@stigmer/runner 3.1.6 → 3.1.8

package/src/activities/execute-deep-agent/__tests__/hitl-reject.test.ts

@@ -0,0 +1,314 @@
+/**
+ * REJECT semantics across both checkpointers (issue #197).
+ *
+ * These tests exercise the full ExecuteDeepAgent activity on the post-decision
+ * re-invocation after a user REJECTS a gated tool call, under BOTH the durable
+ * (http, cloud) and ephemeral (memory, OSS/desktop) checkpointers.
+ *
+ * The contract (deny-tool-and-continue): a rejected tool is NOT executed, the
+ * user's objection is fed back to the model, and the execution CONTINUES to
+ * EXECUTION_COMPLETED — identically on both checkpointers. The rejected tool
+ * call is terminalized (never left stuck at WAITING_APPROVAL) with
+ * approval_action=REJECT recorded for audit.
+ *
+ * Modeled on hitl-resume-history.test.ts (http) and sequential-gate-resume.test.ts
+ * (memory): performSetup + the agent graph are mocked so the assertions isolate
+ * the activity's resume orchestration and status reconciliation.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { makeInMemoryArtifactStorage } from "../../../__test-utils__/fake-artifact-storage.js";
+import { create, clone } from "@bufbuild/protobuf";
+import {
+  AgentExecutionStatusSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import {
+  AgentMessageSchema,
+  ToolCallSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import {
+  ApprovalAction,
+  ExecutionPhase,
+  MessageType,
+  ToolCallStatus,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { V3ProtocolEvent } from "../v3-event-recorder.js";
+import type { Config } from "../../../config.js";
+import type { SetupResult } from "../setup.js";
+
+vi.mock("@temporalio/activity", () => ({
+  Context: {
+    current: () => ({
+      cancellationSignal: new AbortController().signal,
+      heartbeat: vi.fn(),
+    }),
+  },
+  CancelledFailure: class CancelledFailure extends Error {},
+}));
+
+vi.mock("../../../idle-watchdog.js", () => ({
+  activityStarted: vi.fn(),
+  activityFinished: vi.fn(),
+}));
+
+const { persistedStatuses } = vi.hoisted(() => ({
+  persistedStatuses: [] as AgentExecutionStatus[],
+}));
+
+vi.mock("../../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(() => ({
+    updateStatus: vi.fn(async (_id: string, status: AgentExecutionStatus) => {
+      persistedStatuses.push(clone(AgentExecutionStatusSchema, status));
+      return { signal: 0 };
+    }),
+    getExecution: vi.fn(),
+  })),
+}));
+
+vi.mock("../setup.js", () => ({ performSetup: vi.fn() }));
+
+import { createDeepAgentActivities } from "../index.js";
+import { performSetup } from "../setup.js";
+
+const GATED_TOOL_CALL_ID = "toolu_reject_01";
+const PRE_AI_TEXT = "I'll call the echo tool.";
+const POST_AI_TEXT = "Understood — I'll proceed without that tool.";
+const REJECT_COMMENT = "not this time";
+
+function v3Event(seq: number, method: string, data: unknown, namespace: string[] = []): V3ProtocolEvent {
+  return { type: "event", seq, method, params: { namespace, timestamp: Date.now(), data } };
+}
+
+/**
+ * A rejected tool does NOT execute, so the resumed stream carries only the
+ * model's follow-up assistant turn reacting to the rejection — no
+ * tool-started / tool-finished for the gated call.
+ */
+function postRejectAssistantTurn(): V3ProtocolEvent[] {
+  return [
+    v3Event(0, "messages", { event: "message-start", run_id: "r2" }),
+    v3Event(1, "messages", {
+      event: "content-block-delta",
+      index: 0,
+      delta: { type: "text-delta", text: POST_AI_TEXT },
+      run_id: "r2",
+    }),
+    v3Event(2, "messages", { event: "message-finish", run_id: "r2" }),
+  ];
+}
+
+function mockV3Run(events: V3ProtocolEvent[]) {
+  return {
+    [Symbol.asyncIterator]: async function* () {
+      for (const e of events) yield e;
+    },
+    output: Promise.resolve({ messages: [] }),
+    abort: vi.fn(),
+    signal: new AbortController().signal,
+  };
+}
+
+/** Run-1 transcript with the gated call carrying the user's REJECT decision. */
+function persistedRejectedStatus(): AgentExecutionStatus {
+  return create(AgentExecutionStatusSchema, {
+    phase: ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    startedAt: "2026-06-15T00:00:00.000Z",
+    messages: [
+      create(AgentMessageSchema, {
+        type: MessageType.MESSAGE_AI,
+        content: PRE_AI_TEXT,
+        timestamp: "2026-06-15T00:00:01.000Z",
+        toolCalls: [
+          create(ToolCallSchema, {
+            id: GATED_TOOL_CALL_ID,
+            name: "echo",
+            status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+            requiresApproval: true,
+            approvalMessage: "Execute echo tool",
+            approvalAction: ApprovalAction.REJECT,
+            mcpServerSlug: "test-mcp",
+          }),
+        ],
+      }),
+    ],
+  });
+}
+
+const approvalPolicies = new Map([
+  ["test-mcp/echo", {
+    toolName: "echo",
+    mcpServerSlug: "test-mcp",
+    requiresApproval: true,
+    approvalMessage: "Execute echo tool",
+  }],
+]);
+
+/** Durable (http) resume: getState reports a pending interrupt, then resolves. */
+function fakeHttpRejectSetup(): SetupResult {
+  let streamed = false;
+  const pendingInterruptState = {
+    values: { messages: [{ role: "assistant", content: PRE_AI_TEXT }] },
+    tasks: [{
+      id: "task-1",
+      interrupts: [{
+        value: {
+          tool_call_id: GATED_TOOL_CALL_ID,
+          tool_name: "echo",
+          mcp_server_slug: "test-mcp",
+          message: "Execute echo tool",
+        },
+        resumeValue: undefined,
+      }],
+    }],
+  };
+  const resolvedState = { values: { messages: [{ role: "assistant", content: PRE_AI_TEXT }] }, tasks: [] };
+
+  const agentGraph = {
+    getState: vi.fn(async () => (streamed ? resolvedState : pendingInterruptState)),
+    streamEvents: vi.fn(async () => {
+      streamed = true;
+      return mockV3Run(postRejectAssistantTurn());
+    }),
+  };
+
+  return {
+    agentGraph,
+    langgraphConfig: { configurable: { thread_id: "thread-reject-http" } },
+    langgraphInput: { messages: [{ role: "user", content: "Call echo" }] },
+    execution: {
+      spec: { message: "Call echo with 'hello'." },
+      status: persistedRejectedStatus(),
+    },
+    agent: {},
+    session: { spec: { workspaceEntries: [] } },
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-http" },
+    mcpConnection: null,
+    mergedEnvVars: {},
+    secretKeys: new Set<string>(),
+    modelName: "claude-sonnet",
+    gracefulStop: undefined,
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
+    provisionResults: [],
+    approvalPolicies,
+    toolServerMap: new Map([["echo", "test-mcp"]]),
+    leasedCategories: new Set(),
+    globalBypass: false,
+    hasStructuredOutput: false,
+    streamVersion: "v3",
+  } as unknown as SetupResult;
+}
+
+/** Memory resume: empty live checkpoint (replay), stream completes with a turn. */
+function fakeMemoryRejectSetup(): SetupResult {
+  const emptyState = { values: { messages: [] as unknown[] }, tasks: [] };
+  const agentGraph = {
+    getState: vi.fn(async () => emptyState),
+    streamEvents: vi.fn(async () => mockV3Run(postRejectAssistantTurn())),
+  };
+
+  return {
+    agentGraph,
+    langgraphConfig: { configurable: { thread_id: "thread-reject-mem" } },
+    langgraphInput: { messages: [{ role: "user", content: "Call echo" }] },
+    execution: {
+      spec: { message: "Call echo with 'hello'." },
+      status: persistedRejectedStatus(),
+    },
+    agent: {},
+    session: { spec: { workspaceEntries: [] } },
+    workspaceBackend: { rootDir: "/tmp/stigmer-test-ws-reject-mem" },
+    mcpConnection: null,
+    mergedEnvVars: {},
+    secretKeys: new Set<string>(),
+    modelName: "claude-sonnet",
+    gracefulStop: undefined,
+    artifactStorage: makeInMemoryArtifactStorage({ urlBase: "https://artifacts.local/" }).storage,
+    provisionResults: [],
+    approvalPolicies,
+    toolServerMap: new Map([["echo", "test-mcp"]]),
+    leasedCategories: new Set(),
+    globalBypass: false,
+    hasStructuredOutput: false,
+    streamVersion: "v3",
+  } as unknown as SetupResult;
+}
+
+const httpConfig: Config = {
+  taskQueue: "test-queue",
+  temporalAddress: "localhost:7233",
+  temporalNamespace: "default",
+  stigmerBackendEndpoint: "http://localhost:7234",
+  stigmerToken: null,
+  cursorApiKey: "",
+  workspaceRootDir: "/tmp/test",
+  mode: "cloud",
+  proxyEndpoint: "http://localhost:7234",
+  maxConcurrentActivities: 5,
+  idleTimeoutSeconds: null,
+  cloudModeEnabled: true,
+  checkpointerType: "http",
+  checkpointerProxyEndpoint: "http://localhost:7234",
+  primaryModel: "claude-sonnet",
+  cursorStreamStallTimeoutMs: 180000,
+  workspaceLockTimeoutMs: 900000,
+};
+
+const memoryConfig: Config = {
+  ...httpConfig,
+  mode: "local",
+  proxyEndpoint: null,
+  cloudModeEnabled: false,
+  checkpointerType: "memory",
+  checkpointerProxyEndpoint: null,
+};
+
+function gatedToolCall(status: AgentExecutionStatus) {
+  return status.messages.flatMap(m => m.toolCalls).find(tc => tc.id === GATED_TOOL_CALL_ID);
+}
+
+describe("ExecuteDeepAgent — REJECT continues the execution (issue #197)", () => {
+  beforeEach(() => {
+    persistedStatuses.length = 0;
+  });
+
+  it("http checkpointer: reject denies the tool and the execution COMPLETES", async () => {
+    vi.mocked(performSetup).mockResolvedValue(fakeHttpRejectSetup());
+    const activities = createDeepAgentActivities(httpConfig);
+    await activities.ExecuteDeepAgent("exec-reject-http", "thread-reject-http");
+
+    const final = persistedStatuses.at(-1)!;
+    expect(final.phase, "rejected execution continues to COMPLETED").toBe(
+      ExecutionPhase.EXECUTION_COMPLETED,
+    );
+
+    const tc = gatedToolCall(final);
+    expect(tc, "the gated tool call is present").toBeDefined();
+    expect(
+      tc!.status,
+      "rejected tool call is terminalized (SKIPPED), never stuck at WAITING_APPROVAL",
+    ).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc!.approvalAction, "the REJECT decision is preserved for audit").toBe(
+      ApprovalAction.REJECT,
+    );
+  });
+
+  it("memory checkpointer: reject denies the tool and the execution COMPLETES", async () => {
+    vi.mocked(performSetup).mockResolvedValue(fakeMemoryRejectSetup());
+    const activities = createDeepAgentActivities(memoryConfig);
+    await activities.ExecuteDeepAgent("exec-reject-mem", "thread-reject-mem");
+
+    const final = persistedStatuses.at(-1)!;
+    expect(final.phase, "rejected execution continues to COMPLETED on memory too").toBe(
+      ExecutionPhase.EXECUTION_COMPLETED,
+    );
+
+    const tc = gatedToolCall(final);
+    expect(tc, "the gated tool call is present").toBeDefined();
+    expect(
+      tc!.status,
+      "rejected tool call is terminalized identically on memory",
+    ).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc!.approvalAction).toBe(ApprovalAction.REJECT);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/hitl.test.ts

@@ -1,13 +1,12 @@
 import { describe, it, expect } from "vitest";
 import { Command } from "@langchain/langgraph";
-import { resolveResumeInput, reconcileToolCallStatuses } from "../hitl.js";
+import { resolveResumeInput, reconcileNonExecutingDecisions } from "../hitl.js";
 import { ApprovalAction, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { create } from "@bufbuild/protobuf";
 import {
   AgentMessageSchema,
   ToolCallSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
-import type { ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
@@ -78,7 +77,6 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(false);
-    expect(result.hasRejection).toBe(false);
     expect(result.graphInput).toEqual({
       messages: [{ role: "user", content: "hello" }],
     });
@@ -105,11 +103,10 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(false);
     expect(result.graphInput).toBeInstanceOf(Command);
   });
 
-  it("detects rejection when a decision is REJECT", () => {
+  it("builds a resume Command for a REJECT decision (denies the tool, does not fail the run)", () => {
     const execution = makeExecution([{
       id: "call-1",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
@@ -120,9 +117,12 @@ describe("resolveResumeInput", () => {
 
     const result = resolveResumeInput(execution, state, "hello");
 
+    // REJECT resumes the gate like any other decision — the gate returns a
+    // denial ToolMessage and the run continues. There is no execution-level
+    // "rejection" flag any more; the terminal tool status is set by
+    // reconcileNonExecutingDecisions.
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(true);
-    expect(result.rejectionReason).toContain("Rejected by user");
+    expect(result.graphInput).toBeInstanceOf(Command);
   });
 
   it("handles multiple interrupts with mixed decisions", () => {
@@ -147,7 +147,6 @@ describe("resolveResumeInput", () => {
     const result = resolveResumeInput(execution, state, "hello");
 
     expect(result.isResumeFromApproval).toBe(true);
-    expect(result.hasRejection).toBe(false);
   });
 
   it("skips already-resumed interrupts", () => {
@@ -167,56 +166,75 @@ describe("resolveResumeInput", () => {
   });
 });
 
-describe("reconcileToolCallStatuses", () => {
-  it("updates APPROVE to RUNNING", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-1",
-      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+describe("reconcileNonExecutingDecisions", () => {
+  function statusWith(
+    toolCalls: Array<{ id: string; status: ToolCallStatus; approvalAction: ApprovalAction }>,
+  ) {
+    return create(AgentExecutionStatusSchema, {
+      messages: [
+        create(AgentMessageSchema, {
+          toolCalls: toolCalls.map(tc =>
+            create(ToolCallSchema, {
+              id: tc.id,
+              name: "test_tool",
+              status: tc.status,
+              approvalAction: tc.approvalAction,
+            }),
+          ),
+        }),
+      ],
     });
-    const toolCalls = new Map<string, ToolCall>([["call-1", tc]]);
-    const decisions = new Map([
-      ["call-1", { action: ApprovalAction.APPROVE, comment: "" }],
-    ]);
-
-    reconcileToolCallStatuses(toolCalls, decisions);
-    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_RUNNING);
-  });
+  }
 
-  it("updates SKIP to SKIPPED", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-2",
+  it("terminalizes a REJECT decision to SKIPPED with a reason (does not FAIL)", () => {
+    const status = statusWith([{
+      id: "call-reject",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
-    });
-    const toolCalls = new Map<string, ToolCall>([["call-2", tc]]);
-    const decisions = new Map([
-      ["call-2", { action: ApprovalAction.SKIP, comment: "" }],
-    ]);
+      approvalAction: ApprovalAction.REJECT,
+    }]);
+
+    reconcileNonExecutingDecisions(status);
 
-    reconcileToolCallStatuses(toolCalls, decisions);
+    const tc = status.messages[0].toolCalls[0];
     expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
+    expect(tc.error).toContain("Rejected by user");
+    // The REJECT decision is preserved so the audit trail stays honest.
+    expect(tc.approvalAction).toBe(ApprovalAction.REJECT);
   });
 
-  it("updates REJECT to FAILED with error message", () => {
-    const tc = create(ToolCallSchema, {
-      id: "call-3",
+  it("terminalizes a SKIP decision to SKIPPED (fixes the stuck-WAITING for skip too)", () => {
+    const status = statusWith([{
+      id: "call-skip",
       status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
-    });
-    const toolCalls = new Map<string, ToolCall>([["call-3", tc]]);
-    const decisions = new Map([
-      ["call-3", { action: ApprovalAction.REJECT, comment: "too risky" }],
-    ]);
+      approvalAction: ApprovalAction.SKIP,
+    }]);
 
-    reconcileToolCallStatuses(toolCalls, decisions);
-    expect(tc.status).toBe(ToolCallStatus.TOOL_CALL_FAILED);
-    expect(tc.error).toContain("too risky");
+    reconcileNonExecutingDecisions(status);
+
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_SKIPPED);
   });
 
-  it("ignores tool calls not in the map", () => {
-    const toolCalls = new Map<string, ToolCall>();
-    const decisions = new Map([
-      ["call-missing", { action: ApprovalAction.APPROVE, comment: "" }],
+  it("leaves APPROVE / APPROVE_ALL untouched (the tool executes)", () => {
+    const status = statusWith([
+      { id: "call-approve", status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL, approvalAction: ApprovalAction.APPROVE },
+      { id: "call-approve-all", status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL, approvalAction: ApprovalAction.APPROVE_ALL },
     ]);
 
-    expect(() => reconcileToolCallStatuses(toolCalls, decisions)).not.toThrow();
+    reconcileNonExecutingDecisions(status);
+
+    // Still WAITING — real tool events (not this reconciler) terminalize them.
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+    expect(status.messages[0].toolCalls[1].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
+  });
+
+  it("is a no-op when there are no decided tool calls", () => {
+    const status = statusWith([{
+      id: "call-pending",
+      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+      approvalAction: ApprovalAction.UNSPECIFIED,
+    }]);
+
+    expect(() => reconcileNonExecutingDecisions(status)).not.toThrow();
+    expect(status.messages[0].toolCalls[0].status).toBe(ToolCallStatus.TOOL_CALL_WAITING_APPROVAL);
   });
 });

package/src/activities/execute-deep-agent/environment.ts

@@ -28,9 +28,16 @@ export async function resolveEnvironment(
   client: StigmerClient,
   executionId: string,
 ): Promise<EnvironmentResult> {
+  // A desktop runner exchanges its bootstrap credential for a token scoped to
+  // this execution's session, so cloud's decrypt gate binds the read (#156).
+  // No-op for cloud sandbox and OSS runners.
+  const scopedToken = await client.acquireScopedRunnerToken({
+    agentExecutionId: executionId,
+  });
+
   let execCtx;
   try {
-    execCtx = await client.getExecutionContextByExecutionId(executionId);
+    execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
   } catch (err: unknown) {
     // ConnectError uses numeric Code.NotFound (5); match the pattern
     // from execute-cursor/env-resolver.ts.

package/src/activities/execute-deep-agent/hitl.ts

@@ -14,18 +14,20 @@
  */
 
 import { Command } from "@langchain/langgraph";
-import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import type { AgentExecution, AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   ApprovalAction,
   ToolCallStatus,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import type { ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import type { AgentMessage } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 
 // APPROVE_ALL resumes the interrupted tool exactly like APPROVE. Its
 // "auto-approve the rest of the run" effect is realized in setup.ts (the
 // approval gate is disabled for the whole execution once any APPROVE_ALL
 // decision exists), not here — this map only resolves the currently
-// interrupted tool calls.
+// interrupted tool calls. REJECT resumes the gate too (the gate returns a
+// denial ToolMessage that the model reads); it denies a single tool, it does
+// NOT fail the run — see reconcileNonExecutingDecisions for the terminal status.
 const ACTION_MAP: ReadonlyMap<ApprovalAction, string> = new Map([
   [ApprovalAction.APPROVE, "approve"],
   [ApprovalAction.APPROVE_ALL, "approve"],
@@ -36,8 +38,6 @@ const ACTION_MAP: ReadonlyMap<ApprovalAction, string> = new Map([
 export interface ResumeResult {
   readonly graphInput: Command | Record<string, unknown>;
   readonly isResumeFromApproval: boolean;
-  readonly hasRejection: boolean;
-  readonly rejectionReason: string;
 }
 
 export interface GraphStateSnapshot {
@@ -87,8 +87,6 @@ export function resolveResumeInput(
     return {
       graphInput: { messages: [{ role: "user", content: userMessage }] },
       isResumeFromApproval: false,
-      hasRejection: false,
-      rejectionReason: "",
     };
   }
 
@@ -97,14 +95,10 @@ export function resolveResumeInput(
     return {
       graphInput: { messages: [{ role: "user", content: userMessage }] },
       isResumeFromApproval: false,
-      hasRejection: false,
-      rejectionReason: "",
     };
   }
 
   const resumeDict: Record<string, { action: string; comment?: string }> = {};
-  let hasRejection = false;
-  let rejectionReason = "";
 
   for (const intr of pendingInterrupts) {
     const toolCallId = intr.toolCallId;
@@ -118,32 +112,22 @@ export function resolveResumeInput(
       action: actionStr,
       ...(decision.comment ? { comment: decision.comment } : {}),
     };
-
-    if (decision.action === ApprovalAction.REJECT) {
-      hasRejection = true;
-      rejectionReason = decision.comment || "Rejected by user";
-    }
   }
 
   if (Object.keys(resumeDict).length === 0) {
     return {
       graphInput: { messages: [{ role: "user", content: userMessage }] },
       isResumeFromApproval: false,
-      hasRejection: false,
-      rejectionReason: "",
     };
   }
 
   console.log(
-    `[hitl] Building resume for ${Object.keys(resumeDict).length} interrupt(s), ` +
-    `rejection=${hasRejection}`,
+    `[hitl] Building resume for ${Object.keys(resumeDict).length} interrupt(s)`,
   );
 
   return {
     graphInput: new Command({ resume: resumeDict }),
     isResumeFromApproval: true,
-    hasRejection,
-    rejectionReason,
   };
 }
 
@@ -207,31 +191,45 @@ function extractApprovalDecisions(
 }
 
 /**
- * Reconcile tool call statuses after resume decisions are applied.
+ * Terminalize tool calls whose approval decision is non-executing — SKIP or
+ * REJECT — so a denied or skipped call is never left stuck at WAITING_APPROVAL.
+ *
+ * This is the single, authoritative, checkpointer-independent reconciliation of
+ * the two decisions that never run the tool: their outcome is fully determined
+ * by the recorded decision (ToolCall.approval_action), not by any graph event.
+ * APPROVE / APPROVE_ALL are intentionally NOT handled here — the tool actually
+ * executes, and real tool events (v3 tool_started → tool_finished) terminalize
+ * it in place.
+ *
+ * Why a decision-derived reconciler rather than the resumed stream: on the
+ * durable path (sqlite local / http cloud) the gate returns a denial/skip
+ * ToolMessage WITHOUT an on_tool_start/on_tool_end pair, and on the memory path
+ * the graph replays without ever re-driving the gate — so in both cases the
+ * seeded WAITING_APPROVAL row is never flipped by the stream and would persist
+ * on a COMPLETED execution. Folding the recorded decision into a terminal status
+ * makes every checkpointer backend behave identically by construction.
  *
- * Updates the StatusBuilder's tool call entries to reflect the approval
- * outcomes: APPROVE → RUNNING, SKIP → SKIPPED, REJECT → FAILED.
+ * REJECT and SKIP share TOOL_CALL_SKIPPED as the terminal status (the tool did
+ * not run); they stay distinguishable by ToolCall.approval_action and by the
+ * append-only approval-event stream (REJECTED vs SKIPPED). Idempotent: a row
+ * already resolved carries the same decision and re-resolves identically.
  */
-export function reconcileToolCallStatuses(
-  toolCalls: ReadonlyMap<string, ToolCall>,
-  decisions: ReadonlyMap<string, ApprovalDecisionEntry>,
-): void {
-  for (const [toolCallId, decision] of decisions) {
-    const tc = toolCalls.get(toolCallId);
-    if (!tc) continue;
-
-    switch (decision.action) {
-      case ApprovalAction.APPROVE:
-      case ApprovalAction.APPROVE_ALL:
-        tc.status = ToolCallStatus.TOOL_CALL_RUNNING;
-        break;
-      case ApprovalAction.SKIP:
-        tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
-        break;
-      case ApprovalAction.REJECT:
-        tc.status = ToolCallStatus.TOOL_CALL_FAILED;
-        tc.error = `Rejected by user: ${decision.comment || "no reason given"}`;
-        break;
+export function reconcileNonExecutingDecisions(status: AgentExecutionStatus): void {
+  const apply = (messages: readonly AgentMessage[]): void => {
+    for (const msg of messages) {
+      for (const tc of msg.toolCalls) {
+        if (tc.approvalAction === ApprovalAction.SKIP) {
+          tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+        } else if (tc.approvalAction === ApprovalAction.REJECT) {
+          tc.status = ToolCallStatus.TOOL_CALL_SKIPPED;
+          if (!tc.error) tc.error = "Rejected by user";
+        }
+      }
     }
+  };
+
+  apply(status.messages);
+  for (const subAgent of status.subAgentExecutions) {
+    apply(subAgent.messages);
   }
 }