@christiandoxa/prodex 0.273.0 → 0.274.0

package/README.md

@@ -494,7 +494,9 @@ Codex `multiAgentMode` is an app-server/thread setting, not a normal TUI `config
 
 `prodex mcp-server`, `prodex app-server`, and `prodex exec-server` are direct Codex command-server passthroughs by default. Prodex selects the profile `CODEX_HOME` and preserves upstream protocol arguments, but it does not wrap stdio, inject the runtime proxy, rotate accounts inside the protocol, or apply gateway guardrails to those command-server streams. A future broker mode may add JSON-RPC-aware routing behind explicit opt-in; default passthrough remains the compatibility path.
 
-`prodex app-server-broker --json` exposes the current broker-ready contract skeleton. It recognizes JSON-RPC lifecycle methods such as `initialize`, `thread/start`, `thread/resume`, `thread/fork`, `turn/start`, and `turn/cancel`, but stdio brokering is still disabled; `--experimental-stdio` fails loudly instead of corrupting protocol traffic.
+`prodex app-server-broker --json` exposes the current broker-ready contract skeleton. It recognizes JSON-RPC lifecycle methods such as `initialize`, `thread/start`, `thread/resume`, `thread/fork`, `turn/start`, and `turn/interrupt`, while still accepting compatibility aliases such as `notifications/initialized` and `turn/cancel`. The diagnostic/parser surface also matches the upstream wire behavior where `jsonrpc: "2.0"` may be omitted on the wire. The disabled-by-default contract currently advertises ordered continuation decisions as `fresh`, `continue-session`, `continue-thread`, and `continue-turn`.
+
+The broker diagnostic boundary is deliberately read-only today. It classifies newline-delimited JSON-RPC frames as `request`, `notification`, `response`, or `invalid`; bounds stdio reads and rejects preview lines over 1 MiB before JSON parsing; validates envelope shape, IDs, params, method names, and response/error payloads; derives session/thread/turn/item metadata plus ordered affinity keys; and exposes invalid-reason counters in preview reports. Its provider-switch policy helper allows fresh/open frames and requires an explicit override for session/thread/turn continuations; preview diagnostics and runtime log observe events include that per-frame provider-switch decision and redact secret-looking JSON-RPC string fields before rendering diagnostics such as `frame_id`, `request_id`, method, or metadata. `--experimental-stdio` runs that diagnostic preview over stdin/stdout, `--experimental-stdio-passthrough-preview` mirrors raw stdin to stdout and emits the same diagnostics to stderr, `--experimental-stdio-validate` emits diagnostics but exits non-zero when any frame fails JSON/protocol/lifecycle validation, and `--experimental-stdio-validate-passthrough` forwards only frames that pass validation while reporting diagnostics to stderr. Protocol validation rejects responses without a pending request id, duplicate pending request ids, pending requests left open at EOF, lifecycle frames that need thread affinity but omit `thread_id` / `threadId`, `thread/started` notifications without `params.thread.id`, valid required thread object context, or valid `thread.status.type` / `activeFlags`, `turn/start` requests missing the required `input` array, turn notifications with missing `turn.items` or missing/invalid `turn.status`, and successful lifecycle responses that omit the returned `thread.id`, `turn.id`, `turn.items`, valid thread response context (`approvalPolicy`, `approvalsReviewer`, `cwd`, `model`, `modelProvider`, `sandbox`), valid returned thread object context, valid `thread.status.type` / valid `activeFlags`, or valid `turn.status` needed for schema-aware tracking. Lifecycle validation currently catches malformed turn notification order such as `turn/completed` before `turn/started`, duplicate turn notifications, a second active turn on the same thread before the first turn completes, and `turn/interrupt` targeting a different active turn. These modes keep default Codex app-server passthrough unchanged, never route providers, and append one local `prodex audit` summary event per preview session with counts only (`component=app_server_broker`, `action=preview_session`, `outcome=observed`), including frame, continuation, policy mode, commit-boundary, rotation-window, routing-hint, provider-switch, and policy-flag count maps. Schema/replay drift fixtures for this surface live under `crates/prodex-app/tests/fixtures/compat_replay/`.
 
 Codex plugin catalog commands are managed passthrough by default:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@christiandoxa/prodex",
-  "version": "0.273.0",
+  "version": "0.274.0",
   "description": "Multi-provider Codex wrapper with OpenAI quota-aware routing and Claude Code support",
   "license": "Apache-2.0",
   "bin": {
@@ -16,12 +16,12 @@
     "@openai/codex": "latest"
   },
   "optionalDependencies": {
-    "@christiandoxa/prodex-linux-x64": "0.273.0",
-    "@christiandoxa/prodex-linux-arm64": "0.273.0",
-    "@christiandoxa/prodex-darwin-x64": "0.273.0",
-    "@christiandoxa/prodex-darwin-arm64": "0.273.0",
-    "@christiandoxa/prodex-win32-x64": "0.273.0",
-    "@christiandoxa/prodex-win32-arm64": "0.273.0",
+    "@christiandoxa/prodex-linux-x64": "0.274.0",
+    "@christiandoxa/prodex-linux-arm64": "0.274.0",
+    "@christiandoxa/prodex-darwin-x64": "0.274.0",
+    "@christiandoxa/prodex-darwin-arm64": "0.274.0",
+    "@christiandoxa/prodex-win32-x64": "0.274.0",
+    "@christiandoxa/prodex-win32-arm64": "0.274.0",
     "@openai/codex-linux-x64": "npm:@openai/codex@linux-x64",
     "@openai/codex-linux-arm64": "npm:@openai/codex@linux-arm64",
     "@openai/codex-darwin-x64": "npm:@openai/codex@darwin-x64",