@stigmer/runner 3.15.1 → 3.15.2-dev.20260913223433

package/src/__test-utils__/harness-contract/types.ts

@@ -56,16 +56,25 @@ import type { TurnInputFixtureOverrides } from "../turn-input-fixture.js";
  *    ends `failed` on the given surface (`engine` unless the scenario says
  *    otherwise — the runtime's three failure copies are its own invariant).
  *  - `cancelled`: the engine ends its own run cancelled with nothing to
- *    wait for (an SDK-side cancel); the turn ends `cancelled`.
+ *    wait for (an SDK-side cancel); the turn ends `cancelled`. Not every
+ *    engine can end itself (a LangGraph run is stopped only by the runtime's
+ *    signal and settles `interrupted`), so a subject that cannot produce it
+ *    says so and the runtime arm is reported SKIPPED there.
+ *  - `limit`: the engine exhausts the tool-round budget the execution set and
+ *    stops at a step boundary with its work checkpointed; the turn ends
+ *    `tool_call_limit`. Not every engine has such a budget (Cursor's SDK does
+ *    not), so a subject that cannot produce it says so and the runtime arm
+ *    is reported SKIPPED there.
  */
 export type ScenarioStep =
   | { readonly kind: "say"; readonly text: string }
-  | { readonly kind: "propose"; readonly toolCallId: string; readonly action: ProposedAction }
+  | { readonly kind: "propose"; readonly toolCallId: string; readonly action: ProposedAction; readonly flows?: boolean }
   | { readonly kind: "read"; readonly toolCallId: string; readonly path: string }
   | { readonly kind: "usage"; readonly delta: UsageDelta }
   | { readonly kind: "hang" }
   | { readonly kind: "fail"; readonly message: string; readonly surface: FailureSurface }
-  | { readonly kind: "cancelled" };
+  | { readonly kind: "cancelled" }
+  | { readonly kind: "limit" };
 
 /** One turn's worth of engine behaviour. */
 export type TurnScenario = readonly ScenarioStep[];
@@ -78,6 +87,18 @@ export const scenario = {
   propose(toolCallId: string, action: ProposedAction): ScenarioStep {
     return { kind: "propose", toolCallId, action };
   },
+  /**
+   * A `write` the arm EXPECTS to flow under apply-then-review capture (a git
+   * work tree, or artifact storage): the engine performs it at once, the row
+   * completes, and the RUNTIME captures it for review after the turn
+   * (`harness/capture.ts`). The arm states the posture rather than the
+   * subject inferring it, so a subject that gates a flowing write is caught,
+   * not accommodated. The bytes written are the engine's own; the arm
+   * asserts the captured PATH and the reconcile's effect, never the content.
+   */
+  flowingWrite(toolCallId: string, path: string): ScenarioStep {
+    return { kind: "propose", toolCallId, action: { kind: "write", resource: path }, flows: true };
+  },
   read(toolCallId: string, path: string): ScenarioStep {
     return { kind: "read", toolCallId, path };
   },
@@ -93,6 +114,9 @@ export const scenario = {
   cancelled(): ScenarioStep {
     return { kind: "cancelled" };
   },
+  limit(): ScenarioStep {
+    return { kind: "limit" };
+  },
 } as const;
 
 /**

package/src/__test-utils__/hermetic-activity.ts

@@ -7,11 +7,15 @@
  * are the wire contract the control plane's workflow keys on — the phases they
  * persist, the copy they write, whether they RETURN a slim status or THROW
  * `CancelledFailure`. Refactoring them safely needs goldens recorded through the
- * activity whole, not through its modules one at a time. The native harness
- * tests already run their activity hermetically by mocking three modules at the
- * boundary (`execute-deep-agent/__tests__/{index,hitl-*,sequential-gate-resume}.test.ts`);
- * this module is that convention made reusable, harness-agnostic, and driven by
- * the framework's own activity environment instead of a hand-written stand-in.
+ * activity whole, not through its modules one at a time. The native harness's
+ * earlier activity tests ran their activity hermetically by mocking three
+ * modules at the boundary with a hand-written `Context` stand-in and a scripted
+ * graph object; this module is that convention made reusable, harness-agnostic,
+ * and driven by the framework's own activity environment. Both harnesses now
+ * run on it (`execute-cursor/__test-utils__/hermetic-cursor.ts`,
+ * `execute-deep-agent/__test-utils__/hermetic-deep-agent.ts`), and the earlier
+ * native tests were re-homed onto the native driver (S3 M0), their assertions
+ * carried into `execute-deep-agent/__tests__/hermetic/`.
  *
  * What is generic here and what is not: everything an activity touches that is
  * NOT the vendor SDK — the Temporal `Context`, the control-plane client, the
@@ -92,6 +96,7 @@ import {
   signalWorkerShutdown,
   unregisterWorkerShutdownSignal,
 } from "../shared/worker-shutdown.js";
+import { decideCapturedFileChanges, type FileReviewVerdicts } from "./file-review-projection.js";
 import { mockStigmerClient } from "./mock-client.js";
 
 // ---------------------------------------------------------------------------
@@ -221,6 +226,19 @@ export class ExecutionRecord {
     return waiting.length;
   }
 
+  /**
+   * What the server's `SubmitFileDecision` and its projection do between
+   * invocations: every change of every AWAITING_REVIEW set the runner captured
+   * gets a per-file verdict, and `status.file_change_sets` is re-folded from
+   * the ledger (`file-review-projection.ts` mirrors the server's fold). The
+   * runner authors the ledger; the server owns the sets — so this is the ONE
+   * place a test writes them. Returns how many decisions were written.
+   */
+  decideCapturedFileChanges(verdicts: FileReviewVerdicts, decidedAt: string): number {
+    if (!this.execution.status) throw new Error("ExecutionRecord: no status to decide file changes on (test bug)");
+    return decideCapturedFileChanges(this.execution.status, verdicts, decidedAt);
+  }
+
   /**
    * Apply one `UpdateStatus` write and answer the control signal the server
    * would. A setup-progress report never carries a signal (the runner ignores
@@ -389,12 +407,30 @@ export function createHermeticEnvironment(): HermeticEnvironment {
 // ---------------------------------------------------------------------------
 
 /**
- * A deterministic, TICKING `Date`. Only `Date` is faked; timers stay real (the
- * periodic heartbeat, the stall watchdog, `withTimeout` all need them). The
- * harness double calls {@link ScriptedClock.tick} once per script step, so
- * every `Date.now()`-based decision on the activity path (status timestamps,
- * the enricher's persist debounce, cache TTLs) sees the same instants run after
- * run and runs the same branches production runs.
+ * A deterministic, TICKING clock: `Date` AND `performance` are faked and
+ * advance together; timers stay real (the periodic heartbeat, the stall
+ * watchdog, `withTimeout` all need them). The harness double calls
+ * {@link ScriptedClock.tick} once per script step, so every clock-based
+ * decision on the activity path — status timestamps, the enricher's persist
+ * debounce, cache TTLs (`Date`); the streaming scheduler's persist cadence
+ * (`performance.now()`) — sees the same instants run after run and runs the
+ * same branches production runs.
+ *
+ * Why both (S3 M5, Q-M5-7; F-M2a-20): until M5 only `Date` was faked, so the
+ * scheduler paced persists on REAL elapsed time and `fileChangeProgress`,
+ * which rides persists, could gain or lose a capture under load — a golden
+ * flake seen twice across S3. One clock, two faces: `tick` advances through
+ * the fake clock's own `tick` (`vi.advanceTimersByTime`), which moves both
+ * `Date` and `performance.now()`; `vi.setSystemTime` would move `Date` alone
+ * (fake-timers keeps `performance` monotonic across a system-time jump), so
+ * only {@link reset} uses it — rewinding `Date` to the epoch for a second
+ * scenario while `performance` stays monotonic, which is harmless because
+ * every turn constructs its scheduler fresh and measures from its own start.
+ *
+ * Faking `performance` replaces the whole global (`now`, a `timeOrigin` at
+ * the epoch, every other method a no-op); nothing on the activity path reads
+ * more than `now`, and a module importing from `node:perf_hooks` would bypass
+ * the fake (none under `src/` does).
  */
 export class ScriptedClock {
   /** A fixed epoch: 2026-01-01T00:00:00.000Z. Chosen for readability in goldens. */
@@ -405,15 +441,17 @@ export class ScriptedClock {
   private nowMs = ScriptedClock.EPOCH_MS;
 
   install(): void {
-    vi.useFakeTimers({ toFake: ["Date"], now: this.nowMs });
+    vi.useFakeTimers({ toFake: ["Date", "performance"], now: this.nowMs });
   }
 
   tick(ms: number = ScriptedClock.STEP_MS): void {
     this.nowMs += ms;
-    vi.setSystemTime(this.nowMs);
+    // Through the fake clock's own tick, so `performance.now()` advances with
+    // `Date`; with no timers faked there is nothing for it to fire.
+    vi.advanceTimersByTime(ms);
   }
 
-  /** Back to the epoch — for a second scenario in the same file. */
+  /** Back to the epoch — for a second scenario in the same file. `Date` rewinds; `performance` stays monotonic (see the header). */
   reset(): void {
     this.nowMs = ScriptedClock.EPOCH_MS;
     vi.setSystemTime(this.nowMs);

package/src/__test-utils__/model-registry-fixture.ts

@@ -10,19 +10,29 @@
  * registry document — and to THROW for any other URL, so a new network
  * dependency on the activity path fails the run instead of leaking.
  *
- * One entry, `composer-2.5`, priced at round numbers so a golden's
- * `estimatedCostUsd` is legible (600 000 input tokens = $0.60). The entry is
- * a Cursor-harness model because that is what the registry lists; the
- * document itself is the control plane's, read by every harness's runtime.
- * `parsePricingTable` wants `harness: "cursor"` + `pricing`; `parseRegistry`
- * wants `id` + `provider` and reads `capabilities.vision`.
+ * One entry per harness, each priced at round numbers so a golden's usage and
+ * cost are legible (600 000 input tokens = $0.60). `composer-2.5` is the
+ * Cursor harness's pinned model (also in the Cursor double's catalog);
+ * `claude-haiku-4.5` is the native harness's, an Anthropic id so the native
+ * error arms' provider label (`tryInferProvider`) and the thinking heuristic
+ * read as they do in production. The document itself is the control plane's,
+ * read by every harness's runtime: `parsePricingTable` keeps every entry with
+ * `pricing`; `parseRegistry` wants `id` + `provider` and reads
+ * `capabilities.vision`; `getDefaultModel` selects only `harness: "native"`.
+ * Every fixture NAMES its model on the execution, so the list's order is
+ * never consulted and adding an entry is byte-invisible to the other
+ * harness's goldens (verified when the native entry landed: Cursor's
+ * seventeen unchanged).
  */
 
 import { vi } from "vitest";
 
-/** The pinned model of every hermetic run; in the registry document AND in the Cursor double's catalog. */
+/** The pinned model of every Cursor hermetic run; in the registry document AND in the Cursor double's catalog. */
 export const FIXTURE_MODEL = "composer-2.5";
 
+/** The pinned model of every native (deep-agent) hermetic run. */
+export const FIXTURE_NATIVE_MODEL = "claude-haiku-4.5";
+
 export const REGISTRY_DOCUMENT = {
   models: [
     {
@@ -48,6 +58,21 @@ export const REGISTRY_DOCUMENT = {
         },
       },
     },
+    {
+      id: FIXTURE_NATIVE_MODEL,
+      displayName: "Claude Haiku 4.5 (hermetic fixture)",
+      provider: "anthropic",
+      harness: "native",
+      costTier: "standard",
+      featured: true,
+      capabilities: { vision: true },
+      pricing: {
+        inputPricePerMillion: 1.0,
+        outputPricePerMillion: 5.0,
+        cacheWritePricePerMillion: 1.25,
+        cacheReadPricePerMillion: 0.1,
+      },
+    },
   ],
 } as const;
 

package/src/__test-utils__/module-specifiers.ts

@@ -42,6 +42,30 @@ export function moduleSpecifiers(fileName: string, source: string): string[] {
   return specifiers;
 }
 
+/**
+ * The module specifiers a file LOADS when it is itself loaded: static
+ * imports and re-exports that are not type-only. A `import type` is erased
+ * by the compiler and a dynamic `import()` runs only when its call runs, so
+ * neither is on the static graph — which is what the SDK-free fences on the
+ * adapters' lifecycle modules ask about (`harness-adapters.ts`'s rule: the
+ * roots import the table before they boot it, so an adapter loads its SDK
+ * inside `boot`, never at the top of its module).
+ */
+export function staticRuntimeSpecifiers(fileName: string, source: string): string[] {
+  const sourceFile = ts.createSourceFile(fileName, source, ts.ScriptTarget.Latest, /* setParentNodes */ false);
+  const specifiers: string[] = [];
+  for (const statement of sourceFile.statements) {
+    if (ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier)) {
+      if (statement.importClause?.isTypeOnly) continue;
+      specifiers.push(statement.moduleSpecifier.text);
+    } else if (ts.isExportDeclaration(statement) && statement.moduleSpecifier !== undefined && ts.isStringLiteral(statement.moduleSpecifier)) {
+      if (statement.isTypeOnly) continue;
+      specifiers.push(statement.moduleSpecifier.text);
+    }
+  }
+  return specifiers;
+}
+
 /**
  * The relative specifiers in `source` that resolve to a path inside
  * `forbiddenRoot`. Package specifiers are ignored: no alias maps a package

package/src/__test-utils__/turn-input-fixture.ts

@@ -58,7 +58,7 @@ export interface TurnInputFixtureOverrides extends Partial<Omit<TurnInput, "exec
    * The status the default execution carries — what the control plane
    * persisted at the end of the previous invocation, on a reinvocation. The
    * runtime seeds the turn's in-progress status from a clone of it
-   * (`seedTranscriptFromExecution`) and an adapter may read the record's own
+   * (`seedFromPersistedStatus`) and an adapter may read the record's own
    * copy for its facts, so a test standing in for the runtime hands both.
    */
   readonly persistedStatus?: AgentExecutionStatus;
@@ -137,7 +137,7 @@ export function turnInputFixture(overrides: TurnInputFixtureOverrides = {}): Tur
       leases: { global: false, categories: new Set(), servers: new Set() },
       policies: new Map(),
     },
-    skills: overrides.skills ?? [],
+    skills: overrides.skills ?? { root: [], bySubAgent: new Map() },
     attachments: overrides.attachments ?? { results: [], visionImages: [], visionNotViewable: [] },
     appliedToolCallIds: overrides.appliedToolCallIds ?? new Set(),
     model: overrides.model ?? { requested: "default", serviceTier: ServiceTier.STANDARD, thinkingMode: ThinkingMode.DISABLED },

package/src/__tests__/harness-boot-order.test.ts

@@ -20,9 +20,16 @@
  * `adapter.ts`'s graph, or a static client import on the registry's, fails
  * the first arm; a `boot` that stopped asserting fails the second.
  *
+ * The table has two rows since S3 M2b (2026-09-13): the child boots the
+ * Cursor adapter and then the native deep-agent adapter, whose `boot`
+ * registers the deepagents profiles and loads LangChain — after the patch,
+ * because it is the second row. A `boot` that reordered the rows, or a
+ * native adapter that imported its engine statically, would move that load
+ * before the patch; the first arm below is where that would show.
+ *
  * `HOME` points at a temp dir so an SDK import-time side effect cannot touch
  * the developer's home; the proxy endpoint is an inert loopback; nothing is
- * dialled. Two spawns, a few seconds: the SDK is imported for real once.
+ * dialled. Two spawns, a few seconds: both SDKs are imported for real once.
  */
 
 import { describe, it, expect } from "vitest";
@@ -63,7 +70,7 @@ function lastLine(text: string): string {
 }
 
 describe("harness boot order (fresh process)", () => {
-  it("booting the harnesses on a proxy-mode config, the way the roots do, installs the interceptors, patches the facade, and loads the SDK", async () => {
+  it("booting both harnesses on a proxy-mode config, the way the roots do, installs the interceptors, patches the facade, and loads both engines after it", async () => {
     const verdict = await runChild("boot");
     expect(verdict.line, "the child's verdict").toBe("harness-boot-order: ok");
     expect(verdict.exitCode).toBe(0);

package/src/activities/call-agent.ts

@@ -225,8 +225,8 @@ export async function callAgentAction(
   // Honest RunConfig → ExecutionConfig mapping (issue #358): every field
   // the author may set is forwarded to a field the runner enforces.
   // model_name replaces the agent's default outright; max_cost_usd feeds
-  // the harness-generic cost guards (cost-cap middleware / cursor
-  // cost-guard); max_tool_rounds feeds resolveRecursionLimit (native
+  // the turn runtime's cost guard (shared/cost-guard.ts, both harnesses);
+  // max_tool_rounds feeds resolveRecursionLimit (native
   // harness only); service_tier and thinking_mode feed the cursor
   // harness's explicit variant selection (issues #357/#772). Zero/unset
   // means "no override" and is omitted.

package/src/activities/execute-cursor/__test-utils__/contract-subject.ts

@@ -79,8 +79,8 @@
  * would show up there AND in `executionCount`, never be papered over.
  */
 
-import { mkdirSync } from "node:fs";
-import { join } from "node:path";
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { ApprovalAction, ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
 import type { Config } from "../../../config.js";
@@ -237,7 +237,11 @@ class CursorSubject implements CursorContractSubject {
           lastSay = s.text;
           break;
         case "propose":
-          script.push(...this.proposeSteps(s.toolCallId, s.action, view, ev));
+          script.push(
+            ...(s.flows
+              ? this.flowingWriteSteps(s.toolCallId, s.action, view, ev)
+              : this.proposeSteps(s.toolCallId, s.action, view, ev)),
+          );
           break;
         case "read":
           script.push(...this.readSteps(s.toolCallId, s.path, view, ev));
@@ -281,6 +285,8 @@ class CursorSubject implements CursorContractSubject {
           script.push(step.effect("kit: the SDK cancels its own run", ({ run }) => run.cancel()));
           ended = true;
           break;
+        case "limit":
+          throw new Error(`${this.name}: limit() is not producible by this subject (the Cursor SDK has no tool-round budget; the runtime arm is declared off for it); test bug`);
         default: {
           const exhaustive: never = s;
           throw new Error(`${this.name}: unknown scenario step ${JSON.stringify(exhaustive)}`);
@@ -352,6 +358,44 @@ class CursorSubject implements CursorContractSubject {
     ];
   }
 
+  /**
+   * A write the arm expects to FLOW under apply-then-review capture: the
+   * stream tool call, the REAL hook (which allows a git-capturable write in
+   * capture mode — asserted through the disagreement record like every other
+   * hook answer), the write itself as the SDK would perform it once allowed
+   * (the bytes are this double's own: the tool-call id, one line, appended),
+   * and the completion. The runtime captures the change after the turn; the
+   * hook's sidecar is what this adapter binds as its CAS observations, so a
+   * gitignored path here would reach the review that way.
+   */
+  private flowingWriteSteps(toolCallId: string, action: ProposedAction, view: EngineView, ev: ReturnType<typeof sdkEvents>): ScriptStep[] {
+    if (action.kind !== "write") {
+      throw new Error(`${this.name}: only a write flows under capture (got ${action.kind}); test bug`);
+    }
+    const memory = this.proposals.get(toolCallId) ?? { emitted: 0, allowed: 0 };
+    this.proposals.set(toolCallId, memory);
+    if (memory.allowed > 0) return [];
+    memory.emitted += 1;
+    const gated: ProposedAction & { kind: GatedActionKind } = { ...action, kind: "write" };
+    const args = streamArgsFor(gated);
+    const workspaceRoot = this.workspaceRootOf(view.sessionId);
+    const file = join(workspaceRoot, action.resource);
+    return [
+      step.event(ev.toolCall(toolCallId, STREAM_NAME.write, "running", args)),
+      step.effect(`kit: the real hook lets ${action.resource} flow under capture`, () => {
+        const { permission } = runWorkspaceHook(workspaceRoot, hookInputFor(gated));
+        if (permission !== "allow") {
+          this.hookDisagreements.push(`${toolCallId}: expected a flowing write to be allowed, hook answered ${permission}`);
+          return;
+        }
+        memory.allowed += 1;
+        mkdirSync(dirname(file), { recursive: true });
+        appendFileSync(file, `${toolCallId}\n`);
+      }),
+      step.event(ev.toolCall(toolCallId, STREAM_NAME.write, "completed", args, ALLOWED_RESULT)),
+    ];
+  }
+
   /**
    * An ungated read: the stream tool call, the REAL hook (which allows every
    * read — the gate's baked-in category set has no arm for it; asserted

package/src/activities/execute-cursor/__test-utils__/hermetic-cursor.ts

@@ -42,16 +42,9 @@
  */
 
 import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { create } from "@bufbuild/protobuf";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
 import type { ModelListItem } from "@cursor/sdk";
-import {
-  LocalPathSourceSchema,
-  WorkspaceEntrySchema,
-  WorkspaceSourceSchema,
-  type WorkspaceEntry,
-} from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import type { StigmerClient } from "../../../client/stigmer-client.js";
 import type { Config } from "../../../config.js";
 import type { ExecuteActivityInput } from "../../../shared/activity-input.js";
@@ -203,45 +196,6 @@ export function runWorkspaceHook(
   return { permission, raw };
 }
 
-/**
- * A git work tree with one committed file, for the file-review capture
- * scenario. Author, committer and both dates are pinned so the commit AND tree
- * object ids are byte-stable — a file-review golden may carry them.
- */
-export function initGitWorkspace(root: string, files: Record<string, string>): void {
-  mkdirSync(root, { recursive: true });
-  const gitEnv = {
-    ...process.env,
-    GIT_AUTHOR_NAME: "hermetic",
-    GIT_AUTHOR_EMAIL: "hermetic@stigmer.test",
-    GIT_COMMITTER_NAME: "hermetic",
-    GIT_COMMITTER_EMAIL: "hermetic@stigmer.test",
-    GIT_AUTHOR_DATE: "2026-01-01T00:00:00Z",
-    GIT_COMMITTER_DATE: "2026-01-01T00:00:00Z",
-  };
-  const git = (args: string[]): void => {
-    execFileSync("git", args, { cwd: root, env: gitEnv, stdio: "ignore" });
-  };
-  git(["init", "-q", "-b", "main"]);
-  for (const [rel, content] of Object.entries(files)) {
-    const abs = join(root, rel);
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, content, "utf-8");
-  }
-  git(["add", "-A"]);
-  git(["commit", "-q", "-m", "initial"]);
-}
-
-/** A session workspace entry mounting an absolute local path (local mode only). */
-export function localPathEntry(name: string, path: string): WorkspaceEntry {
-  return create(WorkspaceEntrySchema, {
-    name,
-    source: create(WorkspaceSourceSchema, {
-      source: { case: "localPath", value: create(LocalPathSourceSchema, { path }) },
-    }),
-  });
-}
-
 // ---------------------------------------------------------------------------
 // Running a scenario
 // ---------------------------------------------------------------------------

package/src/activities/execute-cursor/__tests__/approval-decisions-agree.test.ts

@@ -20,7 +20,7 @@ import { AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/a
 import { AgentMessageSchema, ToolCallSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { ApprovalAction, MessageType, ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 
-import { approvalDecisionsOf } from "../../../harness/turn-context.js";
+import { approvalDecisionsOf } from "../../../harness/approval-decisions.js";
 import { reconstructAdjudicatedApprovals } from "../approval-state.js";
 
 describe("the runtime's approvalDecisionsOf and the adapter's reconstructAdjudicatedApprovals", () => {

package/src/activities/execute-cursor/__tests__/approval-gate.test.ts

@@ -260,15 +260,17 @@ describe("buildApprovalState", () => {
 });
 
 describe("buildReinvocationPrompt", () => {
-  it("describes approved and skipped actions in human terms, not opaque ids", () => {
+  it("describes approved, skipped and rejected actions in human terms, not opaque ids", () => {
     const prompt = buildReinvocationPrompt(
       [
         pending({ toolCallId: "c1", toolName: "edit", message: "Write file: gated.txt" }),
         pending({ toolCallId: "c2", toolName: "shell", message: "Run command: rm -rf build" }),
+        pending({ toolCallId: "c3", toolName: "shell", message: "Run command: git push --force" }),
       ],
       new Map([
         ["c1", ApprovalAction.APPROVE],
         ["c2", ApprovalAction.SKIP],
+        ["c3", ApprovalAction.REJECT],
       ]),
     );
 
@@ -276,8 +278,11 @@ describe("buildReinvocationPrompt", () => {
     expect(prompt).toContain("Write file: gated.txt");
     expect(prompt).toContain("SKIPPED");
     expect(prompt).toContain("Run command: rm -rf build");
+    expect(prompt).toContain("REJECTED");
+    expect(prompt).toContain("Run command: git push --force");
     expect(prompt).not.toContain("c1");
     expect(prompt).not.toContain("c2");
+    expect(prompt).not.toContain("c3");
   });
 
   it("falls back to tool name + args preview when no message is set", () => {