@vellumai/assistant 0.10.5-staging.2 → 0.10.5

package/src/agent/loop.ts

@@ -4,6 +4,7 @@ import { getConfig } from "../config/loader.js";
 import { isMemoryV3Live } from "../config/memory-v3-gate.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { recordEstimate } from "../context/estimator-calibration.js";
+import { preModelCallSanitize } from "../context/outbound-sanitize.js";
 import {
   estimatePromptTokensRaw,
   estimatePromptTokensWithTools,
@@ -14,7 +15,6 @@ import { spoolAndStubOversizedToolResults } from "../context/tool-result-spool.j
 import type { ToolActivityMetadata } from "../daemon/message-types/web-activity.js";
 import { parseActualTokensFromError } from "../daemon/parse-actual-tokens-from-error.js";
 import type { TrustContext } from "../daemon/trust-context.js";
-import { stripHistoricalWebSearchResults } from "../daemon/web-search-history.js";
 import {
   timeSyncSection,
   traceAsyncSection,
@@ -2560,178 +2560,3 @@ export class AgentLoop {
     };
   }
 }
-
-/** Number of most-recent AX tree snapshots to keep in conversation history. */
-const MAX_AX_TREES_IN_HISTORY = 2;
-
-/** Regex that matches the `<ax-tree>...</ax-tree>` markers. */
-const AX_TREE_PATTERN = /<ax-tree>[\s\S]*?<\/ax-tree>/g;
-const AX_TREE_PLACEHOLDER = "<ax_tree_omitted />";
-
-/**
- * Escapes any literal `</ax-tree>` occurrences inside AX tree content so
- * that the non-greedy compaction regex (`AX_TREE_PATTERN`) does not stop
- * prematurely when the user happens to be viewing XML/HTML source that
- * contains the closing tag.  The escaped content does not need to be
- * unescaped because compaction replaces the entire block with a placeholder.
- */
-export function escapeAxTreeContent(content: string): string {
-  return content.replace(/<\/ax-tree>/gi, "&lt;/ax-tree&gt;");
-}
-
-/**
- * Returns a shallow copy of `messages` where all but the most recent
- * `MAX_AX_TREES_IN_HISTORY` `<ax-tree>` blocks have been replaced with a
- * short placeholder.  This keeps the conversation context small so that
- * TTFT does not grow linearly with step count in computer-use sessions.
- *
- * Counting is per-block, not per-message — a single user message can
- * contain multiple tool_result blocks each with their own AX tree snapshot.
- */
-export function compactAxTreeHistory(messages: Message[]): Message[] {
-  // Collect (messageIndex, blockIndex) for every tool_result block with <ax-tree>
-  const axBlocks: Array<{ msgIdx: number; blockIdx: number }> = [];
-  for (let i = 0; i < messages.length; i++) {
-    const msg = messages[i];
-    if (msg.role !== "user") continue;
-    for (let j = 0; j < msg.content.length; j++) {
-      const block = msg.content[j];
-      if (
-        block.type === "tool_result" &&
-        typeof block.content === "string" &&
-        block.content.includes("<ax-tree>")
-      ) {
-        axBlocks.push({ msgIdx: i, blockIdx: j });
-      }
-    }
-  }
-
-  if (axBlocks.length <= MAX_AX_TREES_IN_HISTORY) {
-    return messages;
-  }
-
-  // Build a set of "msgIdx:blockIdx" keys for blocks that should be stripped
-  const toStrip = new Set(
-    axBlocks
-      .slice(0, -MAX_AX_TREES_IN_HISTORY)
-      .map((b) => `${b.msgIdx}:${b.blockIdx}`),
-  );
-
-  return messages.map((msg, idx) => {
-    // Quick check: does this message have any blocks to strip?
-    const hasStripTarget = msg.content.some((_, j) =>
-      toStrip.has(`${idx}:${j}`),
-    );
-    if (!hasStripTarget) return msg;
-
-    return {
-      ...msg,
-      content: msg.content.map((block, j) => {
-        if (
-          toStrip.has(`${idx}:${j}`) &&
-          block.type === "tool_result" &&
-          typeof block.content === "string"
-        ) {
-          return {
-            ...block,
-            content: block.content.replace(
-              AX_TREE_PATTERN,
-              AX_TREE_PLACEHOLDER,
-            ),
-          };
-        }
-        return block;
-      }),
-    };
-  });
-}
-
-/**
- * Strip image contentBlocks from all tool_result blocks except those in the
- * most recent user message that contains tool_result blocks. This prevents
- * screenshots from accumulating in the context window — each image is seen
- * once by the LLM on the turn it was captured, then replaced with a text
- * placeholder on subsequent turns.
- *
- * We target the last user message with tool_results (not just the last user
- * message) because a plain-text user message may follow the tool-result
- * turn. Using the last user message unconditionally would leave the most
- * recent tool screenshots unprotected from stripping.
- */
-function stripOldMediaBlocks(history: Message[]): Message[] {
-  // Find the last user message that contains tool_result blocks.
-  let lastToolResultUserIdx = -1;
-  for (let i = history.length - 1; i >= 0; i--) {
-    if (
-      history[i].role === "user" &&
-      history[i].content.some((b) => b.type === "tool_result")
-    ) {
-      lastToolResultUserIdx = i;
-      break;
-    }
-  }
-
-  return history.map((msg, idx) => {
-    // Keep the most recent tool-result user message intact (current turn)
-    if (idx === lastToolResultUserIdx || msg.role !== "user") return msg;
-
-    // Check if any tool_result blocks carry embedded media (image or audio).
-    const isMedia = (cb: ContentBlock) =>
-      cb.type === "image" || cb.type === "file";
-    const hasMedia = msg.content.some(
-      (b) =>
-        b.type === "tool_result" &&
-        (b as ToolResultContent).contentBlocks?.some(isMedia),
-    );
-    if (!hasMedia) return msg;
-
-    // Strip media from tool_result blocks, replacing with a text marker. The
-    // model already saw/heard the media in the turn it was captured; resending
-    // the bytes every turn (a 12 MB audio clip isn't optimized like images)
-    // bloats the request until compaction.
-    return {
-      ...msg,
-      content: msg.content.map((b) => {
-        if (b.type !== "tool_result") return b;
-        const tr = b as ToolResultContent;
-        if (!tr.contentBlocks?.some(isMedia)) return b;
-        return {
-          ...tr,
-          contentBlocks: undefined,
-          content:
-            (tr.content || "") +
-            "\n[Media (image/audio) was captured and shown previously — binary data removed to save context.]",
-        };
-      }),
-    };
-  });
-}
-
-/**
- * Sanitize the outbound history immediately before a provider call, bundling
- * the pre-send transforms the loop applies to every request:
- * - {@link stripOldMediaBlocks} drops accumulated screenshot/audio bytes from
- *   older tool results — the model saw the media on the turn it was captured.
- * - {@link compactAxTreeHistory} collapses all but the most recent few
- *   `<ax-tree>` snapshots so TTFT does not grow linearly with step count.
- * - {@link stripHistoricalWebSearchResults} converts historical
- *   `web_search_tool_result` blocks to text summaries; Anthropic's opaque
- *   `encrypted_content` tokens expire / are route-scoped, and replaying a stale
- *   one is rejected with `Invalid encrypted_content in search_result block`.
- *
- * Transforms the outbound copy only — the durable history keeps the rich
- * originals and each send re-derives the sanitized projection (every transform
- * is idempotent). Because it runs unconditionally before every provider call,
- * it is the single place where oversized media and expired web-search tokens
- * are guaranteed to be removed from a request.
- *
- * This is outbound-request preparation and should eventually move to a default
- * `pre-model-call` plugin hook ({@link HOOKS.PRE_MODEL_CALL}) once that hook's
- * context carries the outbound message list; for now it lives inline next to
- * the provider call it guards.
- */
-export function preModelCallSanitize(history: Message[]): Message[] {
-  const mediaStripped = stripOldMediaBlocks(history);
-  const axCompacted = compactAxTreeHistory(mediaStripped);
-  return stripHistoricalWebSearchResults(axCompacted).messages;
-}

package/src/context/compactor.ts

@@ -22,7 +22,6 @@ import { optimizeImageForTransport } from "../agent/image-optimize.js";
 import type { CompactionConfig } from "../config/schemas/compaction.js";
 import type { LLMCallSite } from "../config/schemas/llm.js";
 import { filterMessagesForUntrustedActor } from "../daemon/message-provenance.js";
-import { stripHistoricalWebSearchResults } from "../daemon/web-search-history.js";
 import {
   getAttachmentContent,
   getAttachmentMetadataForMessage,
@@ -40,6 +39,7 @@ import type {
 import { type TrustClass } from "../runtime/actor-trust-resolver.js";
 import { resolveCapabilities } from "../runtime/capabilities.js";
 import { getLogger } from "../util/logger.js";
+import { preModelCallSanitize } from "./outbound-sanitize.js";
 import { stripInjectionsForCompaction } from "./strip-injections.js";
 import {
   estimatePromptTokens,
@@ -826,14 +826,20 @@ function extractTextFromResponse(content: ContentBlock[]): string {
     .join("\n");
 }
 
-// Build the outbound message list for a compaction provider call: convert
-// historical web_search_tool_result blocks to text, then append the
-// summarization instruction at the tail.
+// Build the outbound message list for a compaction provider call: apply the
+// same pre-send sanitization bundle as the agent loop's model calls
+// (`preModelCallSanitize` — old tool-result media stripped, AX trees
+// collapsed, historical web-search results converted to text), then append
+// the summarization instruction at the tail.
 //
-// Anthropic's opaque `encrypted_content` tokens are route-scoped and expire, so
-// replaying a stale one is rejected with `Invalid encrypted_content in
-// search_result block`. Sanitizing here — the single seam every compaction
-// provider call funnels through — keeps that error away from both the
+// Matching the loop's projection matters for two reasons. First, the summary
+// call's prefix stays byte-aligned with the agent's warm prompt cache — an
+// unsanitized history diverges from what the loop actually sent at the first
+// stripped block. Second, an unsanitized history carries every screenshot in
+// the conversation; enough images cross Anthropic's many-image threshold,
+// where a stricter per-image dimension cap applies and a single large
+// screenshot rejects the whole summary call. Sanitizing here — the single
+// seam every compaction provider call funnels through — covers both the
 // assistant-driven and emergency summarization calls. Only this outbound copy
 // is sanitized; tail resolution and the persisted compaction result read the
 // caller's original messages, so durable history keeps the rich blocks. The
@@ -842,7 +848,7 @@ function buildCompactionRequest(
   history: Message[],
   instruction: Message,
 ): Message[] {
-  return [...stripHistoricalWebSearchResults(history).messages, instruction];
+  return [...preModelCallSanitize(history), instruction];
 }
 
 // Token headroom a compaction summary call reserves on top of its history: room
@@ -945,11 +951,14 @@ export async function runAssistantDrivenCompaction(
   // Bound the summary call's own input to the context window. With no tool
   // pair to anchor an emergency split, an overflow recovery routes the full
   // history straight here, so the summary call must front-truncate itself or
-  // it overflows in turn. `args.messages` stays intact for tail resolution
-  // below — only the outbound request is truncated. A below-budget history is
-  // returned untouched, keeping the prefix aligned with the agent's warm cache.
+  // it overflows in turn. Truncation operates on the sanitized projection
+  // (what the request actually carries) so the budget estimate is honest —
+  // estimating on raw history would count media bytes the request strips.
+  // `args.messages` stays intact for tail resolution below — only the
+  // outbound request is truncated. A below-budget history is returned
+  // untouched, keeping the prefix aligned with the agent's warm cache.
   const summaryHistory = truncateHistoryToBudget({
-    messages: args.messages,
+    messages: preModelCallSanitize(args.messages),
     systemPrompt: args.systemPrompt,
     budgetTokens: compactionPrefixBudget(args.maxInputTokens),
     providerName: args.provider.tokenEstimationProvider ?? args.provider.name,
@@ -1371,9 +1380,14 @@ export async function runEmergencyCompaction(
   );
   // Bound the prefix to the context window so the summary call fits, reserving
   // budget for the instruction message and the emitted summary. Truncates from
-  // the front, keeping the recent portion the summary most needs.
+  // the front, keeping the recent portion the summary most needs. The prefix
+  // is sliced from the sanitized projection (sanitize-then-slice, matching the
+  // agent's own sends byte-for-byte for cache alignment) so the budget
+  // estimate counts what the request actually carries. All sanitize
+  // transforms are 1:1 per message, so `splitIndex` maps onto the sanitized
+  // array unchanged.
   const prefix = truncateHistoryToBudget({
-    messages: args.messages.slice(0, splitIndex),
+    messages: preModelCallSanitize(args.messages).slice(0, splitIndex),
     systemPrompt: args.systemPrompt,
     budgetTokens: compactionPrefixBudget(args.maxInputTokens),
     providerName: args.provider.tokenEstimationProvider ?? args.provider.name,

package/src/context/outbound-sanitize.ts

@@ -0,0 +1,202 @@
+/**
+ * Outbound-request history sanitization shared by every provider call that
+ * sends conversation history: the agent loop's model calls and the
+ * compactor's summary calls. Each transform derives a sanitized projection of
+ * the outbound copy only — durable history keeps the rich originals, and every
+ * transform is idempotent so each send re-derives the same projection.
+ */
+
+import { stripHistoricalWebSearchResults } from "../daemon/web-search-history.js";
+import type {
+  ContentBlock,
+  Message,
+  ToolResultContent,
+} from "../providers/types.js";
+
+/** Number of most-recent AX tree snapshots to keep in conversation history. */
+const MAX_AX_TREES_IN_HISTORY = 2;
+
+/** Regex that matches the `<ax-tree>...</ax-tree>` markers. */
+const AX_TREE_PATTERN = /<ax-tree>[\s\S]*?<\/ax-tree>/g;
+const AX_TREE_PLACEHOLDER = "<ax_tree_omitted />";
+
+/**
+ * Escapes any literal `</ax-tree>` occurrences inside AX tree content so
+ * that the non-greedy compaction regex (`AX_TREE_PATTERN`) does not stop
+ * prematurely when the user happens to be viewing XML/HTML source that
+ * contains the closing tag.  The escaped content does not need to be
+ * unescaped because compaction replaces the entire block with a placeholder.
+ */
+export function escapeAxTreeContent(content: string): string {
+  return content.replace(/<\/ax-tree>/gi, "&lt;/ax-tree&gt;");
+}
+
+/**
+ * Returns a shallow copy of `messages` where all but the most recent
+ * `MAX_AX_TREES_IN_HISTORY` `<ax-tree>` blocks have been replaced with a
+ * short placeholder.  This keeps the conversation context small so that
+ * TTFT does not grow linearly with step count in computer-use sessions.
+ *
+ * Counting is per-block, not per-message — a single user message can
+ * contain multiple tool_result blocks each with their own AX tree snapshot.
+ */
+export function compactAxTreeHistory(messages: Message[]): Message[] {
+  // Collect (messageIndex, blockIndex) for every tool_result block with <ax-tree>
+  const axBlocks: Array<{ msgIdx: number; blockIdx: number }> = [];
+  for (let i = 0; i < messages.length; i++) {
+    const msg = messages[i];
+    if (msg.role !== "user") {
+      continue;
+    }
+    for (let j = 0; j < msg.content.length; j++) {
+      const block = msg.content[j];
+      if (
+        block.type === "tool_result" &&
+        typeof block.content === "string" &&
+        block.content.includes("<ax-tree>")
+      ) {
+        axBlocks.push({ msgIdx: i, blockIdx: j });
+      }
+    }
+  }
+
+  if (axBlocks.length <= MAX_AX_TREES_IN_HISTORY) {
+    return messages;
+  }
+
+  // Build a set of "msgIdx:blockIdx" keys for blocks that should be stripped
+  const toStrip = new Set(
+    axBlocks
+      .slice(0, -MAX_AX_TREES_IN_HISTORY)
+      .map((b) => `${b.msgIdx}:${b.blockIdx}`),
+  );
+
+  return messages.map((msg, idx) => {
+    // Quick check: does this message have any blocks to strip?
+    const hasStripTarget = msg.content.some((_, j) =>
+      toStrip.has(`${idx}:${j}`),
+    );
+    if (!hasStripTarget) {
+      return msg;
+    }
+
+    return {
+      ...msg,
+      content: msg.content.map((block, j) => {
+        if (
+          toStrip.has(`${idx}:${j}`) &&
+          block.type === "tool_result" &&
+          typeof block.content === "string"
+        ) {
+          return {
+            ...block,
+            content: block.content.replace(
+              AX_TREE_PATTERN,
+              AX_TREE_PLACEHOLDER,
+            ),
+          };
+        }
+        return block;
+      }),
+    };
+  });
+}
+
+/**
+ * Strip image contentBlocks from all tool_result blocks except those in the
+ * most recent user message that contains tool_result blocks. This prevents
+ * screenshots from accumulating in the context window — each image is seen
+ * once by the LLM on the turn it was captured, then replaced with a text
+ * placeholder on subsequent turns.
+ *
+ * We target the last user message with tool_results (not just the last user
+ * message) because a plain-text user message may follow the tool-result
+ * turn. Using the last user message unconditionally would leave the most
+ * recent tool screenshots unprotected from stripping.
+ */
+function stripOldMediaBlocks(history: Message[]): Message[] {
+  // Find the last user message that contains tool_result blocks.
+  let lastToolResultUserIdx = -1;
+  for (let i = history.length - 1; i >= 0; i--) {
+    if (
+      history[i].role === "user" &&
+      history[i].content.some((b) => b.type === "tool_result")
+    ) {
+      lastToolResultUserIdx = i;
+      break;
+    }
+  }
+
+  return history.map((msg, idx) => {
+    // Keep the most recent tool-result user message intact (current turn)
+    if (idx === lastToolResultUserIdx || msg.role !== "user") {
+      return msg;
+    }
+
+    // Check if any tool_result blocks carry embedded media (image or audio).
+    const isMedia = (cb: ContentBlock) =>
+      cb.type === "image" || cb.type === "file";
+    const hasMedia = msg.content.some(
+      (b) =>
+        b.type === "tool_result" &&
+        (b as ToolResultContent).contentBlocks?.some(isMedia),
+    );
+    if (!hasMedia) {
+      return msg;
+    }
+
+    // Strip media from tool_result blocks, replacing with a text marker. The
+    // model already saw/heard the media in the turn it was captured; resending
+    // the bytes every turn (a 12 MB audio clip isn't optimized like images)
+    // bloats the request until compaction.
+    return {
+      ...msg,
+      content: msg.content.map((b) => {
+        if (b.type !== "tool_result") {
+          return b;
+        }
+        const tr = b as ToolResultContent;
+        if (!tr.contentBlocks?.some(isMedia)) {
+          return b;
+        }
+        return {
+          ...tr,
+          contentBlocks: undefined,
+          content:
+            (tr.content || "") +
+            "\n[Media (image/audio) was captured and shown previously — binary data removed to save context.]",
+        };
+      }),
+    };
+  });
+}
+
+/**
+ * Sanitize the outbound history immediately before a provider call, bundling
+ * the pre-send transforms applied to every request that carries conversation
+ * history:
+ * - {@link stripOldMediaBlocks} drops accumulated screenshot/audio bytes from
+ *   older tool results — the model saw the media on the turn it was captured.
+ *   Beyond context bloat, unstripped history can carry enough images to cross
+ *   Anthropic's many-image threshold, where a stricter per-image dimension
+ *   cap applies and a single large screenshot rejects the whole request.
+ * - {@link compactAxTreeHistory} collapses all but the most recent few
+ *   `<ax-tree>` snapshots so TTFT does not grow linearly with step count.
+ * - {@link stripHistoricalWebSearchResults} converts historical
+ *   `web_search_tool_result` blocks to text summaries; Anthropic's opaque
+ *   `encrypted_content` tokens expire / are route-scoped, and replaying a stale
+ *   one is rejected with `Invalid encrypted_content in search_result block`.
+ *
+ * Transforms the outbound copy only — the durable history keeps the rich
+ * originals and each send re-derives the sanitized projection (every transform
+ * is idempotent). Both the agent loop's model calls and the compactor's
+ * summary calls funnel through this bundle, so their request prefixes stay
+ * byte-aligned (the summary call reuses the agent's warm prompt cache) and
+ * oversized media and expired web-search tokens are guaranteed to be removed
+ * from every request.
+ */
+export function preModelCallSanitize(history: Message[]): Message[] {
+  const mediaStripped = stripOldMediaBlocks(history);
+  const axCompacted = compactAxTreeHistory(mediaStripped);
+  return stripHistoricalWebSearchResults(axCompacted).messages;
+}

package/src/daemon/handlers/shared.ts

@@ -16,6 +16,7 @@ import type { AuthContext } from "../../runtime/auth/types.js";
 import * as pendingInteractions from "../../runtime/pending-interactions.js";
 import { unwrapExternalContentForDisplay } from "../../security/untrusted-content.js";
 import { getLogger } from "../../util/logger.js";
+import { joinWithSpacing } from "../../util/text-spacing.js";
 import { estimateBase64Bytes } from "../assistant-attachments.js";
 import type { ConversationTransportMetadata } from "../message-protocol.js";
 import type { TrustContext } from "../trust-context.js";
@@ -330,29 +331,6 @@ export function renderHistoryContent(
   const contentBlocks: ConversationContentBlock[] = [];
   let currentTextBlock: { type: "text"; text: string } | null = null;
 
-  function joinWithSpacing(parts: string[]): string {
-    let result = parts[0] ?? "";
-    for (let i = 1; i < parts.length; i++) {
-      const prev = result[result.length - 1];
-      const next = parts[i][0];
-      // Only insert a space when neither side already has whitespace
-      if (
-        prev &&
-        next &&
-        prev !== " " &&
-        prev !== "\n" &&
-        prev !== "\t" &&
-        next !== " " &&
-        next !== "\n" &&
-        next !== "\t"
-      ) {
-        result += " ";
-      }
-      result += parts[i];
-    }
-    return result;
-  }
-
   function finalizeSegment(): void {
     if (hasOpenSegment) {
       const joined = joinWithSpacing(currentSegmentParts);

package/src/daemon/host-cu-proxy.ts

@@ -16,8 +16,8 @@
 
 import { v4 as uuid } from "uuid";
 
-import { escapeAxTreeContent } from "../agent/loop.js";
 import { loadConfig } from "../config/loader.js";
+import { escapeAxTreeContent } from "../context/outbound-sanitize.js";
 import type { ContentBlock } from "../providers/types.js";
 import {
   assistantEventHub,

package/src/messaging/providers/slack/send.test.ts

@@ -280,3 +280,82 @@ describe("sendSlackReply post path", () => {
     expect(callSlackApiMock).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("sendSlackReply approval fallback", () => {
+  const approval = {
+    requestId: "req-123",
+    actions: [
+      { id: "approve_once", label: "Approve once" },
+      { id: "reject", label: "Reject" },
+    ],
+    plainTextFallback: 'Reply "ABC123 approve" or "ABC123 reject"',
+  };
+  const blocks: KnownBlock[] = [
+    { type: "section", text: { type: "mrkdwn", text: "Approve tool: bash" } },
+  ];
+
+  beforeEach(() => {
+    callSlackApiMock.mockReset();
+    callSlackApiMock.mockImplementation(async () => ({ ok: true }));
+  });
+
+  test("block-free retry re-attaches plain-text reply instructions", async () => {
+    // Dropping an approval's blocks drops its buttons — the retry text must
+    // carry the reply instructions so the recipient can still act.
+    callSlackApiMock
+      .mockImplementationOnce(async () => {
+        throw new SlackApiError("invalid_blocks");
+      })
+      .mockImplementationOnce(async () => ({
+        ok: true,
+        ts: "1700000000.000400",
+      }));
+
+    const result = await sendSlackReply("C123", "Approve tool: bash", {
+      blocks,
+      approval,
+    });
+
+    expect(result).toEqual({ ok: true, ts: "1700000000.000400" });
+    expect(callSlackApiMock).toHaveBeenCalledTimes(2);
+    expect(callSlackApiMock).toHaveBeenNthCalledWith(2, "chat.postMessage", {
+      channel: "C123",
+      text: 'Approve tool: bash\n\nReply "ABC123 approve" or "ABC123 reject"',
+    });
+  });
+
+  test("retry text is unchanged when it already contains the instructions", async () => {
+    callSlackApiMock
+      .mockImplementationOnce(async () => {
+        throw new SlackApiError("msg_blocks_too_long");
+      })
+      .mockImplementationOnce(async () => ({
+        ok: true,
+        ts: "1700000000.000500",
+      }));
+
+    const text = `Approve tool: bash\n\n${approval.plainTextFallback}`;
+    await sendSlackReply("C123", text, { blocks, approval });
+
+    expect(callSlackApiMock).toHaveBeenNthCalledWith(2, "chat.postMessage", {
+      channel: "C123",
+      text,
+    });
+  });
+
+  test("approval without usable instructions is never retried bare", async () => {
+    // A block-free approval with no reply instructions gives the recipient no
+    // way to respond — fail the delivery instead so it surfaces as an error.
+    callSlackApiMock.mockImplementationOnce(async () => {
+      throw new SlackApiError("invalid_blocks");
+    });
+
+    await expect(
+      sendSlackReply("C123", "Approve tool: bash", {
+        blocks,
+        approval: { ...approval, plainTextFallback: "  " },
+      }),
+    ).rejects.toThrow();
+    expect(callSlackApiMock).toHaveBeenCalledTimes(1);
+  });
+});