@copilotkit/aimock 1.41.0 → 1.42.0

package/dist/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":[],"sources":["../src/search.ts"],"sourcesContent":["/**\n * Web Search API support for LLMock.\n *\n * Handles POST /search requests (Tavily-compatible). Matches fixtures by\n * comparing the request `query` field against registered patterns. First\n * match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport { flattenHeaders, matchesPattern } from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Search types ─────────────────────────────────────────────────────────\n\nexport interface SearchResult {\n  title: string;\n  url: string;\n  content: string;\n  score?: number;\n}\n\nexport interface SearchFixture {\n  match: string | RegExp;\n  results: SearchResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleSearch(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: SearchFixture[],\n  journal: Journal,\n  defaults: { logger: Logger },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: string; max_results?: number };\n  try {\n    body = JSON.parse(raw) as { query?: string; max_results?: number };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/search\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"search\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const query = body.query ?? \"\";\n  const maxResults = body.max_results;\n\n  // Find first matching fixture\n  let matchedResults: SearchResult[] = [];\n  let matchedFixture: SearchFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Search fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No search fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Apply max_results limit\n  if (maxResults !== undefined && maxResults > 0) {\n    matchedResults = matchedResults.slice(0, maxResults);\n  }\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/search\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"search\",\n    response: { status: 200, fixture: null },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      query,\n      results: matchedResults,\n      images: [],\n      response_time: 0,\n      answer: null,\n    }),\n  );\n}\n"],"mappings":";;;AA6BA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAGF,MAAM,QAAQ,KAAK,SAAS;CAC5B,MAAM,aAAa,KAAK;CAGxB,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAI,eAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;AAI/F,KAAI,eAAe,UAAa,aAAa,EAC3C,kBAAiB,eAAe,MAAM,GAAG,WAAW;AAGtD,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAAS,eAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GAAE,QAAQ;GAAK,SAAS;GAAM;EACzC,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb;EACA,SAAS;EACT,QAAQ,EAAE;EACV,eAAe;EACf,QAAQ;EACT,CAAC,CACH"}
+{"version":3,"file":"search.js","names":[],"sources":["../src/search.ts"],"sourcesContent":["/**\n * Web Search API support for LLMock.\n *\n * Handles POST /search requests (Tavily-compatible). Matches fixtures by\n * comparing the request `query` field against registered patterns. First\n * match wins; no match returns empty results.\n */\n\nimport type * as http from \"node:http\";\nimport {\n  flattenHeaders,\n  isJsonObject,\n  matchesPattern,\n  normalizeTextInput,\n  resolveStrictMode,\n  strictNoMatchLogLine,\n  strictNoMatchMessage,\n  strictOverrideField,\n} from \"./helpers.js\";\nimport type { Journal } from \"./journal.js\";\nimport type { Logger } from \"./logger.js\";\n\n// ─── Search types ─────────────────────────────────────────────────────────\n\nexport interface SearchResult {\n  title: string;\n  url: string;\n  content: string;\n  score?: number;\n}\n\nexport interface SearchFixture {\n  match: string | RegExp;\n  results: SearchResult[];\n}\n\n// ─── Request handler ──────────────────────────────────────────────────────\n\nexport async function handleSearch(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  raw: string,\n  fixtures: SearchFixture[],\n  journal: Journal,\n  defaults: { logger: Logger; strict?: boolean },\n  setCorsHeaders: (res: http.ServerResponse) => void,\n): Promise<void> {\n  const { logger } = defaults;\n  setCorsHeaders(res);\n\n  let body: { query?: unknown; max_results?: number };\n  try {\n    body = JSON.parse(raw) as { query?: unknown; max_results?: number };\n  } catch (parseErr) {\n    const detail = parseErr instanceof Error ? parseErr.message : \"unknown\";\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/search\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"search\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: `Malformed JSON: ${detail}`,\n          type: \"invalid_request_error\",\n          code: \"invalid_json\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Reject bodies that parsed but are not a JSON object (e.g. `null`) before\n  // touching fields — otherwise `body.query` throws a TypeError that surfaces\n  // as a 500 instead of a 400.\n  if (!isJsonObject(body)) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/search\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"search\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Request body must be a JSON object\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n\n  const rawQuery: unknown = body.query ?? \"\";\n  const normalizedQuery = normalizeTextInput(rawQuery);\n  if (normalizedQuery === null) {\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/search\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"search\",\n      response: { status: 400, fixture: null },\n    });\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: \"Invalid parameter: 'query' must be a string or an array of strings\",\n          type: \"invalid_request_error\",\n        },\n      }),\n    );\n    return;\n  }\n  // `query` is the normalized string used for matching; the response echoes\n  // `rawQuery` so an array payload round-trips exactly as it did before.\n  const query = normalizedQuery;\n  const maxResults = body.max_results;\n\n  // Find first matching fixture\n  let matchedResults: SearchResult[] = [];\n  let matchedFixture: SearchFixture | null = null;\n\n  for (const fixture of fixtures) {\n    if (matchesPattern(query, fixture.match)) {\n      matchedFixture = fixture;\n      matchedResults = fixture.results;\n      break;\n    }\n  }\n\n  if (matchedFixture) {\n    logger.debug(`Search fixture matched for query \"${query.slice(0, 80)}\"`);\n  } else {\n    logger.debug(`No search fixture matched for query \"${query.slice(0, 80)}\" — returning empty`);\n  }\n\n  // Strict mode turns the lenient default (empty results) into a no-match\n  // error, like every other fixture-matching handler. These fixtures carry no\n  // sequence/turn state, so the skipped count is always 0.\n  if (!matchedFixture && resolveStrictMode(defaults.strict, req.headers)) {\n    const strictMessage = strictNoMatchMessage(0);\n    logger.error(strictNoMatchLogLine(req.method ?? \"POST\", req.url ?? \"/search\", 0));\n    journal.add({\n      method: req.method ?? \"POST\",\n      path: req.url ?? \"/search\",\n      headers: flattenHeaders(req.headers),\n      body: null,\n      service: \"search\",\n      response: {\n        status: 503,\n        fixture: null,\n        ...strictOverrideField(defaults.strict, req.headers),\n      },\n    });\n    res.writeHead(503, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error: {\n          message: strictMessage,\n          type: \"invalid_request_error\",\n          code: \"no_fixture_match\",\n        },\n      }),\n    );\n    return;\n  }\n\n  // Apply max_results limit\n  if (maxResults !== undefined && maxResults > 0) {\n    matchedResults = matchedResults.slice(0, maxResults);\n  }\n\n  journal.add({\n    method: req.method ?? \"POST\",\n    path: req.url ?? \"/search\",\n    headers: flattenHeaders(req.headers),\n    body: null,\n    service: \"search\",\n    response: {\n      status: 200,\n      fixture: null,\n      ...strictOverrideField(defaults.strict, req.headers),\n    },\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      query: rawQuery,\n      results: matchedResults,\n      images: [],\n      response_time: 0,\n      answer: null,\n    }),\n  );\n}\n"],"mappings":";;;AAsCA,eAAsB,aACpB,KACA,KACA,KACA,UACA,SACA,UACA,gBACe;CACf,MAAM,EAAE,WAAW;AACnB,gBAAe,IAAI;CAEnB,IAAI;AACJ,KAAI;AACF,SAAO,KAAK,MAAM,IAAI;UACf,UAAU;EACjB,MAAM,SAAS,oBAAoB,QAAQ,SAAS,UAAU;AAC9D,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS,mBAAmB;GAC5B,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;AAMF,KAAI,CAAC,aAAa,KAAK,EAAE;AACvB,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAGF,MAAM,WAAoB,KAAK,SAAS;CACxC,MAAM,kBAAkB,mBAAmB,SAAS;AACpD,KAAI,oBAAoB,MAAM;AAC5B,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IAAE,QAAQ;IAAK,SAAS;IAAM;GACzC,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACP,EACF,CAAC,CACH;AACD;;CAIF,MAAM,QAAQ;CACd,MAAM,aAAa,KAAK;CAGxB,IAAI,iBAAiC,EAAE;CACvC,IAAI,iBAAuC;AAE3C,MAAK,MAAM,WAAW,SACpB,KAAI,eAAe,OAAO,QAAQ,MAAM,EAAE;AACxC,mBAAiB;AACjB,mBAAiB,QAAQ;AACzB;;AAIJ,KAAI,eACF,QAAO,MAAM,qCAAqC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG;KAExE,QAAO,MAAM,wCAAwC,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB;AAM/F,KAAI,CAAC,kBAAkB,kBAAkB,SAAS,QAAQ,IAAI,QAAQ,EAAE;EACtE,MAAM,gBAAgB,qBAAqB,EAAE;AAC7C,SAAO,MAAM,qBAAqB,IAAI,UAAU,QAAQ,IAAI,OAAO,WAAW,EAAE,CAAC;AACjF,UAAQ,IAAI;GACV,QAAQ,IAAI,UAAU;GACtB,MAAM,IAAI,OAAO;GACjB,SAAS,eAAe,IAAI,QAAQ;GACpC,MAAM;GACN,SAAS;GACT,UAAU;IACR,QAAQ;IACR,SAAS;IACT,GAAG,oBAAoB,SAAS,QAAQ,IAAI,QAAQ;IACrD;GACF,CAAC;AACF,MAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,MAAI,IACF,KAAK,UAAU,EACb,OAAO;GACL,SAAS;GACT,MAAM;GACN,MAAM;GACP,EACF,CAAC,CACH;AACD;;AAIF,KAAI,eAAe,UAAa,aAAa,EAC3C,kBAAiB,eAAe,MAAM,GAAG,WAAW;AAGtD,SAAQ,IAAI;EACV,QAAQ,IAAI,UAAU;EACtB,MAAM,IAAI,OAAO;EACjB,SAAS,eAAe,IAAI,QAAQ;EACpC,MAAM;EACN,SAAS;EACT,UAAU;GACR,QAAQ;GACR,SAAS;GACT,GAAG,oBAAoB,SAAS,QAAQ,IAAI,QAAQ;GACrD;EACF,CAAC;AAEF,KAAI,UAAU,KAAK,EAAE,gBAAgB,oBAAoB,CAAC;AAC1D,KAAI,IACF,KAAK,UAAU;EACb,OAAO;EACP,SAAS;EACT,QAAQ,EAAE;EACV,eAAe;EACf,QAAQ;EACT,CAAC,CACH"}

package/dist/server.cjs

@@ -1,4 +1,5 @@
 const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_constants = require('./constants.cjs');
 const require_api_key_auth = require('./api-key-auth.cjs');
 const require_helpers = require('./helpers.cjs');
 const require_logger = require('./logger.cjs');
@@ -127,7 +128,8 @@ const DEFAULT_MODELS = [
 const CORS_HEADERS = {
 	"Access-Control-Allow-Origin": "*",
 	"Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-	"Access-Control-Allow-Headers": "*"
+	"Access-Control-Allow-Headers": "*",
+	"Access-Control-Expose-Headers": "X-Total-Count"
 };
 function setCorsHeaders(res) {
 	for (const [key, value] of Object.entries(CORS_HEADERS)) res.setHeader(key, value);
@@ -145,11 +147,24 @@ function handleNotFound(res, message) {
 	} }));
 }
 const CONTROL_PREFIX = "/__aimock";
+/** The complete `GET /__aimock/fixtures` query-param vocabulary; anything else 400s. */
+const FIXTURES_PARAMS = new Set(["include"]);
+/** The complete `GET /__aimock/journal` query-param vocabulary; anything else 400s. */
+const JOURNAL_PARAMS = new Set([
+	"limit",
+	"offset",
+	"path",
+	"method",
+	"status",
+	"service",
+	"testId"
+]);
 /**
 * Perform a full reset: clear the fixtures array, the journal (entries *and*
 * per-test fixture match-counts, i.e. sequence position), the video and fal.ai
-* job/queue state, and the Gemini interaction/event-id counters, then re-zero
-* the `aimock_fixtures_loaded` gauge.
+* job/queue state, the Gemini interaction/event-id counters, and any runtime
+* chaos override (reverting to the construction-time chaos config), then
+* re-zero the `aimock_fixtures_loaded` gauge.
 *
 * `targets` is `null` when no server is running (an in-process `reset()` before
 * `start()`). The process-global generation state is reset either way, since it
@@ -166,6 +181,7 @@ function performFullReset(fixtures, targets) {
 	require_gemini_interactions.resetEventIdCounter();
 	if (!targets) return;
 	targets.journal.clear();
+	targets.defaults.chaos = void 0;
 	targets.videoStates.clear();
 	targets.openRouterVideoJobs.clear();
 	targets.veoVideoJobs.clear();
@@ -174,10 +190,103 @@ function performFullReset(fixtures, targets) {
 	if (targets.defaults.registry) targets.defaults.registry.setGauge("aimock_fixtures_loaded", {}, fixtures.length);
 }
 /**
+* JSON-safe redaction for control-API inspection output. Functions (fixture
+* `predicate`s, response factories) and RegExps do not survive
+* JSON.stringify as anything useful, so they become marker strings.
+*/
+function redactForInspection(value) {
+	if (typeof value === "function") return "[function]";
+	if (value instanceof RegExp) return String(value);
+	if (Array.isArray(value)) return value.map(redactForInspection);
+	if (value !== null && typeof value === "object") {
+		const out = {};
+		for (const [key, entry] of Object.entries(value)) out[key] = redactForInspection(entry);
+		return out;
+	}
+	return value;
+}
+/**
+* One-line kind label for a fixture response used by
+* `GET /__aimock/fixtures?include=fixtures` (e.g. "text", "error").
+* Response factories are reported as "factory".
+*
+* Discriminates with the same `is*Response` guards the request handlers use,
+* in the same order — NOT by inspecting keys. Every response shape extends
+* `ResponseOverrides` (`id`/`created`/`model`/`usage`), so a recorded fixture's
+* first key is usually an envelope override rather than the discriminant. The
+* audio-before-content/toolCalls order is the ORDERING CONTRACT documented on
+* `AudioResponse` in types.ts: those shapes structurally overlap.
+*/
+function fixtureResponseKind(response) {
+	if (require_helpers.isResponseFactory(response)) return "factory";
+	if (require_helpers.isErrorResponse(response)) return "error";
+	if (require_helpers.isAudioResponse(response)) return "audio";
+	if (require_helpers.isVideoResponse(response)) return "video";
+	if (require_helpers.isTranscriptionResponse(response)) return "transcription";
+	if (require_helpers.isImageResponse(response)) return "image";
+	if (require_helpers.isEmbeddingResponse(response)) return "embedding";
+	if (require_helpers.isJSONResponse(response)) return "json";
+	if (require_helpers.isContentWithToolCallsResponse(response)) return "contentWithToolCalls";
+	if (require_helpers.isToolCallResponse(response)) return "toolCalls";
+	if (require_helpers.isTextResponse(response)) return "text";
+	return "unknown";
+}
+/**
+* Resolve a journal entry's testId exactly the way `getTestId` resolves an
+* incoming request's: the `X-Test-Id` header wins, then `?testId=` parsed out
+* of the query string, then `DEFAULT_TEST_ID`. The
+* filter and the server's own per-test isolation must never disagree — and a
+* raw `path.includes("testId=t1")` both prefix-collides with `t10` and matches
+* unrelated params like `notTestId`.
+*/
+function journalEntryTestId(entry) {
+	const header = entry.headers["x-test-id"];
+	if (header) return header;
+	const qIdx = entry.path.indexOf("?");
+	if (qIdx !== -1) {
+		const queryValue = new URLSearchParams(entry.path.slice(qIdx + 1)).get("testId");
+		if (queryValue) return queryValue;
+	}
+	return require_constants.DEFAULT_TEST_ID;
+}
+/**
+* The testId a chaos override is stored under, and read back with — resolved by
+* `getTestId`, i.e. `X-Test-Id` header then `?testId=`, exactly as
+* `resolveScopedDefaults` resolves the traffic being evaluated. A control call
+* and the requests it is meant to affect can then never land in different
+* scopes. `DEFAULT_TEST_ID` (neither header nor param) means the server-wide
+* baseline.
+*
+* Returns `null` when `X-Test-Id` is PRESENT but blank. `String(testId ?? "")`
+* in a harness produces that trivially, and silently treating it as "untagged"
+* would install a server-wide baseline that fails every other test — the exact
+* cross-test leak per-testId scoping exists to prevent. Callers must 400.
+*/
+function chaosScopeId(req) {
+	const headerValue = req.headers["x-test-id"];
+	const raw = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+	if (typeof raw === "string" && raw.trim() === "") return null;
+	return require_helpers.getTestId(req);
+}
+/** 400 for a control call whose `X-Test-Id` is present but blank. */
+function writeBlankTestId(res) {
+	res.writeHead(400, { "Content-Type": "application/json" });
+	res.end(JSON.stringify({ error: "Invalid 'X-Test-Id': header is present but empty" }));
+	return true;
+}
+/** The chaos config in effect for one testId: its override, else the baseline. */
+function effectiveChaos(defaults, scopeId) {
+	const scoped = defaults.chaosByTestId?.get(scopeId);
+	if (scoped) return scoped;
+	const current = defaults.chaos;
+	if (!current) return {};
+	return require_chaos.isChaosScope(current) ? current.base ?? {} : current;
+}
+/**
 * Handle requests under `/__aimock/`. Returns `true` if the request was
 * handled, `false` if the path doesn't match the control prefix.
 */
-async function handleControlAPI(req, res, pathname, fixtures, journal, videoStates, openRouterVideoJobs, veoVideoJobs, grokVideoJobs, bytePlusVideoJobs, defaults) {
+async function handleControlAPI(req, res, pathname, searchParams, fixtures, journal, videoStates, openRouterVideoJobs, veoVideoJobs, grokVideoJobs, bytePlusVideoJobs, defaults) {
 	if (!pathname.startsWith(CONTROL_PREFIX)) return false;
 	const subPath = pathname.slice(9);
 	setCorsHeaders(res);
@@ -187,13 +296,148 @@ async function handleControlAPI(req, res, pathname, fixtures, journal, videoStat
 		return true;
 	}
 	if (subPath === "/journal" && req.method === "GET") {
-		res.writeHead(200, { "Content-Type": "application/json" });
-		res.end(JSON.stringify(journal.getAll()));
+		const bad = (message) => {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: message }));
+			return true;
+		};
+		for (const key of searchParams.keys()) if (!JOURNAL_PARAMS.has(key)) return bad(`Unknown query parameter: '${key}'. Supported: ${[...JOURNAL_PARAMS].join(", ")}`);
+		const parseNonNegativeInt = (name, fallback) => {
+			const raw = searchParams.get(name);
+			if (raw === null) return fallback;
+			if (!/^\d+$/.test(raw.trim())) return null;
+			return Number(raw);
+		};
+		const limit = parseNonNegativeInt("limit", -1);
+		const offset = parseNonNegativeInt("offset", 0);
+		if (limit === null) return bad("Invalid 'limit': must be an integer >= 0");
+		if (offset === null) return bad("Invalid 'offset': must be an integer >= 0");
+		let statusFilter;
+		const statusRaw = searchParams.get("status");
+		if (statusRaw !== null) {
+			if (!/^\d+$/.test(statusRaw.trim())) return bad("Invalid 'status': must be an integer");
+			statusFilter = Number(statusRaw);
+		}
+		const pathFilter = searchParams.get("path");
+		const methodFilter = searchParams.get("method");
+		const serviceFilter = searchParams.get("service");
+		const testIdFilter = searchParams.get("testId");
+		let entries = journal.getAll();
+		if (methodFilter !== null) {
+			const want = methodFilter.toUpperCase();
+			entries = entries.filter((e) => e.method.toUpperCase() === want);
+		}
+		if (pathFilter !== null) entries = entries.filter((e) => e.path.includes(pathFilter));
+		if (statusFilter !== void 0) entries = entries.filter((e) => e.response.status === statusFilter);
+		if (serviceFilter !== null) entries = entries.filter((e) => e.service === serviceFilter);
+		if (testIdFilter !== null) entries = entries.filter((e) => journalEntryTestId(e) === testIdFilter);
+		const total = entries.length;
+		if (offset > 0) entries = entries.slice(offset);
+		if (limit >= 0) entries = entries.slice(0, limit);
+		res.writeHead(200, {
+			"Content-Type": "application/json",
+			"X-Total-Count": String(total)
+		});
+		res.end(JSON.stringify(entries));
 		return true;
 	}
 	if (subPath === "/fixtures" && req.method === "GET") {
+		for (const key of searchParams.keys()) if (!FIXTURES_PARAMS.has(key)) {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: `Unknown query parameter: '${key}'. Supported: ${[...FIXTURES_PARAMS].join(", ")}` }));
+			return true;
+		}
+		const include = searchParams.get("include");
+		if (include === null) {
+			res.writeHead(200, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ count: fixtures.length }));
+			return true;
+		}
+		if (include !== "fixtures") {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Invalid 'include': expected 'fixtures'" }));
+			return true;
+		}
+		res.writeHead(200, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({
+			count: fixtures.length,
+			fixtures: fixtures.map((fixture, index) => ({
+				index,
+				match: redactForInspection(fixture.match),
+				responseKind: fixtureResponseKind(fixture.response),
+				...fixture.latency !== void 0 ? { latency: fixture.latency } : {},
+				...fixture.chaos !== void 0 ? { chaos: fixture.chaos } : {}
+			}))
+		}));
+		return true;
+	}
+	if (subPath === "/chaos" && req.method === "GET") {
+		const scopeId = chaosScopeId(req);
+		if (scopeId === null) return writeBlankTestId(res);
+		res.writeHead(200, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ chaos: effectiveChaos(defaults, scopeId) }));
+		return true;
+	}
+	if (subPath === "/chaos" && req.method === "DELETE") {
+		const scopeId = chaosScopeId(req);
+		if (scopeId === null) return writeBlankTestId(res);
+		defaults.chaosByTestId?.delete(scopeId);
+		res.writeHead(200, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ chaos: effectiveChaos(defaults, scopeId) }));
+		return true;
+	}
+	if (subPath === "/chaos" && req.method === "POST") {
+		const scopeId = chaosScopeId(req);
+		if (scopeId === null) return writeBlankTestId(res);
+		let raw;
+		try {
+			raw = await require_helpers.readBody(req);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			defaults.logger.error(`POST /__aimock/chaos: failed to read body: ${msg}`);
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: `Failed to read request body: ${msg}` }));
+			return true;
+		}
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			defaults.logger.error(`POST /__aimock/chaos: invalid JSON: ${msg}`);
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: `Invalid JSON: ${msg}` }));
+			return true;
+		}
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Invalid body: expected a JSON object" }));
+			return true;
+		}
+		const allowed = [
+			"dropRate",
+			"malformedRate",
+			"disconnectRate"
+		];
+		for (const key of Object.keys(parsed)) if (!allowed.includes(key)) {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: `Unknown chaos field: '${key}'` }));
+			return true;
+		}
+		const next = {};
+		for (const key of allowed) {
+			const value = parsed[key];
+			if (value === void 0) continue;
+			if (typeof value !== "number" || Number.isNaN(value) || value < 0 || value > 1) {
+				res.writeHead(400, { "Content-Type": "application/json" });
+				res.end(JSON.stringify({ error: `Invalid '${key}': must be a number between 0 and 1` }));
+				return true;
+			}
+			next[key] = value;
+		}
+		defaults.chaosByTestId?.set(scopeId, next);
 		res.writeHead(200, { "Content-Type": "application/json" });
-		res.end(JSON.stringify({ count: fixtures.length }));
+		res.end(JSON.stringify({ chaos: effectiveChaos(defaults, scopeId) }));
 		return true;
 	}
 	if (subPath === "/fixtures" && req.method === "POST") {
@@ -302,8 +546,37 @@ async function handleControlAPI(req, res, pathname, fixtures, journal, videoStat
 			res.end(JSON.stringify({ error: `Invalid JSON: ${msg}` }));
 			return true;
 		}
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Invalid body: expected a JSON object" }));
+			return true;
+		}
 		const status = parsed.status ?? 500;
+		if (!require_fixture_loader.isInjectableStatus(status)) {
+			res.writeHead(400, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: `Invalid 'status': must be ${require_fixture_loader.INJECTED_STATUS_RANGE}` }));
+			return true;
+		}
 		const errorBody = parsed.body;
+		if (errorBody !== void 0 && errorBody !== null) {
+			if (typeof errorBody !== "object" || Array.isArray(errorBody)) {
+				res.writeHead(400, { "Content-Type": "application/json" });
+				res.end(JSON.stringify({ error: "Invalid 'body': must be an object" }));
+				return true;
+			}
+			for (const field of [
+				"message",
+				"type",
+				"code"
+			]) {
+				const value = errorBody[field];
+				if (value !== void 0 && value !== null && typeof value !== "string") {
+					res.writeHead(400, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ error: `Invalid 'body.${field}': must be a string` }));
+					return true;
+				}
+			}
+		}
 		const errorFixture = {
 			match: { predicate: () => true },
 			response: {
@@ -363,7 +636,6 @@ async function handleCompletions(req, res, fixtures, journal, defaults, modelFal
 	let body;
 	try {
 		body = JSON.parse(raw);
-		if (modelFallback && !body.model) body.model = modelFallback;
 	} catch (parseErr) {
 		const detail = parseErr instanceof Error ? parseErr.message : "unknown parse error";
 		journal.add({
@@ -384,6 +656,24 @@ async function handleCompletions(req, res, fixtures, journal, defaults, modelFal
 		} }));
 		return;
 	}
+	if (!require_helpers.isJsonObject(body)) {
+		journal.add({
+			method: req.method ?? "POST",
+			path: req.url ?? COMPLETIONS_PATH,
+			headers: require_helpers.flattenHeaders(req.headers),
+			body: null,
+			response: {
+				status: 400,
+				fixture: null
+			}
+		});
+		require_sse_writer.writeErrorResponse(res, 400, openRouter ? require_openrouter_chat.serializeOpenRouterError(400, "Request body must be a JSON object") : JSON.stringify({ error: {
+			message: "Request body must be a JSON object",
+			type: "invalid_request_error"
+		} }));
+		return;
+	}
+	if (modelFallback && !body.model) body.model = modelFallback;
 	if (!Array.isArray(body.messages)) {
 		journal.add({
 			method: req.method ?? "POST",
@@ -475,7 +765,7 @@ async function handleCompletions(req, res, fixtures, journal, defaults, modelFal
 		const snippet = typeof lastUserMsg?.content === "string" ? lastUserMsg.content.slice(0, 80) : "";
 		defaults.logger.debug(`No fixture matched for request (model=${body.model ?? "?"}, msg="${snippet}")`);
 	}
-	const chaosAction = require_chaos.evaluateChaos(fixture, defaults.chaos, req.headers, defaults.logger);
+	const chaosAction = require_chaos.evaluateChaos(fixture, defaults.chaos, req.headers, defaults.logger, req.url);
 	const chaosContext = {
 		method,
 		path,
@@ -772,13 +1062,27 @@ async function createServerWithResolvedAuth(fixtures, options, resolvedAuth, mou
 	const logger = new require_logger.Logger(options?.logLevel ?? "silent");
 	const registry = options?.metrics ? require_metrics.createMetricsRegistry() : void 0;
 	const serverOptions = options ?? {};
+	const chaosByTestId = /* @__PURE__ */ new Map();
 	const defaults = {
 		latency: serverOptions.latency ?? 0,
 		chunkSize: Math.max(1, serverOptions.chunkSize ?? DEFAULT_CHUNK_SIZE),
 		replaySpeed: serverOptions.replaySpeed ?? 1,
 		logger,
+		chaosByTestId,
 		get chaos() {
-			return serverOptions.chaos;
+			return {
+				base: chaosByTestId.get(require_constants.DEFAULT_TEST_ID) ?? serverOptions.chaos,
+				byTestId: chaosByTestId
+			};
+		},
+		set chaos(value) {
+			if (value === void 0) {
+				chaosByTestId.clear();
+				return;
+			}
+			const base = require_chaos.isChaosScope(value) ? value.base : value;
+			if (base === void 0) chaosByTestId.delete(require_constants.DEFAULT_TEST_ID);
+			else chaosByTestId.set(require_constants.DEFAULT_TEST_ID, base);
 		},
 		registry,
 		get record() {
@@ -935,7 +1239,7 @@ async function createServerWithResolvedAuth(fixtures, options, resolvedAuth, mou
 			require_api_key_auth.markAuthenticatedRequest(req, resolvedAuth.policy);
 		}
 		if (pathname.startsWith(CONTROL_PREFIX)) {
-			await handleControlAPI(req, res, pathname, fixtures, journal, videoStates, openRouterVideoJobs, veoVideoJobs, grokVideoJobs, bytePlusVideoJobs, defaults);
+			await handleControlAPI(req, res, pathname, parsedUrl.searchParams, fixtures, journal, videoStates, openRouterVideoJobs, veoVideoJobs, grokVideoJobs, bytePlusVideoJobs, defaults);
 			return;
 		}
 		if (mounts) {
@@ -1827,7 +2131,7 @@ async function createServerWithResolvedAuth(fixtures, options, resolvedAuth, mou
 			try {
 				falBody = req.method === "POST" || req.method === "PUT" ? await require_helpers.readBody(req) : "";
 				const raw = falBody;
-				const chaosAction = require_chaos.evaluateChaos(null, defaults.chaos, req.headers, defaults.logger);
+				const chaosAction = require_chaos.evaluateChaos(null, defaults.chaos, req.headers, defaults.logger, req.url);
 				if (chaosAction) {
 					require_chaos.applyChaosAction(chaosAction, res, null, journal, {
 						method: req.method ?? "GET",
@@ -1869,7 +2173,7 @@ async function createServerWithResolvedAuth(fixtures, options, resolvedAuth, mou
 			setCorsHeaders(res);
 			try {
 				const raw = req.method === "POST" || req.method === "PUT" ? falBody ?? await require_helpers.readBody(req) : "{}";
-				const chaosAction = require_chaos.evaluateChaos(null, defaults.chaos, req.headers, defaults.logger);
+				const chaosAction = require_chaos.evaluateChaos(null, defaults.chaos, req.headers, defaults.logger, req.url);
 				if (chaosAction) {
 					require_chaos.applyChaosAction(chaosAction, res, null, journal, {
 						method: req.method ?? "GET",