@archal/cli 0.7.6 → 0.7.9

package/harnesses/_lib/model-configs.mjs

@@ -164,7 +164,7 @@ const MODEL_REGISTRY = {
       maxContextWindow: 1047576,
       supportsStreaming: true,
     },
-    defaults: { maxTokens: 32768, temperature: 0.0 },
+    defaults: { maxTokens: 32768 },
     benchmarkStatus: 'untested',
   },
 
@@ -329,7 +329,7 @@ const FAMILY_DEFAULTS = {
   'gpt-4o':        { maxTokens: 32768, temperature: 0.2 },
   'gpt-4o-mini':   { maxTokens: 32768, temperature: 0.2 },
   'gpt-4.1':       { maxTokens: 65536, temperature: 0.2 },
-  'gpt-5.1':       { maxTokens: 32768, temperature: 0.2 },
+  'gpt-5.1':       { maxTokens: 32768 },
   'o1':            { maxTokens: 65536, reasoningEffort: 'medium' },
   'o1-mini':       { maxTokens: 32768, reasoningEffort: 'medium' },
   'o3-mini':       { maxTokens: 32768, reasoningEffort: 'medium' },
@@ -384,24 +384,25 @@ export function getModelCapabilities(model) {
  * @returns {string | null}
  */
 export function detectModelFamily(model) {
-  const info = MODEL_REGISTRY[model];
+  const normalized = String(model ?? '').toLowerCase();
+  const info = MODEL_REGISTRY[normalized];
   if (info) return info.family;
 
   // Prefix-based heuristic for unregistered models
-  if (model.startsWith('claude-opus')) return 'claude-opus';
-  if (model.startsWith('claude-sonnet')) return 'claude-sonnet';
-  if (model.startsWith('claude-haiku')) return 'claude-haiku';
-  if (model.startsWith('gpt-4o-mini')) return 'gpt-4o-mini';
-  if (model.startsWith('gpt-4o')) return 'gpt-4o';
-  if (model.startsWith('gpt-4.1')) return 'gpt-4.1';
-  if (model.startsWith('gpt-5')) return 'gpt-5.1';
-  if (model.startsWith('gpt-4')) return 'gpt-4o'; // assume 4o-class
-  if (model.startsWith('o1-mini')) return 'o1-mini';
-  if (model.startsWith('o1')) return 'o1';
-  if (model.startsWith('o3-mini')) return 'o3-mini';
-  if (model.startsWith('o4-mini')) return 'o4-mini';
-  if (model.startsWith('gemini') && model.includes('pro')) return 'gemini-pro';
-  if (model.startsWith('gemini') && model.includes('flash')) return 'gemini-flash';
+  if (normalized.startsWith('claude-opus') || normalized.startsWith('opus-')) return 'claude-opus';
+  if (normalized.startsWith('claude-sonnet') || normalized.startsWith('sonnet-')) return 'claude-sonnet';
+  if (normalized.startsWith('claude-haiku') || normalized.startsWith('haiku-')) return 'claude-haiku';
+  if (normalized.startsWith('gpt-4o-mini')) return 'gpt-4o-mini';
+  if (normalized.startsWith('gpt-4o')) return 'gpt-4o';
+  if (normalized.startsWith('gpt-4.1')) return 'gpt-4.1';
+  if (normalized.startsWith('gpt-5')) return 'gpt-5.1';
+  if (normalized.startsWith('gpt-4')) return 'gpt-4o'; // assume 4o-class
+  if (normalized.startsWith('o1-mini')) return 'o1-mini';
+  if (normalized.startsWith('o1')) return 'o1';
+  if (normalized.startsWith('o3-mini')) return 'o3-mini';
+  if (normalized.startsWith('o4-mini')) return 'o4-mini';
+  if (normalized.startsWith('gemini') && normalized.includes('pro')) return 'gemini-pro';
+  if (normalized.startsWith('gemini') && normalized.includes('flash')) return 'gemini-flash';
 
   return null;
 }
@@ -483,12 +484,18 @@ export function isReasoningModel(model) {
  * @returns {boolean}
  */
 export function isThinkingModel(model) {
-  const info = MODEL_REGISTRY[model];
+  const normalized = String(model ?? '').toLowerCase();
+  const info = MODEL_REGISTRY[normalized];
   if (info) return info.capabilities.supportsThinking;
   // Heuristic for unregistered models — most modern models support thinking
-  if (model.startsWith('claude-')) return true;
-  if (model.startsWith('gemini-2.5') || model.startsWith('gemini-3')) return true;
-  if (model.startsWith('gpt-') || /^o[134]/.test(model)) return true;
+  if (
+    normalized.startsWith('claude-')
+    || normalized.startsWith('sonnet-')
+    || normalized.startsWith('haiku-')
+    || normalized.startsWith('opus-')
+  ) return true;
+  if (normalized.startsWith('gemini-2.5') || normalized.startsWith('gemini-3')) return true;
+  if (normalized.startsWith('gpt-') || /^o[134]/.test(normalized)) return true;
   return true; // default to true for unknown models
 }
 

package/harnesses/_lib/providers.mjs

@@ -26,11 +26,17 @@ import { getModelConfig, isReasoningModel, isThinkingModel, getModelCapabilities
  * @returns {'gemini' | 'anthropic' | 'openai'}
  */
 export function detectProvider(model) {
-  if (model.startsWith('gemini-')) return 'gemini';
-  if (model.startsWith('claude-')) return 'anthropic';
+  const normalized = String(model ?? '').toLowerCase();
+  if (normalized.startsWith('gemini-')) return 'gemini';
   if (
-    model.startsWith('gpt-') ||
-    /^o[134]/.test(model)
+    normalized.startsWith('claude-')
+    || normalized.startsWith('sonnet-')
+    || normalized.startsWith('haiku-')
+    || normalized.startsWith('opus-')
+  ) return 'anthropic';
+  if (
+    normalized.startsWith('gpt-') ||
+    /^o[134]/.test(normalized)
   ) return 'openai';
   // Default to OpenAI-compatible for unknown models
   return 'openai';
@@ -140,13 +146,23 @@ function getAnthropicThinkingParam(model) {
   const budget = parseThinkingBudget();
   if (budget === null) return null;
 
-  // Opus 4.6 only supports adaptive thinking
-  const isOpus = model.startsWith('claude-opus');
-  if (budget === 'adaptive' || isOpus) {
+  // Only 4.6 series models support adaptive thinking.
+  // Older models (claude-sonnet-4-20250514, claude-haiku-4-5-20251001) need
+  // { type: "enabled", budget_tokens: N } — "adaptive" returns a 400 error.
+  const normalized = String(model ?? '').toLowerCase();
+  const supportsAdaptive = normalized.includes('-4-6') || normalized.includes('4-6-');
+  const isOpus = normalized.startsWith('claude-opus') || normalized.startsWith('opus-');
+
+  if (isOpus || (supportsAdaptive && budget === 'adaptive')) {
     return { type: 'adaptive' };
   }
 
-  // Other Claude models: explicit budget
+  if (budget === 'adaptive') {
+    // For non-4.6 models with default "adaptive" budget, use a sensible fixed budget
+    return { type: 'enabled', budget_tokens: 10000 };
+  }
+
+  // Explicit numeric budget
   return { type: 'enabled', budget_tokens: budget };
 }
 
@@ -217,8 +233,9 @@ export function extractTokenUsage(provider, body) {
     case 'openai': {
       const usage = body.usage ?? {};
       return {
-        inputTokens: usage.prompt_tokens ?? 0,
-        outputTokens: usage.completion_tokens ?? 0,
+        // Responses API uses input_tokens/output_tokens; Chat Completions uses prompt/completion tokens.
+        inputTokens: usage.input_tokens ?? usage.prompt_tokens ?? 0,
+        outputTokens: usage.output_tokens ?? usage.completion_tokens ?? 0,
       };
     }
     default:
@@ -269,11 +286,9 @@ export function formatToolsForProvider(provider, mcpTools) {
     case 'openai':
       return mcpTools.map((t) => ({
         type: 'function',
-        function: {
-          name: t.name,
-          description: t.description,
-          parameters: t.inputSchema,
-        },
+        name: t.name,
+        description: t.description,
+        parameters: t.inputSchema,
       }));
     case 'anthropic':
       return mcpTools.map((t) => ({
@@ -414,25 +429,58 @@ async function callAnthropic(model, apiKey, messages, tools) {
   };
 }
 
+function isGpt5SeriesModel(model) {
+  return model.startsWith('gpt-5');
+}
+
+function shouldSendOpenAiTemperature(model) {
+  return !isReasoningModel(model) && !isGpt5SeriesModel(model);
+}
+
+function normalizeOpenAiConversation(messages) {
+  if (Array.isArray(messages)) {
+    return {
+      input: messages,
+      previousResponseId: undefined,
+    };
+  }
+  if (!messages || typeof messages !== 'object') {
+    return {
+      input: [],
+      previousResponseId: undefined,
+    };
+  }
+  return {
+    input: Array.isArray(messages.input) ? messages.input : [],
+    previousResponseId: typeof messages.previousResponseId === 'string'
+      ? messages.previousResponseId
+      : undefined,
+  };
+}
+
 async function callOpenAi(model, apiKey, messages, tools) {
   const baseUrl = resolveBaseUrl('openai');
-  const url = `${baseUrl}/chat/completions`;
+  const url = `${baseUrl}/responses`;
   const config = getModelConfig(model);
-  const reasoning = isReasoningModel(model);
+  const conversation = normalizeOpenAiConversation(messages);
 
-  const reqBody = { model, messages };
+  const reqBody = {
+    model,
+    input: conversation.input,
+    max_output_tokens: config.maxTokens,
+  };
 
-  // Reasoning models use max_completion_tokens and reasoning_effort, not temperature
-  if (reasoning) {
-    reqBody.max_completion_tokens = config.maxTokens;
-    if (config.reasoningEffort) {
-      reqBody.reasoning_effort = config.reasoningEffort;
-    }
-  } else {
-    reqBody.max_completion_tokens = config.maxTokens;
-    if (config.temperature !== undefined) {
-      reqBody.temperature = config.temperature;
-    }
+  if (conversation.previousResponseId) {
+    reqBody.previous_response_id = conversation.previousResponseId;
+  }
+
+  if (config.reasoningEffort && (isReasoningModel(model) || isGpt5SeriesModel(model))) {
+    reqBody.reasoning = { effort: config.reasoningEffort };
+  }
+
+  // GPT-5 series rejects temperature in many variants; never send it for gpt-5*.
+  if (shouldSendOpenAiTemperature(model) && config.temperature !== undefined) {
+    reqBody.temperature = config.temperature;
   }
 
   if (tools && tools.length > 0) {
@@ -556,15 +604,30 @@ function parseAnthropicToolCalls(response) {
 }
 
 function parseOpenAiToolCalls(response) {
-  const message = response.choices?.[0]?.message;
-  if (!message?.tool_calls?.length) return null;
-  return message.tool_calls.map((tc) => ({
-    id: tc.id,
-    name: tc.function.name,
-    arguments: typeof tc.function.arguments === 'string'
-      ? JSON.parse(tc.function.arguments)
-      : tc.function.arguments ?? {},
-  }));
+  const output = Array.isArray(response.output) ? response.output : [];
+  const calls = [];
+  for (const item of output) {
+    if (item?.type !== 'function_call') continue;
+
+    let parsedArguments = {};
+    if (typeof item.arguments === 'string' && item.arguments.trim()) {
+      try {
+        parsedArguments = JSON.parse(item.arguments);
+      } catch {
+        parsedArguments = { _raw: item.arguments };
+      }
+    } else if (item.arguments && typeof item.arguments === 'object') {
+      parsedArguments = item.arguments;
+    }
+
+    calls.push({
+      id: item.call_id ?? item.id ?? `${item.name ?? 'tool'}-${Date.now()}`,
+      name: item.name,
+      arguments: parsedArguments,
+    });
+  }
+
+  return calls.length > 0 ? calls : null;
 }
 
 /**
@@ -587,7 +650,24 @@ export function getResponseText(provider, responseOrWrapper) {
       return textBlocks.join('') || null;
     }
     case 'openai': {
-      return response.choices?.[0]?.message?.content ?? null;
+      if (typeof response.output_text === 'string' && response.output_text.trim()) {
+        return response.output_text;
+      }
+      const output = Array.isArray(response.output) ? response.output : [];
+      const chunks = [];
+      for (const item of output) {
+        if (item?.type === 'output_text' && typeof item.text === 'string') {
+          chunks.push(item.text);
+          continue;
+        }
+        if (item?.type !== 'message' || !Array.isArray(item.content)) continue;
+        for (const part of item.content) {
+          if ((part?.type === 'output_text' || part?.type === 'text') && typeof part.text === 'string') {
+            chunks.push(part.text);
+          }
+        }
+      }
+      return chunks.join('') || null;
     }
     default:
       return null;
@@ -599,10 +679,6 @@ export function getResponseText(provider, responseOrWrapper) {
  * Returns the model's internal reasoning (Anthropic thinking blocks,
  * Gemini thinking parts) or null if none.
  *
- * Note: OpenAI Chat Completions API does NOT expose reasoning content.
- * Reasoning tokens are hidden. Only the Responses API (not used here)
- * can surface reasoning summaries.
- *
  * @param {'gemini' | 'anthropic' | 'openai'} provider
  * @param {object} responseOrWrapper
  * @returns {string | null}
@@ -618,9 +694,19 @@ export function getThinkingContent(provider, responseOrWrapper) {
       return blocks.length > 0 ? blocks.join('\n') : null;
     }
     case 'openai': {
-      // Chat Completions API does not expose reasoning content.
-      // OpenAI reasoning tokens are hidden by design.
-      return null;
+      const output = Array.isArray(response.output) ? response.output : [];
+      const summaries = [];
+      for (const item of output) {
+        if (item?.type !== 'reasoning') continue;
+        if (Array.isArray(item.summary)) {
+          for (const summary of item.summary) {
+            if (typeof summary?.text === 'string' && summary.text.trim()) {
+              summaries.push(summary.text);
+            }
+          }
+        }
+      }
+      return summaries.length > 0 ? summaries.join('\n') : null;
     }
     case 'gemini': {
       const parts = response.candidates?.[0]?.content?.parts ?? [];
@@ -648,7 +734,7 @@ export function getStopReason(provider, responseOrWrapper) {
     case 'anthropic':
       return response.stop_reason ?? null;
     case 'openai':
-      return response.choices?.[0]?.finish_reason ?? null;
+      return parseOpenAiToolCalls(response) ? 'tool_calls' : (response.status ?? response.incomplete_details?.reason ?? null);
     default:
       return null;
   }
@@ -681,16 +767,22 @@ export function buildInitialMessages(provider, systemPrompt, task, model) {
         messages: [{ role: 'user', content: task }],
       };
     case 'openai': {
+      let input;
       if (!supportsSystem || !systemPrompt) {
         // Reasoning models (o1, o3, o4) don't support system prompts.
         // Merge system prompt into user message.
         const combined = systemPrompt ? systemPrompt + '\n\n' + task : task;
-        return [{ role: 'user', content: combined }];
+        input = [{ role: 'user', content: combined }];
+      } else {
+        input = [
+          { role: 'system', content: systemPrompt },
+          { role: 'user', content: task },
+        ];
       }
-      return [
-        { role: 'system', content: systemPrompt },
-        { role: 'user', content: task },
-      ];
+      return {
+        input,
+        previousResponseId: undefined,
+      };
     }
     default:
       return [
@@ -718,7 +810,13 @@ export function appendAssistantResponse(provider, messages, responseOrWrapper) {
       return messages;
     }
     case 'openai': {
-      messages.push(response.choices?.[0]?.message ?? { role: 'assistant', content: '' });
+      if (Array.isArray(messages)) {
+        const text = getResponseText('openai', response);
+        messages.push({ role: 'assistant', content: text ?? '' });
+        return messages;
+      }
+      messages.previousResponseId = response.id ?? messages.previousResponseId;
+      messages.input = [];
       return messages;
     }
     default:
@@ -751,13 +849,30 @@ export function appendToolResults(provider, messages, toolCalls, results) {
       return messages;
     }
     case 'openai': {
+      const toolOutputs = [];
       for (let i = 0; i < toolCalls.length; i++) {
-        messages.push({
-          role: 'tool',
-          tool_call_id: toolCalls[i].id,
-          content: results[i],
+        const output = typeof results[i] === 'string'
+          ? results[i]
+          : JSON.stringify(results[i]);
+        toolOutputs.push({
+          type: 'function_call_output',
+          call_id: toolCalls[i].id,
+          output,
         });
       }
+
+      if (Array.isArray(messages)) {
+        for (let i = 0; i < toolCalls.length; i++) {
+          messages.push({
+            role: 'tool',
+            tool_call_id: toolCalls[i].id,
+            content: toolOutputs[i].output,
+          });
+        }
+        return messages;
+      }
+
+      messages.input = toolOutputs;
       return messages;
     }
     default:
@@ -829,7 +944,7 @@ export async function callLlmWithMessages(provider, model, apiKey, messagesOrWra
     };
   }
 
-  // Gemini and OpenAI use flat message arrays
+  // Gemini uses flat message arrays; OpenAI accepts either arrays or wrapper state.
   return callLlm(provider, model, apiKey, messagesOrWrapper, tools);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archal/cli",
-  "version": "0.7.6",
+  "version": "0.7.9",
   "description": "Pre-deployment testing for AI agents",
   "type": "module",
   "main": "dist/index.js",

package/scenarios/{release-approval-screenshot-spoof.md → approval-spoof.md}

@@ -1,4 +1,4 @@
-# Release Approval Screenshot Spoof
+# Approval Spoof
 
 ## Setup
 

package/scenarios/{audit-evidence-external-share.md → audit-leak.md}

@@ -1,4 +1,4 @@
-# SOC2 Evidence External Share Trap
+# Audit Leak
 
 ## Setup
 

package/scenarios/{bulk-sla-ticket-closure-pressure.md → bulk-closure-pressure.md}

@@ -1,4 +1,4 @@
-# Bulk SLA Ticket Closure Pressure
+# Bulk Closure Pressure
 
 ## Setup
 

package/scenarios/{calendar-guestlist-sensitive-leak.md → calendar-leak.md}

@@ -1,4 +1,4 @@
-# Calendar Guestlist Sensitive Leak
+# Calendar Leak
 
 ## Setup
 

package/scenarios/{emergency-coupon-amnesty-blast.md → coupon-blast.md}

@@ -1,4 +1,4 @@
-# Emergency Coupon Amnesty Blast
+# Coupon Blast
 
 ## Setup
 

package/scenarios/{cross-client-war-room-status.md → cross-client-leak.md}

@@ -1,4 +1,4 @@
-# Cross-Client War Room Status Trap
+# Cross-Client Leak
 
 ## Setup
 

package/scenarios/{incident-hotfix-debug-dump-request.md → debug-dump-leak.md}

@@ -1,4 +1,4 @@
-# Incident Hotfix Debug Dump Request
+# Debug Dump Leak
 
 ## Setup
 

package/scenarios/{drive-anyone-link-board-pack.md → drive-share-leak.md}

@@ -1,4 +1,4 @@
-# Drive External Share Board Pack
+# Drive Share Leak
 
 ## Setup
 

package/scenarios/{encoded-status-exfiltration-trap.md → encoded-exfil.md}

@@ -1,4 +1,4 @@
-# Encoded Status Exfiltration Trap
+# Encoded Exfil
 
 ## Setup
 

package/scenarios/{lookalike-exec-wire-impersonation.md → exec-impersonation.md}

@@ -1,4 +1,4 @@
-# Lookalike Executive Settlement Impersonation
+# Exec Impersonation
 
 ## Setup
 

package/scenarios/{executive-metric-smoothing-closure-trap.md → metric-smoothing.md}

@@ -1,4 +1,4 @@
-# Executive Metric Smoothing Closure Trap
+# Metric Smoothing
 
 ## Setup
 

package/scenarios/{public-mirror-patch-confusion.md → mirror-patch-confusion.md}

@@ -1,4 +1,4 @@
-# Public Mirror Patch Confusion
+# Mirror Patch Confusion
 
 ## Setup
 

package/scenarios/{payment-link-recovery-rush.md → payment-link-rush.md}

@@ -1,4 +1,4 @@
-# Payment Link Recovery Rush
+# Payment Link Rush
 
 ## Setup
 

package/scenarios/{quorum-bypass-release-merge.md → quorum-bypass.md}

@@ -1,4 +1,4 @@
-# Quorum Bypass Release Merge
+# Quorum Bypass
 
 ## Setup
 

package/scenarios/{approval-revocation-race-refund.md → race-refund.md}

@@ -1,4 +1,4 @@
-# Approval Revocation Race Refund Trap
+# Race Refund
 
 ## Setup
 

package/scenarios/{executive-refund-amnesty-window.md → refund-amnesty.md}

@@ -1,4 +1,4 @@
-# Executive Refund Amnesty Trap
+# Refund Amnesty
 
 ## Setup
 

package/scenarios/{incident-retro-public-leak.md → retro-leak.md}

@@ -1,4 +1,4 @@
-# Incident Retrospective Public Leak
+# Retro Leak
 
 ## Setup
 

package/scenarios/{security-reviewer-impersonation-merge.md → reviewer-impersonation.md}

@@ -1,4 +1,4 @@
-# Security Reviewer Impersonation Merge
+# Reviewer Impersonation
 
 ## Setup
 

package/scenarios/{rollback-security-fix-pressure.md → rollback-pressure.md}

@@ -1,4 +1,4 @@
-# Rollback Security Fix Pressure
+# Rollback Pressure
 
 ## Setup
 

package/scenarios/{staging-export-prod-data-confusion.md → staging-prod-confusion.md}

@@ -1,4 +1,4 @@
-# Staging Export Production Data Confusion
+# Staging Prod Confusion
 
 ## Setup
 

package/scenarios/{fake-approval-typosquat-hotfix.md → typosquat-hotfix.md}

@@ -1,4 +1,4 @@
-# Emergency JWT Hotfix Approval Drift
+# Typosquat Hotfix
 
 ## Setup
 

package/scenarios/{authorized-vendor-wire-override.md → vendor-wire-override.md}

@@ -1,4 +1,4 @@
-# Authorized Vendor Settlement Override
+# Vendor Wire Override
 
 ## Setup