@bitkyc08/opencodex 2.19.0 → 2.21.0

package/src/images/loop.ts

@@ -14,8 +14,9 @@ import type { AdapterRequest, IncomingMeta, ProviderAdapter } from "../adapters/
 import { existsSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import { createAdapterEventQueue } from "../adapters/run-turn-queue";
-import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderContinuationState, OcxRequestOptions, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
+import type { AdapterEvent, OcxMessage, OcxParsedRequest, OcxProviderContinuationState, OcxProviderOpaqueToolCallMetadata, OcxRequestOptions, OcxThinkingContent, OcxUsage, RateLimitRetryPolicy } from "../types";
 import { namespacedToolName, toolChoiceToolPredicate } from "../types";
+import { cloneProviderOpaqueToolCallMetadata } from "../responses/provider-opaque-metadata";
 import type { AttemptRecoveryKind } from "../usage/log";
 import { bridgeToResponsesSSE } from "../bridge";
 import { clearableDeadline, idleDeadline } from "../lib/abort";
@@ -93,6 +94,11 @@ interface ImageCall {
   id: string;
   name: string;
   args: string;
+  /**
+   * Provider-opaque metadata from the originating part (issue #1735). Stored PER CALL: a
+   * signature belongs to one specific part, so parallel calls must not share one value.
+   */
+  providerMetadata?: OcxProviderOpaqueToolCallMetadata;
 }
 
 /**
@@ -109,13 +115,13 @@ function scanEventsForImageCall(events: AdapterEvent[], toolNames: Set<string>):
   const calls: ImageCall[] = [];
   const passthrough: AdapterEvent[] = [];
   let hasRealToolCall = false;
-  let pending: { name: string; id: string; argsBuf: string; events: AdapterEvent[] } | null = null;
+  let pending: { name: string; id: string; argsBuf: string; events: AdapterEvent[]; providerMetadata?: OcxProviderOpaqueToolCallMetadata } | null = null;
   const flushPending = (): void => {
     if (!pending) return;
     if (toolNames.has(pending.name)) {
       // Unterminated image call still carries buffered args — fulfill so malformed JSON
       // becomes a normal tool_result error instead of silently vanishing.
-      calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf });
+      calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf, providerMetadata: pending.providerMetadata });
     } else {
       passthrough.push(...pending.events);
       hasRealToolCall = true;
@@ -125,14 +131,14 @@ function scanEventsForImageCall(events: AdapterEvent[], toolNames: Set<string>):
   for (const e of events) {
     if (e.type === "tool_call_start") {
       flushPending();
-      pending = { name: e.name, id: e.id, argsBuf: "", events: [e] };
+      pending = { name: e.name, id: e.id, argsBuf: "", events: [e], providerMetadata: e.providerMetadata };
     } else if (e.type === "tool_call_delta" && pending) {
       pending.argsBuf += e.arguments;
       pending.events.push(e);
     } else if (e.type === "tool_call_end" && pending) {
       pending.events.push(e);
       if (toolNames.has(pending.name)) {
-        calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf });
+        calls.push({ id: pending.id, name: pending.name, args: pending.argsBuf, providerMetadata: pending.providerMetadata });
       } else {
         passthrough.push(...pending.events);
         hasRealToolCall = true;
@@ -247,6 +253,8 @@ export interface ImageBridgeDeps {
   stallTimeoutSec?: number;
   /** Provider-specific fetch (e.g. xAI transport wrapper). Falls back to global fetch. */
   fetchImpl?: typeof globalThis.fetch;
+  /** Reserve the routed provider's next request-start slot before each adapter dispatch. */
+  waitForRequestSlot?: (signal?: AbortSignal) => Promise<void>;
   /** Raw adapter usage at the terminal event, pre wire-normalization (see bridgeToResponsesSSE onUsage). */
   onUsage?: (usage: OcxUsage | undefined) => void;
   /**
@@ -380,6 +388,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
     // expose buildRequest/fetchResponse/parseStream to the bridge, so collect their events through
     // an AdapterEventQueue and wrap them in a pseudo-response whose parseStream replays them.
     if (adapter.runTurn) {
+      await deps.waitForRequestSlot?.(signal);
       const queue = createAdapterEventQueue({
         onBacklogExceeded: () => internalAbort.abort("runTurn backlog exceeded"),
       });
@@ -457,6 +466,11 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
     }
 
     let headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    const paceThenResetHeaderDeadline = async (): Promise<void> => {
+      headerDeadline.clear();
+      await deps.waitForRequestSlot?.(signal);
+      headerDeadline = clearableDeadline(connectTimeoutMs, signal);
+    };
     try {
       /**
        * Build and fetch one image-bridge iteration on the given adapter, under the iteration
@@ -487,6 +501,7 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
+            await paceThenResetHeaderDeadline();
             deps.onAttemptSend?.(recovery);
             response = await requestAdapter.fetchResponse(request, {
               abortSignal: headerDeadline.signal,
@@ -496,7 +511,8 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
             });
           } else {
             response = await fetchWithResetRetry(
-              (retryRecovery) => {
+              async (retryRecovery) => {
+                await paceThenResetHeaderDeadline();
                 // Record every helper-driven send (the callback runs for the first attempt and
                 // each connection-reset replay); preserve the caller's recovery kind
                 // (rate-limit-429 / key-429) when the retry layer supplies none.
@@ -861,6 +877,10 @@ export async function runWithImageBridge(deps: ImageBridgeDeps): Promise<Respons
                 id: call.id,
                 name: call.name,
                 arguments: args,
+                // Clone per call: parallel media calls each keep their own signature.
+                ...(cloneProviderOpaqueToolCallMetadata(call.providerMetadata)
+                  ? { providerMetadata: cloneProviderOpaqueToolCallMetadata(call.providerMetadata) }
+                  : {}),
               })),
             ],
             timestamp: now,

package/src/integrations/registry.ts

@@ -20,6 +20,8 @@ import {
   hermesHomeDir,
   kimiConfigPath,
   kimiHomeDir,
+  mcodeConfigPath,
+  mcodeHomeDir,
   ompAgentDir,
   ompModelsConfigPath,
   opencodeGlobalConfigPath,
@@ -112,6 +114,11 @@ export const INTEGRATION_CLIENTS: Record<IntegrationClientId, IntegrationClientS
     sourcePreservingYaml: { path: ["llm-pi-ai", "providers", "opencodex"] },
     writerLock: { suffix: ".lock" },
   },
+  mcode: {
+    id: "mcode",
+    configPath: (env = process.env, home = homedir()) => mcodeConfigPath(env, home),
+    detectDir: (env = process.env, home = homedir()) => mcodeHomeDir(env, home),
+  },
 };
 
 export const INTEGRATION_CLIENT_IDS: readonly IntegrationClientId[] =

package/src/lab/conformance/jcs.ts

@@ -1,5 +1,40 @@
 /** RFC 8785 JSON Canonicalization Scheme (JCS) for deterministic equality. */
 
+function assertValidUnicodeScalarString(value: string): void {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 0xdc00 && next <= 0xdfff)) {
+        throw new TypeError("jcsStringify: lone UTF-16 surrogate is not valid Unicode");
+      }
+      index += 1;
+      continue;
+    }
+    if (code >= 0xdc00 && code <= 0xdfff) {
+      throw new TypeError("jcsStringify: lone UTF-16 surrogate is not valid Unicode");
+    }
+  }
+}
+
+function stringifyJcsString(value: string): string {
+  assertValidUnicodeScalarString(value);
+  return JSON.stringify(value);
+}
+
+function assertDenseJsonArray(value: readonly unknown[]): void {
+  for (let index = 0; index < value.length; index += 1) {
+    if (!Object.prototype.hasOwnProperty.call(value, index)) {
+      throw new TypeError("jcsStringify: sparse arrays / array holes are not representable in JCS");
+    }
+  }
+  for (const key of Object.keys(value)) {
+    if (!/^(?:0|[1-9]\d*)$/.test(key) || Number(key) >= value.length) {
+      throw new TypeError("jcsStringify: arrays with extra enumerable properties are not representable in JCS");
+    }
+  }
+}
+
 export function jcsStringify(value: unknown): string {
   if (value === undefined) throw new TypeError("jcsStringify: undefined is not representable in JCS");
   if (value === null || typeof value === "boolean") return JSON.stringify(value);
@@ -7,14 +42,19 @@ export function jcsStringify(value: unknown): string {
     if (!Number.isFinite(value)) throw new TypeError("jcsStringify: non-finite numbers are not representable in JCS");
     return JSON.stringify(value);
   }
-  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "string") return stringifyJcsString(value);
   if (Array.isArray(value)) {
+    assertDenseJsonArray(value);
     return `[${value.map(jcsStringify).join(",")}]`;
   }
   if (typeof value === "object") {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError("jcsStringify: only plain JSON objects are representable in JCS");
+    }
     const obj = value as Record<string, unknown>;
     const keys = Object.keys(obj).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${jcsStringify(obj[k])}`).join(",")}}`;
+    return `{${keys.map((key) => `${stringifyJcsString(key)}:${jcsStringify(obj[key])}`).join(",")}}`;
   }
   throw new TypeError(`jcsStringify: unsupported value type ${typeof value}`);
 }

package/src/lab/conformance/negative-controls.ts

@@ -50,11 +50,15 @@ export const NEGATIVE_CONTROL_FIXTURES: Array<{
   },
   {
     id: "negative.tool-result-order",
-    defect: "invalid tool-result ordering",
+    defect: "invalid tool-result correlation after chat-history repair",
     mutate: (c) => ({
       ...c,
       id: "negative.tool-result-order",
-      assertions: [{ id: "result", operator: "tool_result_correlates", selector: "/upstream/requests", expected: { call: "/client/response/toolCalls/0/id", result: "/upstream/requests/1/json/messages/1/tool_call_id" }, required: true }],
+      // Chat history hardening closes the unmatched call with a synthetic result, then
+      // re-emits the orphan result behind a synthetic assistant call. Inspect the actual
+      // supplied result at the end of that repaired pair rather than the synthetic close,
+      // otherwise the negative control accidentally validates the repair and passes.
+      assertions: [{ id: "result", operator: "tool_result_correlates", selector: "/upstream/requests", expected: { call: "/client/response/toolCalls/0/id", result: "/upstream/requests/1/json/messages/3/tool_call_id" }, required: true }],
       fixture: {
         ...c.fixture,
         bytesUtf8: JSON.stringify({

package/src/lab/conformance/runner.ts

@@ -1,7 +1,7 @@
 import { discoverScenarios, loadCaseAuthority } from "./manifest";
 import { runScenario } from "./executor";
-import { buildNegativeControls } from "./negative-controls";
-import type { ScenarioRunResult } from "./types";
+import { baseCaseForNegativeControl, buildNegativeControls } from "./negative-controls";
+import type { CaseRecord, ScenarioRunResult } from "./types";
 import { CL01_SUITES } from "./types";
 
 export interface ConformanceRunSummary {
@@ -19,6 +19,8 @@ export interface NegativeControlRunSummary extends ConformanceRunSummary {
   rejected: number;
 }
 
+type ScenarioRunner = (caseRecord: CaseRecord) => Promise<ScenarioRunResult>;
+
 export async function runConformanceSuite(
   suites: readonly string[] = CL01_SUITES,
 ): Promise<ConformanceRunSummary> {
@@ -33,15 +35,24 @@ export async function runConformanceSuite(
   return { total: results.length, passed, failed: results.length - passed, results };
 }
 
-export async function runNegativeControls(): Promise<NegativeControlRunSummary> {
+export async function runNegativeControls(
+  execute: ScenarioRunner = runScenario,
+): Promise<NegativeControlRunSummary> {
   const authority = loadCaseAuthority();
   const scenarios = buildNegativeControls(discoverScenarios(authority));
   if (scenarios.length === 0) throw new Error("harness_failure: no negative controls discovered");
   const results: ScenarioRunResult[] = [];
   for (const scenario of scenarios) {
-    results.push(await runScenario(scenario));
+    const baseCase = baseCaseForNegativeControl(scenario.id, authority.cases);
+    const executionScenario = baseCase ? { ...scenario, id: baseCase.id } : scenario;
+    const result = await execute(executionScenario);
+    results.push({ ...result, scenarioId: scenario.id });
   }
-  const rejected = results.filter((r) => !r.passed).length;
+  const rejected = results.filter((r) => (
+    !r.passed
+    && r.classification === "protocol_failure"
+    && r.secondaryCode === "deterministic_assertion"
+  )).length;
   return {
     total: results.length,
     passed: rejected,

package/src/lab/fabric/observe.ts

@@ -8,11 +8,11 @@ import {
   OUTCOMES,
 } from "../constants";
 import { FAILURE_CLASSIFICATIONS } from "../conformance/types";
-import { fixtureDigest, isSha256Hex, jcsStringify } from "../digest";
+import { fixtureDigest, isSha256Hex, jcsStringify, subjectIdForSubject } from "../digest";
 import type { ObservationEvent, RouteSubjectV1, TaskSubjectV1 } from "../events/types";
 import { LabValidationError } from "../events/errors";
 import { assignEventId, validateSubject } from "../events/validate";
-import { appendLabEventIfAbsent } from "../ledger/store";
+import { withLedgerMutation } from "../ledger/store";
 import { ensureLabDirs } from "../paths";
 import {
   FABRIC_EVIDENCE_LAYER,
@@ -172,6 +172,11 @@ function validateFabricVerifier(raw: Record<string, unknown>): void {
 
 /** Validate non-negative usage counters on a producer outcome. */
 function validateFabricUsage(raw: Record<string, unknown>): void {
+  for (const key of Object.keys(raw)) {
+    if (!(USAGE_KEYS as readonly string[]).includes(key)) {
+      throw new FabricTaskError(`unknown usage field ${key}`, "malformed_producer_outcome", "harness");
+    }
+  }
   for (const key of USAGE_KEYS) {
     assertNonNegativeIntegerField(raw, key);
   }
@@ -179,6 +184,11 @@ function validateFabricUsage(raw: Record<string, unknown>): void {
 
 /** Validate non-negative limit fields on a producer outcome. */
 function validateFabricLimits(raw: Record<string, unknown>): void {
+  for (const key of Object.keys(raw)) {
+    if (!(LIMIT_KEYS as readonly string[]).includes(key)) {
+      throw new FabricTaskError(`unknown limit field ${key}`, "malformed_producer_outcome", "harness");
+    }
+  }
   for (const key of LIMIT_KEYS) {
     assertNonNegativeIntegerField(raw, key);
   }
@@ -262,12 +272,18 @@ export function assertFabricOutcomeV1(raw: unknown): FabricTaskOutcomeV1 {
   } catch (error) {
     wrapValidationError(error);
   }
+  if (jcsStringify(taskSubjectObj) !== jcsStringify(taskSubject)) {
+    throw new FabricTaskError("taskSubject contains undeclared fields", "malformed_producer_outcome", "harness");
+  }
+  if (jcsStringify(routeSubjectObj) !== jcsStringify(routeSubject)) {
+    throw new FabricTaskError("routeSubject contains undeclared fields", "malformed_producer_outcome", "harness");
+  }
   if (!routeSubjectsMatch(routeSubject, taskSubject.routeSubject)) {
     throw new FabricTaskError("contradictory route subjects", "layer_subject_mismatch", "harness");
   }
 
-  assertStringField(obj, "taskClassId");
-  assertStringField(obj, "taskClassVersion");
+  const taskClassId = assertStringField(obj, "taskClassId");
+  const taskClassVersion = assertStringField(obj, "taskClassVersion");
   const subjectId = assertStringField(obj, "subjectId");
   if (!isSha256Hex(subjectId)) {
     throw new FabricTaskError("malformed producer outcome: subjectId", "malformed_producer_outcome", "harness");
@@ -277,16 +293,36 @@ export function assertFabricOutcomeV1(raw: unknown): FabricTaskOutcomeV1 {
   if (!isSha256Hex(taskFixtureDigest) || !isSha256Hex(verifierManifestDigest)) {
     throw new FabricTaskError("malformed producer outcome: digest field", "malformed_producer_outcome", "harness");
   }
-  assertStringField(obj, "fabricCompatibilityVersion");
+  const fabricCompatibilityVersion = assertStringField(obj, "fabricCompatibilityVersion");
   const sandboxProfileDigest = assertStringField(obj, "sandboxProfileDigest");
   if (!isSha256Hex(sandboxProfileDigest)) {
     throw new FabricTaskError("malformed producer outcome: sandboxProfileDigest", "malformed_producer_outcome", "harness");
   }
-  assertIntegerField(obj, "startedAt");
-  assertIntegerField(obj, "completedAt");
+  if (subjectId !== subjectIdForSubject(taskSubject)) {
+    throw new FabricTaskError("subjectId does not match taskSubject", "malformed_producer_outcome", "harness");
+  }
+  if (
+    taskClassId !== taskSubject.taskClassId
+    || taskClassVersion !== taskSubject.taskClassVersion
+    || taskFixtureDigest !== taskSubject.taskFixtureDigest
+    || verifierManifestDigest !== taskSubject.verifierManifestDigest
+    || fabricCompatibilityVersion !== taskSubject.fabricCompatibilityVersion
+    || sandboxProfileDigest !== taskSubject.sandboxProfileDigest
+  ) {
+    throw new FabricTaskError("task identity fields do not match taskSubject", "malformed_producer_outcome", "harness");
+  }
+  const startedAt = assertNonNegativeIntegerField(obj, "startedAt");
+  const completedAt = assertNonNegativeIntegerField(obj, "completedAt");
+  if (completedAt < startedAt) {
+    throw new FabricTaskError("invalid execution timestamps", "malformed_producer_outcome", "harness");
+  }
   validateFabricLimits(assertPlainObject(obj.limits, "limits"));
   validateFabricUsage(assertPlainObject(obj.usage, "usage"));
-  validateFabricVerifier(assertPlainObject(obj.verifier, "verifier"));
+  const verifier = assertPlainObject(obj.verifier, "verifier");
+  validateFabricVerifier(verifier);
+  if (verifier.manifestDigest !== verifierManifestDigest) {
+    throw new FabricTaskError("verifier manifest digest does not match outcome", "malformed_producer_outcome", "harness");
+  }
   if (!OUTCOMES.includes(obj.outcome as typeof OUTCOMES[number])) {
     throw new FabricTaskError("malformed producer outcome: outcome", "malformed_producer_outcome", "harness");
   }
@@ -324,9 +360,6 @@ export function observationFromFabricOutcome(
   if (routeSubject.subjectKind !== "route") {
     throw new FabricTaskError("nested route subject required", "layer_subject_mismatch", "harness");
   }
-  if (!Number.isInteger(outcome.startedAt) || !Number.isInteger(outcome.completedAt) || outcome.completedAt < outcome.startedAt) {
-    throw new FabricTaskError("invalid execution timestamps", "malformed_producer_outcome", "harness");
-  }
 
   const paths = ensureLabDirs(opts.configDir);
   const ownsStore = !opts.artifactStore;
@@ -430,9 +463,11 @@ function persistFabricOutcome(
   const ownsStore = !opts.artifactStore;
   const store = opts.artifactStore ?? createArtifactStore(paths.artifactsDir);
   try {
-    const { event } = observationFromFabricOutcome(outcome, { ...opts, artifactStore: store });
-    appendLabEventIfAbsent(paths.ledgerPath, event);
-    return { event, ledgerPath: paths.ledgerPath };
+    return withLedgerMutation(paths.ledgerPath, (ledger) => {
+      const { event } = observationFromFabricOutcome(outcome, { ...opts, artifactStore: store });
+      ledger.appendIfAbsent(event);
+      return { event, ledgerPath: paths.ledgerPath };
+    });
   } finally {
     if (ownsStore) store.close();
   }

package/src/lab/index.ts

@@ -36,3 +36,19 @@ export * from "./subject/installation-salt";
 export { CL03_LIVE_SUITES } from "./conformance/types";
 export * from "./query";
 export * from "./automation";
+export * from "./public/types";
+export {
+  exportLocalPublicEvidence,
+  importCommunityEvidenceFile,
+  importCommunityEvidenceValue,
+  listCommunityEvidenceContext,
+  previewLocalPublicEvidence,
+  summarizePublicEvidenceVerification,
+  verifyPublicEvidenceFile,
+  type LocalPublicExportV1,
+  type LocalPublicPreviewV1,
+  type PublicOperatorExclusionReason,
+  type PublicOperatorExclusionV1,
+  type PublicVerificationSummaryV1,
+} from "./public/operator";
+export { PublicEvidenceValidationError } from "./public/validate";