@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/src/activities/execute-cursor/__tests__/deny-gate-exact-apply.test.ts

@@ -0,0 +1,203 @@
+/**
+ * @regression file-hitl-phase0 — pins the no-storage deny-gate exact-apply seam
+ * (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ *
+ * Deterministic integration proof of the Cursor deny-gate "what you approve is
+ * what gets applied" guarantee, driven through the REAL composition and the REAL
+ * deny-oracle hook — the achievable substitute for a pure-Go offline e2e, which
+ * is structurally infeasible (no offline Cursor agent driver; see DD-23).
+ *
+ * It replays the exact chain (and ORDER) `execute-cursor/index.ts` runs on a
+ * deny-gate resume, against a REAL {@link LocalWorkspaceBackend} on a temp
+ * non-git workspace with NO artifact storage (the `!captureMode` branch):
+ *
+ *   reconstructAdjudicatedApprovals  (Phase 3, before apply)
+ *     -> applyApprovedWholeFileWrites (Phase 5b3, flips applied calls COMPLETED)
+ *     -> excludeAppliedFromGrants     (Phase 5c)
+ *     -> buildApprovalGrants          (Phase 5c)
+ *     -> the generated bash hook       (the pre-write deny-oracle)
+ *
+ * The order is load-bearing: `reconstructAdjudicatedApprovals` filters on
+ * WAITING_APPROVAL and index.ts computes the adjudicated set ONCE (before apply
+ * flips status) and never re-derives it, so `excludeAppliedFromGrants` is the
+ * only thing that keeps an exact-applied write out of the grants. Seeded tool
+ * calls therefore carry BOTH `args` (structured — exact-apply's whole-file
+ * source) AND `argsPreview` (grant-identity source).
+ *
+ * The reinvocation prompt split (an applied write rendered "already applied") is
+ * covered separately in build-prompt.test.ts and is NOT re-asserted here.
+ *
+ * Deterministic; no Cursor API key. The hook cases are skipped where bash is
+ * unavailable.
+ */
+
+import { describe, it, expect, onTestFinished } from "vitest";
+import { create, type JsonObject } from "@bufbuild/protobuf";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type {
+  AgentMessage,
+  ToolCall,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  MessageType,
+  ToolCallStatus,
+  ApprovalAction,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { applyApprovedWholeFileWrites, excludeAppliedFromGrants } from "../exact-apply.js";
+import { reconstructAdjudicatedApprovals, buildApprovalGrants } from "../approval-state.js";
+import type { ApprovalGrant } from "../approval-state.js";
+import { LocalWorkspaceBackend } from "../../../shared/workspace/local-backend.js";
+import {
+  setupCursorHookHarness,
+  hasBash,
+  hookWrite,
+  hookShell,
+} from "../__test-utils__/cursor-hook-harness.js";
+
+const EXEC_ID = "exec-deny-gate";
+
+// `deriveCaptureMode` (the decision that arms this deny-gate/exact-apply path) is
+// truth-table-tested at its shared home: shared/filereview/__tests__/capture.test.ts.
+
+// ── builders ─────────────────────────────────────────────────────────────────
+
+/** A fresh temp workspace root (real disk), auto-removed at test end. */
+function tempWorkspace(): string {
+  const dir = mkdtempSync(join(tmpdir(), "deny-gate-exact-apply-"));
+  onTestFinished(() => rmSync(dir, { recursive: true, force: true }));
+  return dir;
+}
+
+/**
+ * A WAITING_APPROVAL tool call carrying BOTH the structured `args` (exact-apply
+ * reads the whole-file content here) AND `argsPreview` (reconstructAdjudicated-
+ * Approvals + buildApprovalGrants read grant identity here) — the fixture shape
+ * index.ts sees on a deny-gate resume.
+ */
+function adjudicatedCall(
+  id: string,
+  name: string,
+  args: Record<string, unknown>,
+  approvalAction: ApprovalAction,
+): ToolCall {
+  return create(ToolCallSchema, {
+    id,
+    name,
+    status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+    approvalAction,
+    args: args as JsonObject,
+    argsPreview: JSON.stringify(args),
+  });
+}
+
+function messagesOf(...toolCalls: ToolCall[]): AgentMessage[] {
+  return [create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls })];
+}
+
+/**
+ * Replay the deny-gate resume chain in the SAME ORDER index.ts runs it (see the
+ * module docstring). Returns every intermediate so a test can assert on the exact
+ * seam the activity wires.
+ */
+async function replayDenyGateResume(root: string, messages: AgentMessage[]): Promise<{
+  applied: ReadonlySet<string>;
+  grantApprovals: ReturnType<typeof reconstructAdjudicatedApprovals>["pendingApprovals"];
+  grants: ApprovalGrant[];
+}> {
+  const adjudicated = reconstructAdjudicatedApprovals(messages); // Phase 3 (pre-apply)
+  const applied = await applyApprovedWholeFileWrites({
+    messages,
+    workspaceBackend: new LocalWorkspaceBackend(root),
+    workspaceDirs: [root],
+    executionId: EXEC_ID,
+  }); // Phase 5b3 (mutates applied calls to COMPLETED)
+  const grantApprovals = excludeAppliedFromGrants(adjudicated.pendingApprovals, applied); // Phase 5c
+  const grants = buildApprovalGrants(grantApprovals, adjudicated.decisions, adjudicated.contentDigests);
+  return { applied, grantApprovals, grants };
+}
+
+// ── the seam (no hook / bash needed) ─────────────────────────────────────────
+
+describe("deny-gate exact-apply seam (real LocalWorkspaceBackend, storage off)", () => {
+  it("approve: writes the EXACT bytes to a root-level path, marks the tool COMPLETED, and issues NO grant for it", async () => {
+    const root = tempWorkspace();
+    const path = "notes.md";
+    const content = "# Notes\n- Planton\n";
+    const write = adjudicatedCall("tc-write", "write", { file_path: path, content }, ApprovalAction.APPROVE);
+
+    const { applied, grantApprovals, grants } = await replayDenyGateResume(root, messagesOf(write));
+
+    // The runner applied exactly the approved bytes to real disk...
+    expect(applied).toEqual(new Set(["tc-write"]));
+    expect(readFileSync(join(root, path), "utf-8")).toBe(content);
+    expect(write.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    // ...and excluded it from the grants, so a further write to it will re-gate.
+    expect(grantApprovals.map((pa) => pa.toolCallId)).not.toContain("tc-write");
+    expect(grants).toHaveLength(0);
+  });
+
+  it("reject / undecided: applies nothing and grants nothing", async () => {
+    const root = tempWorkspace();
+    const rejected = adjudicatedCall("tc-rej", "write", { file_path: "drop.txt", content: "x" }, ApprovalAction.REJECT);
+    const undecided = adjudicatedCall("tc-und", "write", { file_path: "maybe.txt", content: "y" }, ApprovalAction.UNSPECIFIED);
+
+    const { applied, grants } = await replayDenyGateResume(root, messagesOf(rejected, undecided));
+
+    expect(applied.size).toBe(0);
+    expect(existsSync(join(root, "drop.txt"))).toBe(false);
+    expect(existsSync(join(root, "maybe.txt"))).toBe(false);
+    // A REJECT is never granted; an UNSPECIFIED never even enters the adjudicated set.
+    expect(grants).toHaveLength(0);
+  });
+
+  it("safety: an approved write to a not-yet-existing subdirectory falls back (no mkdir, no partial write)", async () => {
+    // LocalWorkspaceBackend created without a platformDir does not mkdir parents,
+    // so exact-apply's write throws ENOENT and degrades to the grant+reinvocation
+    // path — never a partial/corrupt file. This documents that pre-existing, safe
+    // behavior (see the plan's out-of-scope note).
+    const root = tempWorkspace();
+    const nested = adjudicatedCall("tc-nested", "write", { file_path: "sub/nested.txt", content: "z" }, ApprovalAction.APPROVE);
+
+    const { applied } = await replayDenyGateResume(root, messagesOf(nested));
+
+    expect(applied.size).toBe(0);
+    expect(existsSync(join(root, "sub"))).toBe(false);
+    expect(existsSync(join(root, "sub", "nested.txt"))).toBe(false);
+    // Left for the existing grant + reinvocation path.
+    expect(nested.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+});
+
+// ── the full loop through the REAL deny-oracle hook (needs bash) ──────────────
+
+const withBash = hasBash ? describe : describe.skip;
+
+withBash("deny-gate exact-apply seam through the real hook", () => {
+  it("re-gates a further write to the exact-applied path (DENY) while a co-approved shell still flows (ALLOW)", async () => {
+    const root = tempWorkspace();
+    const appliedPath = "app.ts";
+    const write = adjudicatedCall("tc-write", "write", { file_path: appliedPath, content: "export const x = 1;\n" }, ApprovalAction.APPROVE);
+    const shell = adjudicatedCall("tc-shell", "shell", { command: "npm test" }, ApprovalAction.APPROVE);
+
+    const { applied, grants } = await replayDenyGateResume(root, messagesOf(write, shell));
+
+    // The write was exact-applied and excluded; the shell (never applied) kept its grant.
+    expect(applied).toEqual(new Set(["tc-write"]));
+    expect(grants.map((g) => g.toolName)).toEqual(["shell"]);
+
+    // Drive the REAL generated hook (non-git, capture off) with exactly those grants.
+    const hook = setupCursorHookHarness({ grants, gitWorkspace: false, captureMode: false });
+
+    // A further write to the exact-applied path has no grant at all -> re-gated.
+    expect(hook.decide(hookWrite(appliedPath)).permission).toBe("deny");
+    // The co-approved shell is allowed by its (coarse) grant.
+    expect(hook.decide(hookShell("npm test")).permission).toBe("allow");
+  });
+});

package/src/activities/execute-cursor/__tests__/exact-apply.test.ts

@@ -0,0 +1,375 @@
+/**
+ * @regression file-hitl-phase0 — pins file-edit HITL fix #4 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ *
+ * Unit tests for resume-time exact-apply (the HITL "what you approve is what gets
+ * applied" guarantee for the Cursor deny-only harness).
+ *
+ * Since Phase 5 Slice 4 the approved bytes and target path are read from the
+ * gated tool call's `args` (the single source — there is no separate captured
+ * `file_changes` mirror). These pin the load-bearing invariants:
+ * - an APPROVED whole-file write is written to disk with the EXACT approved bytes
+ *   (args content) and its tool call is marked COMPLETED in place;
+ * - the content resolver NEVER writes the elision marker (which would silently
+ *   corrupt the file) — it degrades to a fall back (no write);
+ * - everything that is not an approved whole-file write (hunk edits, shell, MCP,
+ *   skipped/rejected, already-completed) is left untouched for the existing
+ *   grant + reinvocation path;
+ * - the apply targets the args path resolved under the workspace (multi-root) and
+ *   refuses a target outside the workspace;
+ * - the step is idempotent under Temporal activity retries.
+ *
+ * Deterministic; no Cursor API key.
+ */
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { create, type JsonObject, type MessageInitShape } from "@bufbuild/protobuf";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type {
+  AgentMessage,
+  ToolCall,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  MessageType,
+  ToolCallStatus,
+  ApprovalAction,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+import { PendingApprovalSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+import type { PendingApproval } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/approval_pb";
+
+import {
+  applyApprovedWholeFileWrites,
+  excludeAppliedFromGrants,
+  resolveApprovedWholeFileContent,
+} from "../exact-apply.js";
+import { ELISION_MARKER } from "../../../shared/status-offload.js";
+import { mockWorkspaceBackend } from "../../../__test-utils__/mock-workspace.js";
+import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
+
+const ROOT = "/root";
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+// ── builders ─────────────────────────────────────────────────────────────────
+
+/** An approved, still-pending whole-file write whose args carry path + content. */
+function approvedWrite(
+  args: Record<string, unknown>,
+  overrides: MessageInitShape<typeof ToolCallSchema> = {},
+): ToolCall {
+  return create(ToolCallSchema, {
+    id: "tc-1",
+    name: "write",
+    status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+    approvalAction: ApprovalAction.APPROVE,
+    args: args as JsonObject,
+    ...overrides,
+  });
+}
+
+function messagesOf(...toolCalls: ToolCall[]): AgentMessage[] {
+  return [create(AgentMessageSchema, { type: MessageType.MESSAGE_AI, toolCalls })];
+}
+
+function recordingBackend(): { backend: WorkspaceBackend; writes: Array<{ path: string; content: string }> } {
+  const writes: Array<{ path: string; content: string }> = [];
+  const backend = mockWorkspaceBackend({
+    rootDir: ROOT,
+    writeFile: vi.fn(async (path: string, content: string) => {
+      writes.push({ path, content });
+    }),
+  });
+  return { backend, writes };
+}
+
+const baseOpts = {
+  workspaceDirs: [ROOT],
+  executionId: "exec-test",
+};
+
+// ── applyApprovedWholeFileWrites ─────────────────────────────────────────────
+
+describe("applyApprovedWholeFileWrites", () => {
+  it("writes the EXACT approved bytes to the resolved path and marks the tool COMPLETED", async () => {
+    const tc = approvedWrite({ path: "notes.md", contents: "# Notes\n- Planton\n" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["tc-1"]));
+    expect(writes).toEqual([{ path: `${ROOT}/notes.md`, content: "# Notes\n- Planton\n" }]);
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tc.completedAt).not.toBe("");
+  });
+
+  it("applies the COMPLETE args content verbatim (full-change fidelity regression)", async () => {
+    // The gate's args carry the COMPLETE proposed content (stamped from the
+    // authoritative hook input via applyGateInput), so exact-apply must land ALL
+    // of it — never a partial. This locks that what exact-apply writes equals the
+    // approved args content, whatever it contains.
+    const complete = "# Notes\n- Planton\n\n## TODO\n- first\n- second\n";
+    const tc = approvedWrite({ path: "notes.md", contents: complete });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["tc-1"]));
+    expect(writes).toEqual([{ path: `${ROOT}/notes.md`, content: complete }]);
+    expect(writes[0].content).toContain("## TODO");
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+  });
+
+  it("SAFETY: never writes the elision marker (falls back instead)", async () => {
+    // The args content was elided to the marker by the size backstop.
+    const tc = approvedWrite({ path: "notes.md", contents: ELISION_MARKER });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+
+  it("preserves an empty-string write (a legitimately emptied / new empty file)", async () => {
+    const tc = approvedWrite({ path: "empty.txt", contents: "" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["tc-1"]));
+    expect(writes).toEqual([{ path: `${ROOT}/empty.txt`, content: "" }]);
+  });
+
+  it("targets a file in a NON-primary workspace root (multi-root)", async () => {
+    const otherRoot = "/other";
+    const tc = approvedWrite({ path: `${otherRoot}/pkg/x.ts`, contents: "b" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      workspaceDirs: [ROOT, otherRoot],
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["tc-1"]));
+    expect(writes[0].path).toBe(`${otherRoot}/pkg/x.ts`);
+  });
+
+  it("refuses a target OUTSIDE every workspace root (falls back, no write)", async () => {
+    const tc = approvedWrite({ path: "/etc/passwd", contents: "pwned" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+  });
+
+  it("is idempotent: an already-COMPLETED call is skipped, never written twice", async () => {
+    const tc = approvedWrite(
+      { path: "notes.md", contents: "done\n" },
+      { status: ToolCallStatus.TOOL_CALL_COMPLETED },
+    );
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+  });
+
+  it("falls back when the workspace write fails (never silently drops)", async () => {
+    const tc = approvedWrite({ path: "notes.md", contents: "x" });
+    const backend = mockWorkspaceBackend({
+      rootDir: ROOT,
+      writeFile: vi.fn(async () => {
+        throw new Error("EACCES");
+      }),
+    });
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+
+  it("applies an APPROVE_ALL whole-file write too", async () => {
+    const tc = approvedWrite(
+      { path: "notes.md", contents: "v2\n" },
+      { approvalAction: ApprovalAction.APPROVE_ALL },
+    );
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["tc-1"]));
+    expect(writes).toHaveLength(1);
+  });
+
+  it("leaves a hunk edit untouched (old_string/new_string stays on the reinvocation path)", async () => {
+    const tc = approvedWrite({ path: "notes.md", old_string: "a", new_string: "b" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+
+  it("leaves a SKIPPED / REJECTED / undecided whole-file write untouched", async () => {
+    const skipped = approvedWrite({ path: "a.md", contents: "x" }, { id: "s", approvalAction: ApprovalAction.SKIP });
+    const rejected = approvedWrite({ path: "b.md", contents: "x" }, { id: "r", approvalAction: ApprovalAction.REJECT });
+    const undecided = approvedWrite({ path: "c.md", contents: "x" }, { id: "u", approvalAction: ApprovalAction.UNSPECIFIED });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(skipped, rejected, undecided),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+  });
+
+  it("leaves a non-file approved tool (shell) untouched", async () => {
+    const tc = approvedWrite({ command: "ls" }, { id: "sh", name: "shell" });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(tc),
+      workspaceBackend: backend,
+    });
+
+    expect(applied.size).toBe(0);
+    expect(writes).toHaveLength(0);
+  });
+
+  it("applies only the approved write among a mixed batch, returning just its id", async () => {
+    const write = approvedWrite({ path: "notes.md", contents: "new\n" }, { id: "w" });
+    const shell = approvedWrite({ command: "ls" }, { id: "sh", name: "shell" });
+    const skipped = approvedWrite({ path: "b.md", contents: "x" }, { id: "s", approvalAction: ApprovalAction.SKIP });
+    const { backend, writes } = recordingBackend();
+
+    const applied = await applyApprovedWholeFileWrites({
+      ...baseOpts,
+      messages: messagesOf(write, shell, skipped),
+      workspaceBackend: backend,
+    });
+
+    expect(applied).toEqual(new Set(["w"]));
+    expect(writes).toEqual([{ path: `${ROOT}/notes.md`, content: "new\n" }]);
+  });
+});
+
+// ── excludeAppliedFromGrants ─────────────────────────────────────────────────
+
+describe("excludeAppliedFromGrants", () => {
+  function pendingApproval(toolCallId: string, toolName = "write"): PendingApproval {
+    return create(PendingApprovalSchema, { toolCallId, toolName });
+  }
+
+  it("removes an exact-applied write so it is never re-granted (a further write re-gates)", () => {
+    const approvals = [pendingApproval("w1", "write"), pendingApproval("sh", "shell")];
+    const result = excludeAppliedFromGrants(approvals, new Set(["w1"]));
+    expect(result.map((p) => p.toolCallId)).toEqual(["sh"]);
+  });
+
+  it("is an identity passthrough when nothing was applied (fresh turn / capture mode)", () => {
+    const approvals = [pendingApproval("w1", "write"), pendingApproval("e1", "edit"), pendingApproval("sh", "shell")];
+    expect(excludeAppliedFromGrants(approvals, new Set())).toEqual(approvals);
+  });
+
+  it("retains non-applied approvals (a hunk edit, a shell) beside the removed applied write", () => {
+    // Exact-apply only applies whole-file writes; a hunk edit and shell are never
+    // applied, so they must keep flowing to the grant builder.
+    const approvals = [pendingApproval("w1", "write"), pendingApproval("e1", "edit"), pendingApproval("sh", "shell")];
+    const result = excludeAppliedFromGrants(approvals, new Set(["w1"]));
+    expect(result.map((p) => p.toolCallId)).toEqual(["e1", "sh"]);
+  });
+
+  it("removes only the applied ids from a mixed batch (order preserved)", () => {
+    const approvals = ["a", "b", "c", "d"].map((id) => pendingApproval(id));
+    const result = excludeAppliedFromGrants(approvals, new Set(["b", "d"]));
+    expect(result.map((p) => p.toolCallId)).toEqual(["a", "c"]);
+  });
+
+  it("returns empty for no approvals", () => {
+    expect(excludeAppliedFromGrants([], new Set(["x"]))).toEqual([]);
+  });
+});
+
+// ── resolveApprovedWholeFileContent ──────────────────────────────────────────
+
+describe("resolveApprovedWholeFileContent", () => {
+  it("reads the whole-file content from args.content", () => {
+    const tc = approvedWrite({ file_path: "notes.md", content: "ARGS" });
+    expect(resolveApprovedWholeFileContent(tc)).toBe("ARGS");
+  });
+
+  it("reads the whole-file content from args.contents", () => {
+    const tc = approvedWrite({ file_path: "notes.md", contents: "ARGS-CONTENTS" });
+    expect(resolveApprovedWholeFileContent(tc)).toBe("ARGS-CONTENTS");
+  });
+
+  it("returns null for an elided marker in args", () => {
+    const tc = approvedWrite({ file_path: "notes.md", contents: ELISION_MARKER });
+    expect(resolveApprovedWholeFileContent(tc)).toBeNull();
+  });
+
+  it("returns null when the args carry no whole-file content (a hunk edit)", () => {
+    const tc = approvedWrite({ file_path: "notes.md", old_string: "a", new_string: "b" });
+    expect(resolveApprovedWholeFileContent(tc)).toBeNull();
+  });
+
+  it("preserves an empty-string content (a legitimately emptied file)", () => {
+    const tc = approvedWrite({ file_path: "notes.md", contents: "" });
+    expect(resolveApprovedWholeFileContent(tc)).toBe("");
+  });
+});