@stigmer/runner 3.0.9-dev.20260616060535 → 3.1.0

package/src/activities/execute-cursor/__tests__/message-translator.test.ts

@@ -1,4 +1,6 @@
 /**
+ * @regression file-hitl-phase0 — pins file-edit HITL fix #3 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ *
  * Unit tests for MessageAccumulator tool call status transitions.
  *
  * Validates the indexed tool call tracking that prevents the
@@ -9,12 +11,16 @@
 
 import { describe, it, expect } from "vitest";
 import { create } from "@bufbuild/protobuf";
-import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import {
   MessageType,
   ToolCallStatus,
   SubAgentStatus,
+  ToolKind,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { SDKMessage } from "@cursor/sdk";
 import {
@@ -106,6 +112,40 @@ describe("MessageAccumulator tool call status transitions", () => {
     expect(tc.completedAt).toBeTruthy();
   });
 
+  it("persists the Cursor shell {status,value} envelope verbatim on ToolCall.result", () => {
+    // The Cursor SDK's built-in Shell tool returns a structured envelope object;
+    // the runner stores it as a JSON string (toResultString → JSON.stringify),
+    // and the SDK view layer (normalizeShell) unwraps it for display. This locks
+    // the persisted shape so the cross-language fixture (result-views.json's
+    // cursor_shell_envelope) is grounded in what the runner actually writes,
+    // not a guess — the two halves of the bug fix stay in sync.
+    const messages: AgentMessage[] = [];
+    const acc = new MessageAccumulator(messages);
+
+    const envelope = {
+      status: "success",
+      value: {
+        exitCode: 0,
+        signal: "",
+        stdout: "total 8\n",
+        stderr: "",
+        executionTime: 1176,
+      },
+    };
+
+    acc.processEvent(assistantEvent("r1", "Running ls."));
+    acc.processEvent(toolCallEvent("tc-shell", "Shell", "running"));
+    acc.processEvent(
+      toolCallEvent("tc-shell", "Shell", "completed", "run-1", { result: envelope }),
+    );
+
+    const tc = findToolCallById(messages, "tc-shell")!;
+    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(tc.result).toBe(JSON.stringify(envelope));
+    // Round-trips to the original structure (the SDK normalizer reads .value).
+    expect(JSON.parse(tc.result)).toEqual(envelope);
+  });
+
   it("cross-message completion: tool call completes after new AI message is created", () => {
     const messages: AgentMessage[] = [];
     const acc = new MessageAccumulator(messages);
@@ -418,12 +458,18 @@ describe("MessageAccumulator tool call status transitions", () => {
     expect(sub.messages[1].content).toBe("Here is a summary of AI.");
   });
 
-  it("sub-agent extracts toolCall steps from conversationSteps", () => {
+  // Real Cursor task-result shape (verified against production agent_execution
+  // blobs): each step is a protobuf-oneof keyed DIRECTLY by kind, and a tool
+  // call is { toolCall: { toolCallId, <kind>ToolCall: { args, result } } } whose
+  // result is a oneof { success | error | permissionDenied | rejected }. This is
+  // the shape that exposed the dropped-tool-calls bug: the prior parser only
+  // matched a { type:"toolCall", message } envelope that never occurs.
+  it("sub-agent extracts real direct-keyed toolCall steps from conversationSteps", () => {
     const messages: AgentMessage[] = [];
     const acc = new MessageAccumulator(messages);
 
     const runningEvent = toolCallEvent("tc-sub7", "task", "running", "r1", {
-      args: { description: "Use tools", prompt: "Run ls" },
+      args: { description: "Explore the repo", prompt: "Find the README" },
     });
     acc.processEvent(runningEvent);
     acc.trackSubAgentExecution(runningEvent);
@@ -433,16 +479,36 @@ describe("MessageAccumulator tool call status transitions", () => {
         status: "success",
         value: {
           conversationSteps: [
+            { thinkingMessage: { text: "Let me look for the README." } },
             {
-              type: "toolCall",
-              message: {
-                type: "shell",
-                args: { command: "ls -la" },
-                result: { status: "success", value: { stdout: "file.txt", stderr: "", exitCode: 0 } },
+              toolCall: {
+                toolCallId: "glob-1",
+                globToolCall: {
+                  args: { targetDirectory: "/repo", globPattern: "**/*.md" },
+                  result: { success: { path: "/repo", files: ["README.md"] } },
+                },
               },
             },
-            { type: "assistantMessage", message: { text: "I found file.txt." } },
+            {
+              toolCall: {
+                toolCallId: "read-1",
+                readToolCall: {
+                  args: { path: "/repo/README.md" },
+                  result: {
+                    success: {
+                      content: "# Hello",
+                      path: "/repo/README.md",
+                      totalLines: 1,
+                      fileSize: 7,
+                    },
+                  },
+                },
+              },
+            },
+            { assistantMessage: { text: "I found and read the README." } },
           ],
+          agentId: "sub-agent-xyz",
+          durationMs: 4200,
           isBackground: false,
           backgroundReason: "unspecified",
         },
@@ -452,16 +518,31 @@ describe("MessageAccumulator tool call status transitions", () => {
     acc.trackSubAgentExecution(completedEvent);
 
     const sub = acc.subAgentExecutions[0];
-    expect(sub.messages).toHaveLength(2);
+    // thinking + glob tool call + read tool call + assistant text
+    expect(sub.messages).toHaveLength(4);
 
-    const toolMsg = sub.messages[0];
-    expect(toolMsg.type).toBe(MessageType.MESSAGE_AI);
-    expect(toolMsg.toolCalls).toHaveLength(1);
-    expect(toolMsg.toolCalls[0].name).toBe("shell");
-    expect(toolMsg.toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
-
-    expect(sub.messages[1].type).toBe(MessageType.MESSAGE_AI);
-    expect(sub.messages[1].content).toBe("I found file.txt.");
+    expect(sub.messages[0].type).toBe(MessageType.MESSAGE_THINKING);
+    expect(sub.messages[0].content).toBe("Let me look for the README.");
+
+    const globMsg = sub.messages[1];
+    expect(globMsg.type).toBe(MessageType.MESSAGE_AI);
+    expect(globMsg.toolCalls).toHaveLength(1);
+    expect(globMsg.toolCalls[0].id).toBe("glob-1");
+    expect(globMsg.toolCalls[0].name).toBe("glob");
+    expect(globMsg.toolCalls[0].toolKind).toBe(ToolKind.SEARCH);
+    expect(globMsg.toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+
+    const readMsg = sub.messages[2];
+    expect(readMsg.type).toBe(MessageType.MESSAGE_AI);
+    expect(readMsg.toolCalls).toHaveLength(1);
+    expect(readMsg.toolCalls[0].id).toBe("read-1");
+    expect(readMsg.toolCalls[0].name).toBe("read");
+    expect(readMsg.toolCalls[0].toolKind).toBe(ToolKind.FILE_READ);
+    expect(readMsg.toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    expect(readMsg.toolCalls[0].result).toContain("# Hello");
+
+    expect(sub.messages[3].type).toBe(MessageType.MESSAGE_AI);
+    expect(sub.messages[3].content).toBe("I found and read the README.");
   });
 
   it("sub-agent gracefully handles missing conversationSteps", () => {
@@ -563,26 +644,90 @@ describe("MessageAccumulator tool call status transitions", () => {
       expect(out[0].content).toBe("Real content.");
     });
 
-    it("extracts tool error results correctly", () => {
+    it("maps a tool result error oneof to a FAILED tool call", () => {
+      const out: AgentMessage[] = [];
+      extractConversationSteps({
+        status: "success",
+        value: {
+          conversationSteps: [
+            {
+              toolCall: {
+                toolCallId: "read-err",
+                readToolCall: {
+                  args: { path: "/nope.txt" },
+                  result: { error: { errorMessage: "file not found" } },
+                },
+              },
+            },
+          ],
+        },
+      }, out);
+
+      expect(out).toHaveLength(1);
+      const tc = out[0].toolCalls[0];
+      expect(tc.name).toBe("read");
+      expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+      expect(tc.error).toContain("file not found");
+      expect(tc.result).toBe("");
+    });
+
+    it("maps a gate-denied shell (permissionDenied / rejected) to a FAILED tool call", () => {
       const out: AgentMessage[] = [];
       extractConversationSteps({
         status: "success",
         value: {
           conversationSteps: [
             {
-              type: "toolCall",
-              message: {
-                type: "shell",
-                args: { command: "bad-cmd" },
-                result: { status: "error", error: "command not found" },
+              toolCall: {
+                toolCallId: "shell-denied",
+                shellToolCall: {
+                  args: {},
+                  result: {
+                    permissionDenied: {
+                      command: "rm -rf /",
+                      error: "blocked by approval gate",
+                      isReadonly: false,
+                    },
+                  },
+                },
+              },
+            },
+            {
+              toolCall: {
+                toolCallId: "shell-rejected",
+                shellToolCall: {
+                  args: {},
+                  result: { rejected: { command: "curl evil.sh", reason: "user rejected" } },
+                },
               },
             },
           ],
         },
       }, out);
 
+      expect(out).toHaveLength(2);
+      expect(out[0].toolCalls[0].name).toBe("shell");
+      expect(out[0].toolCalls[0].toolKind).toBe(ToolKind.SHELL);
+      expect(out[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+      expect(out[0].toolCalls[0].error).toContain("blocked by approval gate");
+      expect(out[1].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
+      expect(out[1].toolCalls[0].error).toContain("user rejected");
+    });
+
+    it("skips a malformed toolCall step with no <kind>ToolCall key", () => {
+      const out: AgentMessage[] = [];
+      extractConversationSteps({
+        status: "success",
+        value: {
+          conversationSteps: [
+            { toolCall: { toolCallId: "orphan" } },
+            { assistantMessage: { text: "still works" } },
+          ],
+        },
+      }, out);
+
       expect(out).toHaveLength(1);
-      expect(out[0].toolCalls[0].result).toBe("command not found");
+      expect(out[0].content).toBe("still works");
     });
   });
 
@@ -859,4 +1004,5 @@ describe("MessageAccumulator tool call status transitions", () => {
       expect(cancelInProgressSubAgentProtos([])).toBe(false);
     });
   });
+
 });

package/src/activities/execute-cursor/__tests__/sequential-gate-resume.test.ts

@@ -0,0 +1,189 @@
+/**
+ * @regression file-hitl-phase0 — pins file-edit HITL fix #2 (see _projects/2026-06/20260630.01.file-change-hitl-redesign/tasks/T01_3_regression-manifest.md)
+ *
+ * Cursor analog of execute-deep-agent/__tests__/sequential-gate-resume.test.ts:
+ * two SEQUENTIAL approval gates across a resume, on the Cursor deny-and-reconcile
+ * harness instead of the native in-process gate.
+ *
+ * The shared failure class both files guard: a resume that rebuilds its transcript
+ * from empty drops gate A's already-committed tool-call id, the backend's
+ * append-only-at-identity guard rejects the update, pending_approvals projects to
+ * 0, and the WAITING_FOR_APPROVAL + pending=0 state makes the workflow watchdog
+ * auto-resume — silently skipping (and looping on) gate B.
+ *
+ * The Cursor specifics this file pins, which the native one cannot:
+ *  - the resume re-issues gate A with a BRAND-NEW call id (Cursor has no pause
+ *    primitive; the model re-runs the approved tool), so the fix must reconcile
+ *    the re-run onto gate A's committed id by canonical identity, not append a
+ *    duplicate row;
+ *  - "each tool gates exactly once": gate A, approved on turn 1, must come back
+ *    COMPLETED on the resume (never WAITING_APPROVAL again), while gate B gates
+ *    for the first time — and the REAL bash hook must ALLOW A's re-issue while
+ *    DENYING B, the out-of-process half the native gate has no equivalent for.
+ *
+ * Exercises the MessageAccumulator + denial reconciliation (the unit that owns
+ * the Cursor resume emitter) plus the generated hook, keeping the reproduction
+ * hermetic and pinned to the exact code under change.
+ */
+
+import { describe, it, expect } from "vitest";
+import { create, clone } from "@bufbuild/protobuf";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  ApprovalAction,
+  MessageType,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { SDKMessage } from "@cursor/sdk";
+
+import {
+  MessageAccumulator,
+  reconcileDeniedToolCalls,
+  toolCallIdentityToken,
+} from "../message-translator.js";
+import {
+  buildApprovalGrants,
+  buildApprovalState,
+  reconstructAdjudicatedApprovals,
+} from "../approval-state.js";
+import type { DeniedLedgerEntry } from "../approval-state.js";
+import {
+  setupCursorHookHarness,
+  hasBash,
+  hookWrite,
+  hookShell,
+} from "../__test-utils__/cursor-hook-harness.js";
+
+const GATE_A_ID = "tool_edit_a";
+const GATE_A_PATH = "/work/a.txt";
+const GATE_B_ID = "tool_shell_b";
+const GATE_B_CMD = "make build";
+
+function builtInEvent(
+  callId: string,
+  name: string,
+  status: "running" | "completed",
+  args: Record<string, unknown>,
+  result?: unknown,
+): Extract<SDKMessage, { type: "tool_call" }> {
+  return { type: "tool_call", agent_id: "agent-1", run_id: "r2", call_id: callId, name, status, args, result };
+}
+
+function assistantEvent(text: string): Extract<SDKMessage, { type: "assistant" }> {
+  return {
+    type: "assistant",
+    agent_id: "agent-1",
+    run_id: "r2",
+    message: { role: "assistant", content: [{ type: "text", text }] },
+  };
+}
+
+/** Run-1 transcript: gate A (edit) committed and APPROVED by the user. */
+function approvedGateA(): AgentMessage[] {
+  return [
+    create(AgentMessageSchema, {
+      type: MessageType.MESSAGE_AI,
+      content: "I'll write file A, then build.",
+      timestamp: "2026-06-20T00:00:01.000Z",
+      toolCalls: [
+        create(ToolCallSchema, {
+          id: GATE_A_ID,
+          name: "edit",
+          status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+          requiresApproval: true,
+          approvalAction: ApprovalAction.APPROVE,
+          argsPreview: JSON.stringify({ path: GATE_A_PATH, content: "A\n" }),
+        }),
+      ],
+    }),
+  ];
+}
+
+/**
+ * Resume events: gate A is re-issued with a FRESH id and completes (the approved
+ * tool finally runs), the agent advances and proposes gate B (shell), which is
+ * gated — emitted running, then cut off by the first-denial stop.
+ */
+function resumeIntoGateB(): SDKMessage[] {
+  return [
+    assistantEvent("File A written. Now building."),
+    builtInEvent(`${GATE_A_ID}_RESUME`, "edit", "running", { path: GATE_A_PATH, content: "A\n" }),
+    builtInEvent(`${GATE_A_ID}_RESUME`, "edit", "completed", { path: GATE_A_PATH, content: "A\n" }, "wrote a.txt"),
+    builtInEvent(`${GATE_B_ID}_RESUME`, "shell", "running", { command: GATE_B_CMD }),
+  ];
+}
+
+function allToolCalls(messages: AgentMessage[]) {
+  return messages.flatMap((m) => m.toolCalls);
+}
+
+/** Local mirror of the backend append-only-at-identity guard (see hitl-resume-history). */
+function guardRejectionReason(existing: AgentMessage[], incoming: AgentMessage[]): string | undefined {
+  if (incoming.length < existing.length) return "would shrink the message transcript";
+  const incomingIds = new Set<string>();
+  for (const m of incoming) for (const tc of m.toolCalls) if (tc.id) incomingIds.add(tc.id);
+  for (const m of existing) {
+    for (const tc of m.toolCalls) {
+      if (tc.id && !incomingIds.has(tc.id)) return "would drop a previously-committed tool call";
+    }
+  }
+  return undefined;
+}
+
+describe("Cursor sequential gates A->B across resume", () => {
+  it("preserves gate A (completed) and surfaces gate B exactly once — a superset the guard accepts", async () => {
+    const committed = approvedGateA();
+    const seeded = committed.map((m) => clone(AgentMessageSchema, m));
+
+    const acc = new MessageAccumulator(seeded, { seededSubAgents: [] });
+    for (const event of resumeIntoGateB()) acc.processEvent(event);
+    acc.finalize();
+
+    // Gate B was denied this turn; its identity comes off the reconciled call.
+    const bCall = allToolCalls(seeded).find((tc) => tc.name === "shell")!;
+    const ledger: DeniedLedgerEntry[] = [
+      { toolName: "shell", token: toolCallIdentityToken(bCall) },
+    ];
+    await reconcileDeniedToolCalls(seeded, ledger);
+
+    const tools = allToolCalls(seeded);
+    const byId = new Map(tools.map((tc) => [tc.id, tc]));
+
+    // Superset: gate A's committed id survives the resume (no drop, no re-key).
+    expect(byId.has(GATE_A_ID)).toBe(true);
+    expect(tools.some((tc) => tc.id === `${GATE_A_ID}_RESUME`)).toBe(false);
+
+    // Each gates exactly once: A is now COMPLETED (approved + run, never gated
+    // again); B is WAITING_APPROVAL, and only once.
+    expect(byId.get(GATE_A_ID)!.status).toBe(ToolCallStatus.TOOL_CALL_COMPLETED);
+    const waiting = tools.filter((tc) => tc.status === ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(waiting).toHaveLength(1);
+    expect(waiting[0].name).toBe("shell");
+
+    // No duplicate rows for either gate.
+    expect(tools.filter((tc) => tc.name === "edit")).toHaveLength(1);
+    expect(tools.filter((tc) => tc.name === "shell")).toHaveLength(1);
+
+    // The decisive invariant: the resumed transcript is a strict superset, so the
+    // backend guard accepts it and gate B's pending is actually persisted.
+    expect(guardRejectionReason(committed, seeded)).toBeUndefined();
+  });
+
+  it("the hook ALLOWS gate A's re-issue and DENIES gate B (out-of-process closure)", () => {
+    if (!hasBash) return;
+
+    // Only gate A is approved going into the resume; its grant is what the hook
+    // reads. Gate B has no grant yet (it gates for the first time this turn).
+    const { pendingApprovals, decisions } = reconstructAdjudicatedApprovals(approvedGateA());
+    const grants = buildApprovalGrants(pendingApprovals, decisions);
+    const state = buildApprovalState(new Map(), false, new Set(), grants);
+
+    const harness = setupCursorHookHarness({ grants: state.approvedGrants });
+    expect(harness.decide(hookWrite(GATE_A_PATH)).permission).toBe("allow");
+    expect(harness.decide(hookShell(GATE_B_CMD)).permission).toBe("deny");
+  });
+});

package/src/activities/execute-cursor/__tests__/tool-result-image.test.ts

@@ -2,12 +2,25 @@
  * Unit tests for Cursor MCP image-result normalization.
  *
  * The Cursor SDK wraps an MCP tool result as
- *   { status, value: { content: [ { text:{text} }, { image:{ data, mimeType } } ] } }
- * where image `data` is a Node Buffer-JSON ({ type:"Buffer", data:number[] }).
- * The translator must re-emit that as the canonical top-level content-block
- * array the shared persist-time offload consumes, so a screenshot lands as a
- * renderable image ToolCallOutputRef instead of text/plain. These tests pin
- * that normalization and confirm it flows end-to-end through the offload.
+ *   { status, value: { content: [ { text:{text} }, { image:{ data, mimeType? } } ] } }
+ * where image `data` is a Node Buffer-JSON ({ type:"Buffer", data:number[] }) at
+ * RUNTIME — confirmed verbatim from a real cursor-harness get_app_state result
+ * (a PNG screenshot, no mimeType field). The SDK's .d.ts types `data` as a
+ * string, but the runtime serialization is Buffer-JSON, so the canonical fixture
+ * below uses Buffer-JSON; base64 / data:-URL string `data` is also covered.
+ *
+ * The translator must re-emit the envelope as the canonical top-level
+ * content-block array the shared persist-time offload consumes, so a screenshot
+ * lands as a renderable image ToolCallOutputRef instead of text/plain. These
+ * tests pin that normalization and confirm it flows end-to-end through the
+ * offload.
+ *
+ * Note: this normalization only runs when the SDK delivers `result` as an
+ * OBJECT. When it arrives already-serialized as a STRING (observed in
+ * production: the whole envelope nested under value.content), the translator
+ * passes it through and the shared offload's detectImagePayload is what must
+ * recognize it — that string path (including the Buffer-JSON + no-mimeType
+ * shape) is guarded in shared/__tests__/status-offload.
  */
 
 import { describe, it, expect, vi } from "vitest";
@@ -15,7 +28,7 @@ import { create } from "@bufbuild/protobuf";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import type { SDKMessage } from "@cursor/sdk";
-import type { ArtifactStorage } from "../../../shared/artifact-storage.js";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
 import {
   offloadOversizedToolOutputs,
   detectImagePayload,
@@ -28,17 +41,22 @@ import {
 } from "../message-translator.js";
 import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 
-// PNG signature + a little payload, the way the Cursor SDK serializes bytes.
+// PNG signature + a little payload. PNG_BYTES is how the Cursor SDK delivers
+// image data at runtime (Node Buffer-JSON); PNG_BASE64 is its base64 form, used
+// by the string-`data` variant tests.
 const PNG_BYTES = [137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82];
 const PNG_BASE64 = Buffer.from(PNG_BYTES).toString("base64");
 
+// The canonical envelope, matching the real runtime shape: image.data is Node
+// Buffer-JSON and there is no mimeType. This is the shape the translator and
+// offload must handle.
 function cursorImageEnvelope(text = "App=com.example") {
   return {
     status: "success",
     value: {
       content: [
         { text: { text } },
-        { image: { data: { type: "Buffer", data: PNG_BYTES }, mimeType: "image/png" } },
+        { image: { data: { type: "Buffer", data: PNG_BYTES } } },
       ],
       isError: false,
     },
@@ -46,7 +64,7 @@ function cursorImageEnvelope(text = "App=com.example") {
 }
 
 describe("canonicalizeImageResult", () => {
-  it("converts a Cursor image envelope (Buffer-JSON) to the canonical array", () => {
+  it("converts the canonical Cursor image envelope (Buffer-JSON) to the canonical array", () => {
     const out = canonicalizeImageResult(cursorImageEnvelope("App=Slack"));
     expect(out).toBeDefined();
     expect(JSON.parse(out!)).toEqual([
@@ -152,14 +170,12 @@ describe("buildToolCallProto image normalization", () => {
 describe("cursor image flows through the persist-time offload", () => {
   it("offloads the screenshot as an image ref with no inline bytes", async () => {
     const uploads: { key: string; contentType?: string }[] = [];
-    const storage: ArtifactStorage = {
-      upload: vi.fn(async (key: string, _content: Buffer, contentType?: string) => {
-        uploads.push({ key, contentType });
-        return key;
-      }),
-      getDownloadUrl: vi.fn(async (key: string) => `https://artifacts.local/${key}`),
-      exists: vi.fn(async () => true),
-    };
+    const { storage, blobs } = makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" });
+    storage.upload.mockImplementation(async (key: string, content: Buffer, contentType?: string) => {
+      uploads.push({ key, contentType });
+      blobs.set(key, Buffer.from(content));
+      return key;
+    });
 
     const event = {
       type: "tool_call",
@@ -219,13 +235,18 @@ describe("sub-agent image normalization (extractConversationSteps)", () => {
       result: {
         status: "success",
         value: {
+          // Real Cursor task-result shape: a conversation step is keyed directly
+          // by kind, and a tool call is { toolCall: { toolCallId, <kind>ToolCall:
+          // { args, result } } } whose result is a oneof { success | error | ... }.
+          // The screenshot rides the `success` branch as the tool's result value.
           conversationSteps: [
             {
-              type: "toolCall",
-              message: {
-                type: "get_app_state",
-                args: {},
-                result: cursorImageEnvelope("App=SubAgent"),
+              toolCall: {
+                toolCallId: "sub-img-1",
+                mcpToolCall: {
+                  args: {},
+                  result: { success: cursorImageEnvelope("App=SubAgent").value },
+                },
               },
             },
           ],