@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/src/__test-utils__/fake-artifact-storage.ts

@@ -0,0 +1,72 @@
+/**
+ * The single canonical in-memory {@link ArtifactStorage} test double.
+ *
+ * Every runner test that needs a fake storage should use this — do NOT hand-roll
+ * another partial `ArtifactStorage` literal. Before this helper existed, ~16 test
+ * files each invented their own fake (and their own `getDownloadUrl` convention:
+ * `mem://`, `https://artifacts.local/`, `mock://`, identity, …), which drifted
+ * from the real port and from each other. This double is the one place the port
+ * is modeled for tests.
+ *
+ * Design:
+ *  - `upload` / `download` / `exists` are backed by one shared `Map`, so a key
+ *    that was uploaded reads back byte-exact — the double behaves like a real
+ *    content store, not a set of disconnected stubs.
+ *  - Every method is a `vi.fn`, so call assertions still work
+ *    (`expect(storage.download).toHaveBeenCalledWith(key)`), and any method can
+ *    be overridden per-test to force a failure
+ *    (`storage.download.mockRejectedValueOnce(new Error("… HTTP 404 …"))`).
+ *  - `getDownloadUrl` returns `${urlBase}${key}`; tests that assert on the URL
+ *    string pass their own `urlBase`.
+ */
+
+import { vi } from "vitest";
+import type { ArtifactStorage } from "../shared/artifact-storage.js";
+
+/** An {@link ArtifactStorage} whose methods are `vi.fn` spies over a shared Map. */
+export type InMemoryArtifactStorage = {
+  [K in keyof ArtifactStorage]: ReturnType<typeof vi.fn>;
+} & ArtifactStorage;
+
+export interface InMemoryArtifactStorageOptions {
+  /** Prefix for the URLs `getDownloadUrl` returns. Defaults to `mem://`. */
+  readonly urlBase?: string;
+}
+
+export interface InMemoryArtifactStorageHandle {
+  /** The storage double to inject; all methods are spy-able `vi.fn`s. */
+  readonly storage: InMemoryArtifactStorage;
+  /** The backing store — inspect or seed it directly in a test. */
+  readonly blobs: Map<string, Buffer>;
+}
+
+/**
+ * Build an in-memory {@link ArtifactStorage} backed by a shared `Map`.
+ *
+ * @example
+ * const { storage, blobs } = makeInMemoryArtifactStorage();
+ * await storage.upload("k", Buffer.from("hi"));
+ * expect((await storage.download("k")).toString()).toBe("hi");
+ */
+export function makeInMemoryArtifactStorage(
+  opts: InMemoryArtifactStorageOptions = {},
+): InMemoryArtifactStorageHandle {
+  const urlBase = opts.urlBase ?? "mem://";
+  const blobs = new Map<string, Buffer>();
+
+  const storage = {
+    upload: vi.fn(async (key: string, content: Buffer, _contentType?: string) => {
+      blobs.set(key, Buffer.from(content));
+      return key;
+    }),
+    getDownloadUrl: vi.fn(async (key: string) => `${urlBase}${key}`),
+    download: vi.fn(async (key: string) => {
+      const b = blobs.get(key);
+      if (!b) throw new Error(`Artifact not found for key '${key}'`);
+      return Buffer.from(b);
+    }),
+    exists: vi.fn(async (key: string) => blobs.has(key)),
+  } as InMemoryArtifactStorage;
+
+  return { storage, blobs };
+}

package/src/__tests__/approval-gateway-contract.test.ts

@@ -0,0 +1,29 @@
+/**
+ * The runnable HITL gateway P0 safety contract.
+ *
+ * Runs the single, authoritative invariant catalog (see
+ * `__test-utils__/approval-contract/contract.ts`) against BOTH real enforcement
+ * substrates — the in-process deep-agent gate (a real LangGraph graph) and the
+ * out-of-process Cursor deny-oracle (the real bash hook) — and then asserts the
+ * two substrates AGREE on the same logical action.
+ *
+ * This is the consolidation home for the Phase-2 (T03) gateway safety behaviors:
+ * reverting any P0 behavior on either substrate fails here, and a future
+ * substrate joins the safety net by implementing `GatewaySubstrate` and adding
+ * one line below. The Cursor suite self-skips where `bash` is unavailable.
+ */
+
+import {
+  describeGatewayContract,
+  describeCrossSubstrateAgreement,
+} from "../__test-utils__/approval-contract/contract.js";
+import { createDeepAgentSubstrate } from "../activities/execute-deep-agent/__test-utils__/gateway-substrate.js";
+import { createCursorSubstrate } from "../activities/execute-cursor/__test-utils__/gateway-substrate.js";
+
+const deepAgent = createDeepAgentSubstrate();
+const cursor = createCursorSubstrate();
+
+describeGatewayContract(deepAgent);
+describeGatewayContract(cursor);
+
+describeCrossSubstrateAgreement([deepAgent, cursor]);

package/src/__tests__/claimcheck-codec.test.ts

@@ -1,8 +1,8 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach } from "vitest";
 import { ClaimcheckPayloadCodec } from "../claimcheck/payload-codec.js";
 import { compress } from "../claimcheck/compressor.js";
 import type { ClaimcheckConfig } from "../claimcheck/config.js";
-import type { ArtifactStorage } from "../shared/artifact-storage.js";
+import { makeInMemoryArtifactStorage } from "../__test-utils__/fake-artifact-storage.js";
 import type { Payload } from "@temporalio/common";
 
 function makeConfig(overrides: Partial<ClaimcheckConfig> = {}): ClaimcheckConfig {
@@ -15,23 +15,12 @@ function makeConfig(overrides: Partial<ClaimcheckConfig> = {}): ClaimcheckConfig
   };
 }
 
-function makeStorage(): ArtifactStorage & {
-  uploads: Map<string, Buffer>;
-} {
-  const uploads = new Map<string, Buffer>();
-  return {
-    uploads,
-    async upload(key: string, content: Buffer) {
-      uploads.set(key, content);
-      return key;
-    },
-    async getDownloadUrl(key: string) {
-      return `mock://storage/${key}`;
-    },
-    async exists(key: string) {
-      return uploads.has(key);
-    },
-  };
+function makeStorage() {
+  // The canonical in-memory double; `uploads` aliases its backing Map so the
+  // existing `storage.uploads.*` assertions keep working, and `download` reads
+  // straight from what `encode` uploaded (no fetch to stub).
+  const { storage, blobs } = makeInMemoryArtifactStorage();
+  return Object.assign(storage, { uploads: blobs });
 }
 
 function makePayload(data: string | Buffer): Payload {
@@ -158,21 +147,9 @@ describe("ClaimcheckPayloadCodec", () => {
       const original = makeLargePayload(2048);
       const [encoded] = await codec.encode([original]);
 
-      const marker = JSON.parse(Buffer.from(encoded.data!).toString());
-      const storedData = storage.uploads.get(marker.key)!;
-
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
-        ok: true,
-        arrayBuffer: () => Promise.resolve(storedData.buffer.slice(
-          storedData.byteOffset,
-          storedData.byteOffset + storedData.byteLength,
-        )),
-      }));
-
+      // decode reads back through storage.download from what encode uploaded.
       const [decoded] = await codec.decode([encoded]);
       expect(Buffer.from(decoded.data!)).toEqual(original.data);
-
-      vi.unstubAllGlobals();
     });
 
     it("retrieves uncompressed payloads correctly", async () => {
@@ -184,24 +161,11 @@ describe("ClaimcheckPayloadCodec", () => {
       const original = makeLargePayload(1500);
       const [encoded] = await codec.encode([original]);
 
-      const marker = JSON.parse(Buffer.from(encoded.data!).toString());
-      const storedData = storage.uploads.get(marker.key)!;
-
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
-        ok: true,
-        arrayBuffer: () => Promise.resolve(storedData.buffer.slice(
-          storedData.byteOffset,
-          storedData.byteOffset + storedData.byteLength,
-        )),
-      }));
-
       const [decoded] = await codec.decode([encoded]);
       expect(Buffer.from(decoded.data!)).toEqual(original.data);
-
-      vi.unstubAllGlobals();
     });
 
-    it("throws on download failure", async () => {
+    it("wraps a download failure with the claimcheck error contract", async () => {
       const encoded: Payload = {
         metadata: { encoding: Buffer.from("binary/claimcheck") },
         data: Buffer.from(JSON.stringify({
@@ -211,16 +175,15 @@ describe("ClaimcheckPayloadCodec", () => {
         })),
       };
 
-      vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
-        ok: false,
-        status: 404,
-      }));
+      // Drive the failure through the port; the proxy download surfaces the HTTP
+      // status, which the codec must preserve in its wrapped, key-scoped message.
+      storage.download.mockRejectedValueOnce(
+        new Error("Artifact download failed (HTTP 404) for key 'claimcheck/missing'"),
+      );
 
       await expect(codec.decode([encoded])).rejects.toThrow(
-        /Claimcheck retrieve failed.*HTTP 404/,
+        /Claimcheck retrieve failed for key claimcheck\/missing.*HTTP 404/,
       );
-
-      vi.unstubAllGlobals();
     });
   });
 

package/src/__tests__/golden-e2e.test.ts

@@ -78,6 +78,8 @@ function createMockActivities() {
     RunShell: async (): Promise<unknown> => "hello from shell",
     UpdateWorkflowTaskApprovalStatus: async (): Promise<void> => {},
     ClearWorkflowApprovalStatus: async (): Promise<void> => {},
+    UpdateWorkflowFileReviewStatus: async (): Promise<void> => {},
+    GetAwaitingFileReviewChangeSetIds: async (): Promise<string[]> => [],
   };
 }
 

package/src/__tests__/runner-token-coordinator.test.ts

@@ -92,7 +92,7 @@ describe("createRunnerTokenCoordinator", () => {
     it("re-mints from the control-plane token before expiry and reschedules", async () => {
       const applyProxyToken = vi.fn();
       const reMint = vi
-        .fn<[], Promise<RefreshedRunnerToken | undefined>>()
+        .fn<() => Promise<RefreshedRunnerToken | undefined>>()
         .mockResolvedValueOnce({ token: "rt_v2", expiresInSeconds: 100 })
         .mockResolvedValueOnce({ token: "rt_v3", expiresInSeconds: 100 });
 
@@ -121,7 +121,7 @@ describe("createRunnerTokenCoordinator", () => {
     it("retries (without clobbering) when a re-mint fails, then recovers", async () => {
       const applyProxyToken = vi.fn();
       const reMint = vi
-        .fn<[], Promise<RefreshedRunnerToken | undefined>>()
+        .fn<() => Promise<RefreshedRunnerToken | undefined>>()
         .mockResolvedValueOnce(undefined) // first refresh fails to mint
         .mockResolvedValueOnce({ token: "rt_recovered", expiresInSeconds: 100 });
 
@@ -149,7 +149,7 @@ describe("createRunnerTokenCoordinator", () => {
     });
 
     it("stop() cancels the refresh timer", async () => {
-      const reMint = vi.fn<[], Promise<RefreshedRunnerToken | undefined>>();
+      const reMint = vi.fn<() => Promise<RefreshedRunnerToken | undefined>>();
       const coordinator = createRunnerTokenCoordinator({
         applyProxyToken: vi.fn(),
         reMint,

package/src/activities/__tests__/call-agent-status.test.ts

@@ -0,0 +1,135 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { FileChangeSetStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/**
+ * Unit tests for the call-agent-status activities that surface a child agent's
+ * HITL state on the parent workflow. They verify the runner sends the correct
+ * per-child SCOPED writes; the actual per-child merge (never clobbering a
+ * sibling) is enforced and tested in the Go + Java backend handlers.
+ */
+
+interface CapturedUpdate {
+  executionId: string;
+  status: any;
+  options: any;
+}
+
+let capturedUpdates: CapturedUpdate[];
+let mockGetExecutionResult: any;
+
+vi.mock("../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(() => ({
+    updateWorkflowExecutionStatus: (executionId: string, status: any, options: any) => {
+      capturedUpdates.push({ executionId, status, options });
+      return Promise.resolve({});
+    },
+    getExecution: (_id: string) => Promise.resolve(mockGetExecutionResult),
+  })),
+}));
+
+vi.mock("../../config.js", () => ({
+  loadConfig: () => ({ stigmerBackendEndpoint: "http://localhost:7234", stigmerToken: "t" }),
+}));
+
+import {
+  updateWorkflowFileReviewStatus,
+  getAwaitingFileReviewChangeSetIds,
+  updateWorkflowTaskApprovalStatus,
+  clearWorkflowApprovalStatus,
+} from "../call-agent-status.js";
+
+describe("call-agent-status file-review activities", () => {
+  beforeEach(() => {
+    capturedUpdates = [];
+    mockGetExecutionResult = undefined;
+  });
+
+  describe("updateWorkflowFileReviewStatus", () => {
+    it("writes a single per-child reference scoped to the child", async () => {
+      await updateWorkflowFileReviewStatus("wfx_1", "aex_child", ["fcs_1", "fcs_2"]);
+
+      expect(capturedUpdates).toHaveLength(1);
+      const { executionId, status, options } = capturedUpdates[0];
+      expect(executionId).toBe("wfx_1");
+      expect(options.updatePendingFileReviews).toBe(true);
+      expect(options.pendingUpdateChildAgentExecutionId).toBe("aex_child");
+      expect(status.pendingFileReviews).toHaveLength(1);
+      expect(status.pendingFileReviews[0].childAgentExecutionId).toBe("aex_child");
+      expect(status.pendingFileReviews[0].changeSetId).toEqual(["fcs_1", "fcs_2"]);
+    });
+
+    it("empty changeSetIds writes an empty list (scoped clear for the child)", async () => {
+      await updateWorkflowFileReviewStatus("wfx_1", "aex_child", []);
+
+      expect(capturedUpdates).toHaveLength(1);
+      const { status, options } = capturedUpdates[0];
+      expect(options.updatePendingFileReviews).toBe(true);
+      expect(options.pendingUpdateChildAgentExecutionId).toBe("aex_child");
+      expect(status.pendingFileReviews).toHaveLength(0);
+    });
+
+    it("is a no-op when executionId or childExecutionId is missing", async () => {
+      await updateWorkflowFileReviewStatus("", "aex_child", ["fcs_1"]);
+      await updateWorkflowFileReviewStatus("wfx_1", "", ["fcs_1"]);
+      expect(capturedUpdates).toHaveLength(0);
+    });
+  });
+
+  describe("getAwaitingFileReviewChangeSetIds", () => {
+    it("returns only the ids of change sets that are AWAITING_REVIEW", async () => {
+      mockGetExecutionResult = {
+        status: {
+          fileChangeSets: [
+            { id: "fcs_await1", status: FileChangeSetStatus.AWAITING_REVIEW },
+            { id: "fcs_capturing", status: FileChangeSetStatus.CAPTURING },
+            { id: "fcs_decided", status: FileChangeSetStatus.DECIDED },
+            { id: "fcs_await2", status: FileChangeSetStatus.AWAITING_REVIEW },
+          ],
+        },
+      };
+
+      const ids = await getAwaitingFileReviewChangeSetIds("aex_child");
+      expect(ids).toEqual(["fcs_await1", "fcs_await2"]);
+    });
+
+    it("returns empty when the child has no file change sets", async () => {
+      mockGetExecutionResult = { status: {} };
+      expect(await getAwaitingFileReviewChangeSetIds("aex_child")).toEqual([]);
+    });
+
+    it("returns empty (non-fatal) on a missing child id", async () => {
+      expect(await getAwaitingFileReviewChangeSetIds("")).toEqual([]);
+      expect(capturedUpdates).toHaveLength(0);
+    });
+  });
+
+  describe("approval activities are scoped per-child (unify)", () => {
+    it("updateWorkflowTaskApprovalStatus scopes the write to the notifying child", async () => {
+      await updateWorkflowTaskApprovalStatus("wfx_1", "task_a", {
+        executionId: "aex_child",
+        pendingApprovals: [{ toolCallId: "tc_1", toolName: "deploy" } as any],
+      } as any);
+
+      expect(capturedUpdates).toHaveLength(1);
+      const { status, options } = capturedUpdates[0];
+      expect(options.updatePendingApprovals).toBe(true);
+      expect(options.pendingUpdateChildAgentExecutionId).toBe("aex_child");
+      expect(status.pendingApprovals[0].childAgentExecutionId).toBe("aex_child");
+    });
+
+    it("clearWorkflowApprovalStatus scopes the clear to the given child", async () => {
+      await clearWorkflowApprovalStatus("wfx_1", "aex_child");
+
+      expect(capturedUpdates).toHaveLength(1);
+      const { status, options } = capturedUpdates[0];
+      expect(options.updatePendingApprovals).toBe(true);
+      expect(options.pendingUpdateChildAgentExecutionId).toBe("aex_child");
+      expect(status.pendingApprovals).toHaveLength(0);
+    });
+
+    it("clearWorkflowApprovalStatus is a no-op without a child id", async () => {
+      await clearWorkflowApprovalStatus("wfx_1", "");
+      expect(capturedUpdates).toHaveLength(0);
+    });
+  });
+});

package/src/activities/__tests__/call-llm.test.ts

@@ -32,7 +32,7 @@ describe("callLlmAction", () => {
 
   // The LangChain provider SDKs pass a `Headers` instance (not a plain object)
   // to fetch, so read header values case-insensitively via the Headers API.
-  function getHeader(options: { headers?: HeadersInit }, name: string): string | null {
+  function getHeader(options: { headers?: ConstructorParameters<typeof Headers>[0] }, name: string): string | null {
     return new Headers(options.headers).get(name);
   }
 

package/src/activities/__tests__/classify-tool-approvals.test.ts

@@ -8,6 +8,9 @@ vi.mock("../../idle-watchdog.js", () => ({
 
 vi.mock("../../shared/model-registry.js", () => ({
   getSummarizationModel: vi.fn().mockResolvedValue("gpt-4o-mini"),
+  // buildChatModel resolves registry ids; identity keeps the economy model name
+  // intact so provider inference drives client selection in these tests.
+  resolveToApiModelId: vi.fn((m: string) => Promise.resolve(m)),
 }));
 
 const mockInvoke = vi.fn();
@@ -20,6 +23,14 @@ vi.mock("@langchain/openai", () => ({
   })),
 }));
 
+vi.mock("@langchain/anthropic", () => ({
+  ChatAnthropic: vi.fn().mockImplementation(() => ({
+    withStructuredOutput: vi.fn().mockReturnValue({
+      invoke: mockInvoke,
+    }),
+  })),
+}));
+
 vi.mock("@langchain/core/messages", () => ({
   SystemMessage: vi.fn().mockImplementation((content: string) => ({ content, role: "system" })),
   HumanMessage: vi.fn().mockImplementation((content: string) => ({ content, role: "human" })),
@@ -223,6 +234,106 @@ describe("ClassifyToolApprovals activity", () => {
     });
   });
 
+  describe("reconcileBatchClassifications — fail closed on partial output", () => {
+    it("fails closed for a tool the model omitted from its output", async () => {
+      const { reconcileBatchClassifications } = await import("../classify-tool-approvals.js");
+
+      const batch: ToolDescriptor[] = [
+        { name: "delete_file", description: "Delete a file" },
+        { name: "send_email", description: "Send an email" },
+      ];
+      // Model only classified one of the two tools.
+      const llmResults = [
+        { tool_name: "delete_file", requires_approval: true, message: "Delete {{args.path}}" },
+      ];
+
+      const { reconciled, failedClosedCount } = reconcileBatchClassifications(batch, llmResults);
+
+      expect(failedClosedCount).toBe(1);
+      expect(reconciled).toEqual([
+        { tool_name: "delete_file", requires_approval: true, message: "Delete {{args.path}}" },
+        { tool_name: "send_email", requires_approval: true, message: "Execute send_email" },
+      ]);
+    });
+
+    it("keeps full classifications unchanged when every tool is present", async () => {
+      const { reconcileBatchClassifications } = await import("../classify-tool-approvals.js");
+
+      const batch: ToolDescriptor[] = [
+        { name: "search_code", description: "Search" },
+        { name: "delete_file", description: "Delete" },
+      ];
+      const llmResults = [
+        { tool_name: "search_code", requires_approval: false, message: "" },
+        { tool_name: "delete_file", requires_approval: true, message: "Delete {{args.path}}" },
+      ];
+
+      const { reconciled, failedClosedCount } = reconcileBatchClassifications(batch, llmResults);
+
+      expect(failedClosedCount).toBe(0);
+      expect(reconciled).toEqual(llmResults);
+    });
+
+    it("drops hallucinated output names that were never in the batch", async () => {
+      const { reconcileBatchClassifications } = await import("../classify-tool-approvals.js");
+
+      const batch: ToolDescriptor[] = [{ name: "real_tool", description: "Real" }];
+      const llmResults = [
+        { tool_name: "real_tool", requires_approval: false, message: "" },
+        { tool_name: "ghost_tool", requires_approval: false, message: "" },
+      ];
+
+      const { reconciled } = reconcileBatchClassifications(batch, llmResults);
+
+      expect(reconciled).toHaveLength(1);
+      expect(reconciled[0].tool_name).toBe("real_tool");
+    });
+
+    it("fails closed for the entire batch when the model returns nothing", async () => {
+      const { reconcileBatchClassifications } = await import("../classify-tool-approvals.js");
+
+      const batch: ToolDescriptor[] = [
+        { name: "tool_a", description: "" },
+        { name: "tool_b", description: "" },
+      ];
+
+      const { reconciled, failedClosedCount } = reconcileBatchClassifications(batch, []);
+
+      expect(failedClosedCount).toBe(2);
+      expect(reconciled.every((r) => r.requires_approval)).toBe(true);
+    });
+
+    it("end-to-end: an omitted mutating tool is gated, not silently dropped", async () => {
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      // The model omits `wire_transfer` entirely — only classifies the read tool.
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [
+          { tool_name: "get_balance", requires_approval: false, message: "" },
+        ],
+      });
+
+      const result = await classifyTools(
+        {
+          tools: [
+            { name: "get_balance", description: "Get account balance" },
+            { name: "wire_transfer", description: "Transfer money" },
+          ],
+          serverName: "bank",
+          serverDescription: "",
+          mcpServerId: null,
+        },
+        makeOptions(),
+      );
+
+      // get_balance auto-approved by the classifier; wire_transfer (omitted)
+      // fails closed via reconciliation.
+      expect(result).toHaveLength(1);
+      expect(result[0].tool_name).toBe("wire_transfer");
+      expect(result[0].requires_approval).toBe(true);
+    });
+  });
+
   describe("buildToolsPayload", () => {
     it("formats tools as compact JSON with parameter names only", async () => {
       const { buildToolsPayload } = await import("../classify-tool-approvals.js");
@@ -280,7 +391,7 @@ describe("ClassifyToolApprovals activity", () => {
   });
 
   describe("fallbackApprovals", () => {
-    it("marks all tools as requiring approval with default message", async () => {
+    it("marks ambiguous tools as requiring approval with default message", async () => {
       const { fallbackApprovals } = await import("../classify-tool-approvals.js");
 
       const tools: ToolDescriptor[] = [
@@ -295,6 +406,79 @@ describe("ClassifyToolApprovals activity", () => {
         { tool_name: "tool_b", requires_approval: true, message: "Execute tool_b" },
       ]);
     });
+
+    it("fails closed for every tool, including read-only-looking names", async () => {
+      const { fallbackApprovals } = await import("../classify-tool-approvals.js");
+
+      // Full fail-closed: with no trusted classification, even a `get_*` name is
+      // gated. A name is an untrusted signal and must not relax a gate on outage.
+      const result = fallbackApprovals([
+        { name: "get_app_state", description: "" },
+        { name: "delete_file", description: "" },
+      ]);
+
+      expect(result).toEqual([
+        { tool_name: "get_app_state", requires_approval: true, message: "Execute get_app_state" },
+        { tool_name: "delete_file", requires_approval: true, message: "Execute delete_file" },
+      ]);
+    });
+  });
+
+  describe("read-only authority is the LLM classifier alone (no name relax)", () => {
+    it("keeps a classifier-gated tool gated even if its name leads with a read verb", async () => {
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      // The classic hole: `get_and_delete_stale_records` leads with `get` but
+      // deletes. The old name heuristic auto-approved it; now the trusted LLM
+      // decision (gate it) must stand.
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [
+          { tool_name: "get_and_delete_stale_records", requires_approval: true, message: "Delete stale records" },
+        ],
+      });
+
+      const result = await classifyTools(
+        {
+          tools: [{ name: "get_and_delete_stale_records", description: "Reads then deletes stale rows" }],
+          serverName: "db",
+          serverDescription: "",
+          mcpServerId: null,
+        },
+        makeOptions(),
+      );
+
+      expect(result).toHaveLength(1);
+      expect(result[0].tool_name).toBe("get_and_delete_stale_records");
+      expect(result[0].requires_approval).toBe(true);
+    });
+
+    it("respects the classifier auto-approving a genuine read-only tool", async () => {
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [
+          { tool_name: "get_app_state", requires_approval: false, message: "" },
+          { tool_name: "click", requires_approval: true, message: "Click {{args.element}}" },
+        ],
+      });
+
+      const result = await classifyTools(
+        {
+          tools: [
+            { name: "get_app_state", description: "Reads UI state" },
+            { name: "click", description: "Clicks an element" },
+          ],
+          serverName: "open-computer-use",
+          serverDescription: "",
+          mcpServerId: null,
+        },
+        makeOptions(),
+      );
+
+      // Only what the classifier gated remains; the read tool it cleared is gone.
+      expect(result).toHaveLength(1);
+      expect(result[0].tool_name).toBe("click");
+    });
   });
 
   describe("idle watchdog integration", () => {
@@ -345,6 +529,29 @@ describe("ClassifyToolApprovals activity", () => {
     });
   });
 
+  describe("provider routing", () => {
+    it("routes Anthropic economy models to ChatAnthropic, not the OpenAI path", async () => {
+      const { ChatAnthropic } = await import("@langchain/anthropic");
+      const { ChatOpenAI } = await import("@langchain/openai");
+      const { getSummarizationModel } = await import("../../shared/model-registry.js");
+      vi.mocked(getSummarizationModel).mockResolvedValueOnce("claude-haiku-4.5");
+
+      const { classifyTools } = await import("../classify-tool-approvals.js");
+
+      mockInvoke.mockResolvedValueOnce({
+        approvals: [{ tool_name: "t", requires_approval: false, message: "" }],
+      });
+
+      await classifyTools(
+        { tools: [{ name: "t", description: "d" }], serverName: "s", serverDescription: "", mcpServerId: null },
+        { proxyEndpoint: "http://proxy:8080", stigmerToken: "tok", primaryModel: "claude-opus-4" },
+      );
+
+      expect(ChatAnthropic).toHaveBeenCalledTimes(1);
+      expect(ChatOpenAI).not.toHaveBeenCalled();
+    });
+  });
+
   describe("proxy headers", () => {
     it("passes X-Stigmer-Mcp-Server-Id when mcpServerId is provided", async () => {
       const { ChatOpenAI } = await import("@langchain/openai");