@stigmer/runner 3.0.9-dev.20260615153829 → 3.1.0

package/src/shared/__tests__/approval-fingerprint.test.ts

@@ -0,0 +1,115 @@
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import {
+  APPROVAL_FINGERPRINT_VERSION,
+  coarseToolIdentity,
+  computeApprovalFingerprint,
+  computeCoarseApprovalFingerprint,
+  deriveExecutionFingerprintKey,
+} from "../approval-fingerprint.js";
+import type { ToolActionInput } from "../approval-canonicalize.js";
+
+interface FingerprintVector {
+  name: string;
+  input: ToolActionInput;
+  expected: string;
+}
+
+// Single source of truth, shared byte-for-byte with the future Go/Java editions.
+const vectorsPath = fileURLToPath(
+  new URL("../../../../../../apis/testdata/hitl/fingerprint/vectors.json", import.meta.url),
+);
+const corpus = JSON.parse(readFileSync(vectorsPath, "utf-8")) as {
+  key: string;
+  full: FingerprintVector[];
+  coarse: FingerprintVector[];
+};
+
+describe("approval fingerprint vector corpus", () => {
+  it("loads a non-trivial corpus", () => {
+    expect(corpus.full.length).toBeGreaterThanOrEqual(4);
+    expect(corpus.coarse.length).toBeGreaterThanOrEqual(4);
+  });
+
+  for (const v of corpus.full) {
+    it(`full vector: ${v.name}`, () => {
+      expect(computeApprovalFingerprint(corpus.key, v.input)).toBe(v.expected);
+    });
+  }
+
+  for (const v of corpus.coarse) {
+    it(`coarse vector: ${v.name}`, () => {
+      expect(computeCoarseApprovalFingerprint(corpus.key, v.input)).toBe(v.expected);
+    });
+  }
+});
+
+describe("fingerprint invariants", () => {
+  const key = "test-key";
+
+  it("tags every fingerprint with the version", () => {
+    const fp = computeApprovalFingerprint(key, { toolName: "read" });
+    expect(fp.startsWith(`${APPROVAL_FINGERPRINT_VERSION}:`)).toBe(true);
+  });
+
+  it("is stable for the same action (an approval re-driven is the same lease)", () => {
+    const input: ToolActionInput = { toolName: "Write", paths: ["src/a.ts"], args: { contents: "x" } };
+    expect(computeApprovalFingerprint(key, input)).toBe(computeApprovalFingerprint(key, input));
+  });
+
+  it("changes when the action changes (a drifted action is re-asked, never reused)", () => {
+    const a = computeApprovalFingerprint(key, { toolName: "Write", paths: ["src/a.ts"] });
+    const b = computeApprovalFingerprint(key, { toolName: "Write", paths: ["src/b.ts"] });
+    expect(a).not.toBe(b);
+  });
+
+  it("is key-bound (a fingerprint from one key cannot satisfy another)", () => {
+    const input: ToolActionInput = { toolName: "Shell", shellCommand: "rm -rf /" };
+    expect(computeApprovalFingerprint("key-a", input)).not.toBe(computeApprovalFingerprint("key-b", input));
+  });
+});
+
+describe("coarse projection (Cursor substrate)", () => {
+  it("collapses the write/edit taxonomies onto one identity", () => {
+    // Same logical edit named in the hook taxonomy (Write) and the stream
+    // taxonomy (edit) over the same resource -> one fingerprint. This is the
+    // March-2026 failure class, prevented by construction.
+    const hookSide: ToolActionInput = { toolName: "Write", paths: ["a.txt"] };
+    const streamSide: ToolActionInput = { toolName: "edit", paths: ["a.txt"] };
+    expect(coarseToolIdentity(hookSide).tool).toBe("write");
+    expect(coarseToolIdentity(streamSide).tool).toBe("write");
+    expect(computeCoarseApprovalFingerprint("k", hookSide)).toBe(
+      computeCoarseApprovalFingerprint("k", streamSide),
+    );
+  });
+
+  it("isolates categories (approving a write never satisfies a shell)", () => {
+    const write: ToolActionInput = { toolName: "Write", paths: ["a.txt"] };
+    const shell: ToolActionInput = { toolName: "Shell", shellCommand: "a.txt" };
+    expect(computeCoarseApprovalFingerprint("k", write)).not.toBe(
+      computeCoarseApprovalFingerprint("k", shell),
+    );
+  });
+
+  it("keys MCP tools on tool name with an empty salient", () => {
+    const id = coarseToolIdentity({ toolName: "create_issue", mcpServerSlug: "GitHub" });
+    expect(id).toEqual({ tool: "create_issue", mcpServerSlug: "github", salient: "" });
+  });
+});
+
+describe("per-execution key derivation", () => {
+  it("is stable for the same execution (gateway approves and enforces across re-invocations)", () => {
+    const master = "master-secret";
+    expect(deriveExecutionFingerprintKey(master, "exec-1")).toEqual(
+      deriveExecutionFingerprintKey(master, "exec-1"),
+    );
+  });
+
+  it("isolates executions (a key from one execution cannot serve another)", () => {
+    const master = "master-secret";
+    expect(deriveExecutionFingerprintKey(master, "exec-1")).not.toEqual(
+      deriveExecutionFingerprintKey(master, "exec-2"),
+    );
+  });
+});

package/src/shared/__tests__/approval-policy.test.ts

@@ -11,38 +11,69 @@ import {
   mergeApprovalPolicies,
   lookupMcpToolPolicy,
   resolveApprovalMessage,
-  hasApproveAllDecision,
+  deriveActiveLeases,
+  resolveApprovalProvenance,
+  toProtoPolicySource,
+  type ActiveLeases,
+  type MergedToolPolicy,
 } from "../approval-policy.js";
+import type { ToolApprovalCategory } from "../tool-kind.js";
 import type { ResolvedMcpServer } from "../mcp-resolver.js";
 import type { ToolApprovalOverride } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/spec_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ApprovalAction, ApprovalPolicySource } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/** No active leases — the default gate-everything state used by most merge tests. */
+const NO_LEASES: ActiveLeases = { global: false, categories: new Set(), servers: new Set() };
+
+/** ActiveLeases with the given scopes; `global` defaults to false. */
+function leases(opts: {
+  global?: boolean;
+  categories?: Array<"write" | "delete" | "shell">;
+  servers?: string[];
+}): ActiveLeases {
+  return {
+    global: opts.global ?? false,
+    categories: new Set(opts.categories ?? []),
+    servers: new Set(opts.servers ?? []),
+  };
+}
+
+/** A single tool call shaped just enough for deriveActiveLeases. */
+interface TestToolCall {
+  approvalAction: ApprovalAction;
+  name?: string;
+  mcpServerSlug?: string;
+}
 
 /**
- * Builds a minimal AgentExecution shaped just enough for
- * hasApproveAllDecision, which only reads tool-call approval actions on
- * root and sub-agent messages.
+ * Builds a minimal AgentExecution shaped just enough for deriveActiveLeases,
+ * which reads each tool call's approval action plus its name / mcp_server_slug
+ * (the scope inputs) on root and sub-agent messages, and spec.auto_approve_all.
  */
 function makeExecution(opts: {
-  rootActions?: ApprovalAction[];
-  subAgentActions?: ApprovalAction[];
+  rootCalls?: TestToolCall[];
+  subAgentCalls?: TestToolCall[];
+  autoApproveAll?: boolean;
   hasStatus?: boolean;
 }): AgentExecution {
   const hasStatus = opts.hasStatus ?? true;
+  const spec = { autoApproveAll: opts.autoApproveAll ?? false };
   if (!hasStatus) {
-    return { status: undefined } as unknown as AgentExecution;
+    return { spec, status: undefined } as unknown as AgentExecution;
   }
+  const toCalls = (calls: TestToolCall[] = []) =>
+    calls.map(c => ({
+      approvalAction: c.approvalAction,
+      name: c.name ?? "",
+      mcpServerSlug: c.mcpServerSlug ?? "",
+    }));
   return {
+    spec,
     status: {
-      messages: [
-        { toolCalls: (opts.rootActions ?? []).map(a => ({ approvalAction: a })) },
-      ],
+      messages: [{ toolCalls: toCalls(opts.rootCalls) }],
       subAgentExecutions: [
-        {
-          messages: [
-            { toolCalls: (opts.subAgentActions ?? []).map(a => ({ approvalAction: a })) },
-          ],
-        },
+        { messages: [{ toolCalls: toCalls(opts.subAgentCalls) }] },
       ],
     },
   } as unknown as AgentExecution;
@@ -69,19 +100,29 @@ function makeServer(
 }
 
 describe("mergeApprovalPolicies", () => {
-  it("returns empty map when autoApproveAll is true", () => {
+  it("returns empty map under a global lease (spec.auto_approve_all)", () => {
     const servers = [makeServer("github", [{ toolName: "push" }])];
-    const result = mergeApprovalPolicies(servers, [], true);
+    const result = mergeApprovalPolicies(servers, [], leases({ global: true }));
     expect(result.size).toBe(0);
   });
 
+  it("drops a leased server's tools while keeping other servers gated", () => {
+    const servers = [
+      makeServer("github", [{ toolName: "push" }]),
+      makeServer("database", [{ toolName: "drop_table" }]),
+    ];
+    const result = mergeApprovalPolicies(servers, [], leases({ servers: ["github"] }));
+    expect(result.has("github/push")).toBe(false);
+    expect(result.has("database/drop_table")).toBe(true);
+  });
+
   it("creates policies from toolApprovals", () => {
     const servers = [
       makeServer("github", [
         { toolName: "create_issue", message: "Create issue?" },
       ]),
     ];
-    const result = mergeApprovalPolicies(servers, [], false);
+    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
 
     expect(result.size).toBe(1);
     const policy = result.get("github/create_issue")!;
@@ -98,7 +139,7 @@ describe("mergeApprovalPolicies", () => {
         [{ toolName: "push", message: "pinned message" }],
       ),
     ];
-    const result = mergeApprovalPolicies(servers, [], false);
+    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
 
     const policy = result.get("github/push")!;
     expect(policy.approvalMessage).toBe("pinned message");
@@ -114,7 +155,7 @@ describe("mergeApprovalPolicies", () => {
       message: "",
     }] as any[];
 
-    const result = mergeApprovalPolicies(servers, overrides, false);
+    const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
     expect(result.size).toBe(0);
   });
 
@@ -126,15 +167,57 @@ describe("mergeApprovalPolicies", () => {
       message: "Really delete?",
     }] as any[];
 
-    const result = mergeApprovalPolicies(servers, overrides, false);
+    const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
     expect(result.has("github/delete_repo")).toBe(true);
   });
 
+  describe("provenance (source stamping)", () => {
+    it("stamps classifier_default for a layer-1 tool approval", () => {
+      const servers = [makeServer("github", [{ toolName: "create_issue" }])];
+      const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+      expect(result.get("github/create_issue")!.source).toBe("classifier_default");
+    });
+
+    it("stamps pinned_override when a pinned approval wins", () => {
+      const servers = [
+        makeServer("github", [{ toolName: "push" }], [{ toolName: "push" }]),
+      ];
+      const result = mergeApprovalPolicies(servers, [], NO_LEASES);
+      expect(result.get("github/push")!.source).toBe("pinned_override");
+    });
+
+    it("stamps agent_override when a per-agent override adds a gate", () => {
+      const servers = [makeServer("github", [])];
+      const overrides: ToolApprovalOverride[] = [{
+        toolName: "delete_repo",
+        requiresApproval: true,
+        message: "Really delete?",
+      }] as any[];
+      const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+      expect(result.get("github/delete_repo")!.source).toBe("agent_override");
+    });
+
+    it("stamps agent_override when it overrides a classifier/pinned entry", () => {
+      const servers = [
+        makeServer("github", [{ toolName: "push", message: "classifier" }]),
+      ];
+      const overrides: ToolApprovalOverride[] = [{
+        toolName: "push",
+        requiresApproval: true,
+        message: "agent says gate",
+      }] as any[];
+      const result = mergeApprovalPolicies(servers, overrides, NO_LEASES);
+      const policy = result.get("github/push")!;
+      expect(policy.source).toBe("agent_override");
+      expect(policy.approvalMessage).toBe("agent says gate");
+    });
+  });
+
   it("skips tools without names", () => {
     const servers = [
       makeServer("github", [{ toolName: "" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], false);
+    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
     expect(result.size).toBe(0);
   });
 
@@ -142,7 +225,7 @@ describe("mergeApprovalPolicies", () => {
     const servers = [
       makeServer("github", [{ toolName: "push" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], false);
+    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
     expect(result.get("github/push")!.approvalMessage).toContain("Execute tool: push");
   });
 
@@ -151,50 +234,100 @@ describe("mergeApprovalPolicies", () => {
       makeServer("github", [{ toolName: "push" }]),
       makeServer("database", [{ toolName: "drop_table" }]),
     ];
-    const result = mergeApprovalPolicies(servers, [], false);
+    const result = mergeApprovalPolicies(servers, [], NO_LEASES);
     expect(result.size).toBe(2);
     expect(result.has("github/push")).toBe(true);
     expect(result.has("database/drop_table")).toBe(true);
   });
 });
 
-describe("hasApproveAllDecision", () => {
-  it("returns false when there is no status", () => {
-    expect(hasApproveAllDecision(makeExecution({ hasStatus: false }))).toBe(false);
+describe("deriveActiveLeases", () => {
+  it("returns no leases when there is no status", () => {
+    const result = deriveActiveLeases(makeExecution({ hasStatus: false }));
+    expect(result.global).toBe(false);
+    expect(result.categories.size).toBe(0);
+    expect(result.servers.size).toBe(0);
+  });
+
+  it("returns no scoped leases when no tool call carries APPROVE_ALL", () => {
+    const exec = makeExecution({
+      rootCalls: [
+        { approvalAction: ApprovalAction.APPROVE, name: "shell" },
+        { approvalAction: ApprovalAction.SKIP, name: "write" },
+      ],
+      subAgentCalls: [{ approvalAction: ApprovalAction.REJECT, name: "delete" }],
+    });
+    const result = deriveActiveLeases(exec);
+    expect(result.categories.size).toBe(0);
+    expect(result.servers.size).toBe(0);
+  });
+
+  it("reflects the global pre-arm from spec.auto_approve_all", () => {
+    const result = deriveActiveLeases(makeExecution({ autoApproveAll: true }));
+    expect(result.global).toBe(true);
+  });
+
+  it("derives a built-in CATEGORY lease from an APPROVE_ALL on a built-in", () => {
+    const exec = makeExecution({
+      rootCalls: [{ approvalAction: ApprovalAction.APPROVE_ALL, name: "shell" }],
+    });
+    const result = deriveActiveLeases(exec);
+    expect([...result.categories]).toEqual(["shell"]);
+    expect(result.servers.size).toBe(0);
+  });
+
+  it("collapses FILE_WRITE and FILE_EDIT to a single 'write' category lease", () => {
+    const exec = makeExecution({
+      rootCalls: [
+        { approvalAction: ApprovalAction.APPROVE_ALL, name: "write_file" },
+        { approvalAction: ApprovalAction.APPROVE_ALL, name: "edit_file" },
+      ],
+    });
+    expect([...deriveActiveLeases(exec).categories]).toEqual(["write"]);
   });
 
-  it("returns false when no tool call carries APPROVE_ALL", () => {
+  it("derives a SERVER lease from an APPROVE_ALL on an MCP tool", () => {
     const exec = makeExecution({
-      rootActions: [ApprovalAction.APPROVE, ApprovalAction.SKIP],
-      subAgentActions: [ApprovalAction.REJECT],
+      rootCalls: [
+        { approvalAction: ApprovalAction.APPROVE_ALL, name: "create_issue", mcpServerSlug: "github" },
+      ],
     });
-    expect(hasApproveAllDecision(exec)).toBe(false);
+    const result = deriveActiveLeases(exec);
+    expect([...result.servers]).toEqual(["github"]);
+    expect(result.categories.size).toBe(0);
   });
 
-  it("detects APPROVE_ALL on a root message tool call", () => {
+  it("derives leases from sub-agent tool calls too", () => {
     const exec = makeExecution({
-      rootActions: [ApprovalAction.APPROVE, ApprovalAction.APPROVE_ALL],
+      subAgentCalls: [
+        { approvalAction: ApprovalAction.APPROVE_ALL, name: "delete" },
+        { approvalAction: ApprovalAction.APPROVE_ALL, name: "drop", mcpServerSlug: "database" },
+      ],
     });
-    expect(hasApproveAllDecision(exec)).toBe(true);
+    const result = deriveActiveLeases(exec);
+    expect([...result.categories]).toEqual(["delete"]);
+    expect([...result.servers]).toEqual(["database"]);
   });
 
-  it("detects APPROVE_ALL on a sub-agent message tool call", () => {
+  it("does not lease a read-only built-in (no category) on APPROVE_ALL", () => {
     const exec = makeExecution({
-      rootActions: [ApprovalAction.APPROVE],
-      subAgentActions: [ApprovalAction.APPROVE_ALL],
+      rootCalls: [{ approvalAction: ApprovalAction.APPROVE_ALL, name: "read" }],
     });
-    expect(hasApproveAllDecision(exec)).toBe(true);
+    const result = deriveActiveLeases(exec);
+    expect(result.categories.size).toBe(0);
+    expect(result.servers.size).toBe(0);
   });
 });
 
 describe("lookupMcpToolPolicy", () => {
   it("finds policy by server/tool key", () => {
-    const policies = new Map([
+    const policies = new Map<string, MergedToolPolicy>([
       ["github/push", {
         toolName: "push",
         mcpServerSlug: "github",
         requiresApproval: true,
         approvalMessage: "Push?",
+        source: "classifier_default",
       }],
     ]);
 
@@ -254,3 +387,104 @@ describe("resolveApprovalMessage", () => {
       .toBe("Simple message");
   });
 });
+
+// ---------------------------------------------------------------------------
+// resolveApprovalProvenance — the read-side seam that stamps
+// ToolCall.approval_policy_source. Each branch must map to the right
+// PolicySource so the persisted provenance is correct per layer.
+// ---------------------------------------------------------------------------
+
+describe("resolveApprovalProvenance", () => {
+  const NO_CATEGORIES: ReadonlySet<ToolApprovalCategory> = new Set();
+
+  function mcpPolicy(source: MergedToolPolicy["source"]): ReadonlyMap<string, MergedToolPolicy> {
+    return new Map([
+      [
+        "github/create_issue",
+        {
+          toolName: "create_issue",
+          mcpServerSlug: "github",
+          requiresApproval: true,
+          approvalMessage: "Create issue?",
+          source,
+        },
+      ],
+    ]);
+  }
+
+  it("returns auto_approve_all when the whole-run global bypass is armed", () => {
+    expect(
+      resolveApprovalProvenance("delete", "", new Map(), NO_CATEGORIES, true),
+    ).toBe("auto_approve_all");
+  });
+
+  it("surfaces the merged MCP policy's layer for a gated MCP tool", () => {
+    expect(
+      resolveApprovalProvenance("create_issue", "github", mcpPolicy("agent_override"), NO_CATEGORIES, false),
+    ).toBe("agent_override");
+  });
+
+  it("surfaces annotation_destructive_tighten for a destructive-hint-gated MCP tool", () => {
+    expect(
+      resolveApprovalProvenance(
+        "create_issue",
+        "github",
+        mcpPolicy("annotation_destructive_tighten"),
+        NO_CATEGORIES,
+        false,
+      ),
+    ).toBe("annotation_destructive_tighten");
+  });
+
+  it("reads classifier_default for an MCP tool the chain cleared (no entry)", () => {
+    expect(
+      resolveApprovalProvenance("list_issues", "github", new Map(), NO_CATEGORIES, false),
+    ).toBe("classifier_default");
+  });
+
+  it("returns builtin_category for a mutating built-in with no lease", () => {
+    expect(
+      resolveApprovalProvenance("write", "", new Map(), NO_CATEGORIES, false),
+    ).toBe("builtin_category");
+  });
+
+  it("returns approval_lease for a mutating built-in whose category is leased", () => {
+    expect(
+      resolveApprovalProvenance("write", "", new Map(), new Set<ToolApprovalCategory>(["write"]), false),
+    ).toBe("approval_lease");
+  });
+
+  it("returns undefined for a read-only built-in no layer governs", () => {
+    expect(
+      resolveApprovalProvenance("read", "", new Map(), NO_CATEGORIES, false),
+    ).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// toProtoPolicySource — the runner-union -> proto-enum mapping. The
+// cross-edition corpus (policy-source-corpus.test.ts) pins the numbers; these
+// cases assert the mapping is total and that undefined collapses to UNSPECIFIED.
+// ---------------------------------------------------------------------------
+
+describe("toProtoPolicySource", () => {
+  it("maps undefined (no governing layer) to UNSPECIFIED", () => {
+    expect(toProtoPolicySource(undefined)).toBe(ApprovalPolicySource.UNSPECIFIED);
+  });
+
+  it("maps every union member to a distinct non-UNSPECIFIED enum value", () => {
+    const sources = [
+      "classifier_default",
+      "pinned_override",
+      "agent_override",
+      "auto_approve_all",
+      "approval_lease",
+      "builtin_category",
+      "annotation_destructive_tighten",
+    ] as const;
+    const mapped = sources.map((s) => toProtoPolicySource(s));
+    // All non-UNSPECIFIED and all distinct.
+    expect(mapped.every((v) => v !== ApprovalPolicySource.UNSPECIFIED)).toBe(true);
+    expect(new Set(mapped).size).toBe(sources.length);
+  });
+});

package/src/shared/__tests__/args-preview.test.ts

@@ -0,0 +1,78 @@
+/**
+ * Unit tests for the shared args-preview sanitizers.
+ *
+ * The Cursor gate path depends on {@link buildElidedArgsPreview} producing a
+ * SMALL, ALWAYS-VALID, salient-preserving preview: the resumed turn re-parses it
+ * to rebuild an approval grant's identity, and the persist-time size backstop
+ * would replace an oversized preview with an unparseable marker. These pin those
+ * invariants so a large write can never silently break the resume round-trip.
+ */
+
+import { describe, it, expect } from "vitest";
+import {
+  buildElidedArgsPreview,
+  sanitizeArgsPreview,
+  MAX_ARGS_PREVIEW_LENGTH,
+} from "../args-preview.js";
+
+describe("sanitizeArgsPreview (native)", () => {
+  it("redacts sensitive keys", () => {
+    const out = JSON.parse(sanitizeArgsPreview({ api_key: "sk-123", path: "a.txt" }));
+    expect(out.api_key).toBe("[REDACTED]");
+    expect(out.path).toBe("a.txt");
+  });
+
+  it("truncates the whole string past the cap", () => {
+    const preview = sanitizeArgsPreview({ contents: "x".repeat(MAX_ARGS_PREVIEW_LENGTH * 2) });
+    expect(preview.length).toBeLessThanOrEqual(MAX_ARGS_PREVIEW_LENGTH + 1);
+    expect(preview.endsWith("…")).toBe(true);
+  });
+});
+
+describe("buildElidedArgsPreview (cursor gate)", () => {
+  const SALIENT = ["file_path", "path", "target_notebook", "command"] as const;
+
+  it("stays valid JSON and small for a large write, eliding the content value", () => {
+    const content = "line\n".repeat(100_000); // ~500 KB
+    const preview = buildElidedArgsPreview(
+      { path: "src/big.ts", contents: content },
+      SALIENT,
+    );
+
+    // Parseable — the resume round-trip depends on this.
+    const parsed = JSON.parse(preview) as Record<string, unknown>;
+    // Bounded — nowhere near the raw content size.
+    expect(preview.length).toBeLessThan(1_000);
+    // The salient path survives verbatim (grant identity), content is elided.
+    expect(parsed.path).toBe("src/big.ts");
+    expect(parsed.contents).toBe(`[${content.length} chars]`);
+  });
+
+  it("never elides a salient field, even a very long shell command", () => {
+    const command = "echo " + "a".repeat(5_000);
+    const preview = buildElidedArgsPreview({ command, cwd: "/x" }, SALIENT);
+
+    const parsed = JSON.parse(preview) as Record<string, unknown>;
+    // The grant token is base64(category\ncommand) — the command MUST be whole.
+    expect(parsed.command).toBe(command);
+  });
+
+  it("redacts secret keys", () => {
+    const preview = buildElidedArgsPreview(
+      { path: "a.txt", authorization: "Bearer abc" },
+      SALIENT,
+    );
+    const parsed = JSON.parse(preview) as Record<string, unknown>;
+    expect(parsed.authorization).toBe("[REDACTED]");
+  });
+
+  it("preserves small non-salient values unchanged", () => {
+    const preview = buildElidedArgsPreview(
+      { path: "a.txt", old_string: "alpha", new_string: "beta" },
+      SALIENT,
+    );
+    const parsed = JSON.parse(preview) as Record<string, unknown>;
+    expect(parsed.old_string).toBe("alpha");
+    expect(parsed.new_string).toBe("beta");
+  });
+});