no deletes", hook: "safety" },
+      // The hook's Write carried the whole new file: the edit row matches by its coarse identity.
+      { toolName: "Write", token: contentToken("write", "/w/a.txt", "d1g"), kind: "hook", message: "rejected by you", },
+      // The hook saw an absolute path; the stream spelled it relatively.
+      { toolName: "Read", token: grantToken("Read", "/w/notes.md"), kind: "hook", message: "no reading notes", hook: "" },
+      { toolName: "Shell", token: grantToken("shell", "curl x"), kind: "hook", message: "no network", hook: "net" },
+      // The hook's List is the stream's `ls`, its path spelled relatively there.
+      { toolName: "List", token: grantToken("List", "/w/src"), kind: "hook", message: "no listing src", hook: "safety" },
+      { toolName: "Shell", token: grantToken("shell", "ls"), kind: "hook", message: "would not match a ran row", hook: "x" },
+      { toolName: "Shell", token: grantToken("shell", "whoami"), kind: "hook" },
+      { toolName: "Shell", token: grantToken("shell", "rm -rf x"), kind: "approval", hook: "safety" },
+    ];
+    const messages = [message(earlier), message(shell, edit, read, ran, listing), message(row("c-task", "task", {}, ToolCallStatus.TOOL_CALL_COMPLETED))];
+    const subAgents = [create(SubAgentRunSchema, { id: "c-task", messages: [message(inSubAgent)] })];
+
+    expect(stampHookRefusedToolCalls(messages, subAgents, ledger, 1, "/w")).toEqual(["c-shell", "c-edit", "c-read", "c-sub", "c-ls"]);
+    expect([listing.error, listing.approvalPolicyHook]).toEqual(["no listing src", "safety"]);
+    expect([shell.status, shell.error, shell.approvalPolicySource, shell.approvalPolicyHook]).toEqual([
+      ToolCallStatus.TOOL_CALL_FAILED, "no deletes", ApprovalPolicySource.HOOK, "safety",
+    ]);
+    expect(shell.policyEngineVersion).not.toBe("");
+    expect([edit.error, edit.approvalPolicySource, edit.approvalPolicyHook, edit.policyEngineVersion]).toEqual([
+      "rejected by you", ApprovalPolicySource.UNSPECIFIED, "", "",
+    ]);
+    expect([read.status, read.error, read.approvalPolicyHook, read.requiresApproval]).toEqual([ToolCallStatus.TOOL_CALL_FAILED, "no reading notes", "", false]);
+    expect(read.completedAt).not.toBe("");
+    expect([inSubAgent.error, inSubAgent.approvalPolicyHook]).toEqual(["no network", "net"]);
+    expect([ran.status, earlier.error], "a row that ran, and an earlier turn's, stay as they are").toEqual([ToolCallStatus.TOOL_CALL_COMPLETED, BLOCKED]);
+  });
+
+  it("stamps two hook refusals of one command as two rows, and the terminal collapse after it keeps both", () => {
+    const first = row("c-rm-1", "shell", { command: "rm -rf build" });
+    const tamper = row("c-tamper", "shell", { command: "cp allow.py rule_engine.py" }, ToolCallStatus.TOOL_CALL_COMPLETED);
+    const second = row("c-rm-2", "shell", { command: "rm -rf build" });
+    const refusal = { toolName: "Shell", token: grantToken("shell", "rm -rf build"), kind: "hook", message: "[block-dangerous-rm]", hook: "hookify" } as const;
+    const messages = [message(first), message(tamper), message(second)];
+
+    const stamped = stampHookRefusedToolCalls(messages, [], [refusal, refusal], 0);
+    expect(stamped).toEqual(["c-rm-1", "c-rm-2"]);
+    // Terminal finalize (turn-settle.ts) collapses twins after the boundary
+    // stamped them, keeping the ids the boundary returned.
+    expect(collapseRedundantToolCallTwins(messages, new Set(stamped))).toBe(0);
+    for (const refused of [first, second]) {
+      expect([refused.status, refused.error, refused.approvalPolicyHook]).toEqual([ToolCallStatus.TOOL_CALL_FAILED, "[block-dangerous-rm]", "hookify"]);
+    }
+  });
+
+  it("settles nothing without a refusal that carries its text", () => {
+    const shell = row("c-shell", "shell", { command: "rm -rf x" });
+    expect(stampHookRefusedToolCalls([message(shell)], [], [{ toolName: "Shell", token: grantToken("shell", "rm -rf x"), kind: "hook" }], 0)).toEqual([]);
+    expect(shell.error).toBe(BLOCKED);
+  });
+});