@inetafrica/open-claudia 2.14.8 → 3.0.0

package/test-provider-recall.js

@@ -0,0 +1,271 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), "open-claudia-provider-recall-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.OPEN_CLAUDIA_CONFIG_DIR = path.join(root, "config");
+process.env.WORKSPACE = root;
+process.env.RECALL_METRICS = "on";
+process.env.RECALL_WARM_WALKER = "off";
+fs.mkdirSync(process.env.OPEN_CLAUDIA_CONFIG_DIR, { recursive: true });
+
+const fixture = path.join(__dirname, "test-fixtures", "fake-agent-cli.js");
+const { createClaudeProvider } = require("./core/providers/claude");
+const { createCodexProvider } = require("./core/providers/codex");
+const { createUtilityPolicy } = require("./core/providers/utility-policy");
+const { createUtilityAgentService } = require("./core/utility-agent");
+const { createRecallFilter } = require("./core/recall-filter");
+const discoverer = require("./core/recall/discoverer");
+const metrics = require("./core/recall/metrics");
+const warmWalker = require("./core/recall/warm-walker");
+const systemPrompt = require("./core/system-prompt");
+
+function makeProvider(kind, controls = {}) {
+  const common = {
+    hookTransport: false,
+    resolveExecutable: () => fixture,
+    defaultModel: `${kind}-high-fixture`,
+    buildEnv: () => ({
+      HOME: root,
+      PATH: process.env.PATH || path.dirname(process.execPath),
+      FAKE_AGENT_KIND: kind,
+      ...controls,
+    }),
+    getAuthStatus: () => ({ state: "authenticated", reason: null }),
+  };
+  return kind === "claude" ? createClaudeProvider(common) : createCodexProvider(common);
+}
+
+function makeRegistry(provider) {
+  return {
+    getProvider(id) {
+      if (id !== provider.id) throw Object.assign(new Error(`unknown ${id}`), { code: "UNKNOWN_PROVIDER" });
+      return provider;
+    },
+    listProviders: () => [provider],
+    providerStatus: (id) => ({
+      id,
+      availability: { state: "available", executable: fixture, reason: null },
+      compatibility: { state: "compatible", reason: null },
+      auth: { state: "authenticated", reason: null },
+    }),
+  };
+}
+
+function harness(kind, controls = {}, env = {}) {
+  const provider = makeProvider(kind, controls);
+  const registry = makeRegistry(provider);
+  const policy = createUtilityPolicy({ registry, env: { UTILITY_PROVIDER: kind, ...env } });
+  const utility = createUtilityAgentService({
+    registry,
+    policy,
+    env: { UTILITY_PROVIDER: kind, ...env },
+  });
+  return { provider, registry, policy, utility };
+}
+
+async function main() {
+  assert.strictEqual(typeof createRecallFilter, "function", "recall filter exposes an injectable provider-neutral service");
+  assert.strictEqual(typeof discoverer.runWalker, "function", "discoverer exposes its provider-aware walker boundary");
+
+  let capturedRecallRequest = null;
+  await createRecallFilter({
+    spawnUtilityAgent: async (_prompt, request) => {
+      capturedRecallRequest = request;
+      return { text: "[]" };
+    },
+  }).judgeRelevance("capture provider context", [{ id: "pack:a", name: "A" }], { provider: "claude" });
+  assert.strictEqual(capturedRecallRequest.activeProvider, "claude");
+  assert.strictEqual(Object.prototype.hasOwnProperty.call(capturedRecallRequest, "provider"), false,
+    "foreground recall context is not misclassified as an explicit provider override");
+
+  for (const kind of ["claude", "codex"]) {
+    const capture = path.join(root, `${kind}-filter.json`);
+    const h = harness(kind, {
+      FAKE_AGENT_CAPTURE: capture,
+      FAKE_AGENT_TEXT: '["pack:keep"]',
+    });
+    const filter = createRecallFilter({ spawnUtilityAgent: h.utility.spawnUtilityAgent });
+    const kept = await filter.judgeRelevance("keep this project", [
+      { id: "pack:keep", name: "Keep", description: "relevant" },
+      { id: "pack:drop", name: "Drop", description: "unrelated" },
+    ], { provider: kind, context: "same project" });
+    assert.deepStrictEqual([...kept], ["pack:keep"]);
+    const record = JSON.parse(fs.readFileSync(capture, "utf8"));
+    assert.strictEqual(record.stdin.present, true);
+    assert.ok(!record.argv.some((arg) => /keep this project/.test(arg)), "recall candidates stay out of argv");
+    if (kind === "claude") {
+      assert.strictEqual(record.argv[record.argv.indexOf("--model") + 1], h.provider.tierModel("low"));
+    } else {
+      assert.strictEqual(record.argv[record.argv.indexOf("--model") + 1], h.provider.tierModel("low"));
+      assert.ok(!record.argv.includes("haiku"), "Codex never receives a legacy Claude recall alias");
+    }
+  }
+
+  const failedFilter = createRecallFilter({
+    spawnUtilityAgent: async () => { throw new Error("fixture unavailable"); },
+  });
+  assert.strictEqual(
+    await failedFilter.judgeRelevance("query", [{ id: "pack:a", name: "A" }], { provider: "codex" }),
+    null,
+    "classic relevance filtering remains fail-open",
+  );
+
+  const legacyClaudeCapture = path.join(root, "legacy-claude-filter.json");
+  const legacyClaude = harness("claude", {
+    FAKE_AGENT_CAPTURE: legacyClaudeCapture,
+    FAKE_AGENT_TEXT: '["pack:a"]',
+  }, { RECALL_FILTER_MODEL: "legacy-claude-filter" });
+  await createRecallFilter({ spawnUtilityAgent: legacyClaude.utility.spawnUtilityAgent })
+    .judgeRelevance("query", [{ id: "pack:a", name: "A" }], { provider: "claude" });
+  assert.strictEqual(
+    JSON.parse(fs.readFileSync(legacyClaudeCapture, "utf8")).argv[
+      JSON.parse(fs.readFileSync(legacyClaudeCapture, "utf8")).argv.indexOf("--model") + 1
+    ],
+    "legacy-claude-filter",
+    "legacy exact recall model remains a Claude-only compatibility override",
+  );
+
+  const codexExactCapture = path.join(root, "exact-codex-filter.json");
+  const codexExact = harness("codex", {
+    FAKE_AGENT_CAPTURE: codexExactCapture,
+    FAKE_AGENT_TEXT: '["pack:a"]',
+  }, {
+    RECALL_FILTER_MODEL: "legacy-must-not-cross",
+    RECALL_FILTER_MODEL_CODEX: "codex-filter-exact",
+  });
+  await createRecallFilter({ spawnUtilityAgent: codexExact.utility.spawnUtilityAgent })
+    .judgeRelevance("query", [{ id: "pack:a", name: "A" }], { provider: "codex" });
+  const codexExactArgv = JSON.parse(fs.readFileSync(codexExactCapture, "utf8")).argv;
+  assert.strictEqual(codexExactArgv[codexExactArgv.indexOf("--model") + 1], "codex-filter-exact");
+  assert.ok(!codexExactArgv.includes("legacy-must-not-cross"));
+
+  const candidates = [
+    { id: "pack:a", name: "A", description: "alpha", excerpt: "alpha detail" },
+    { id: "pack:b", name: "B", description: "beta", excerpt: "beta detail" },
+  ];
+  for (const kind of ["claude", "codex"]) {
+    const h = harness(kind, { FAKE_AGENT_TEXT: '[{"id":"pack:a","why":"directly relevant"}]' });
+    const walk = await discoverer.walk("alpha question with enough words", "", candidates, {
+      provider: kind,
+      resolveUtilityProvider: h.policy.resolve,
+      spawnUtilityAgent: h.utility.spawnUtilityAgent,
+      warmWalker: { isEnabled: () => false },
+    });
+    assert.deepStrictEqual([...walk.kept], [["pack:a", "directly relevant"]]);
+    assert.strictEqual(walk.provider, kind);
+    assert.strictEqual(walk.model, h.provider.tierModel("low"));
+    assert.strictEqual(walk.source, "cold");
+  }
+
+  let warmCalls = 0;
+  let coldCalls = 0;
+  const warmClaude = makeProvider("claude");
+  const warmResult = await discoverer.runWalker("warm prompt", {
+    provider: "claude",
+    resolveUtilityProvider: () => ({
+      provider: warmClaude,
+      providerId: "claude",
+      model: warmClaude.tierModel("low"),
+    }),
+    warmWalker: {
+      isEnabled: (provider) => provider.id === "claude" && provider.capabilities.persistentUtilityStream.support === "native",
+      walkWarm: async (_prompt, opts) => {
+        warmCalls += 1;
+        assert.strictEqual(opts.provider.id, "claude");
+        return { text: "[]", costUsd: 0 };
+      },
+    },
+    spawnUtilityAgent: async () => { coldCalls += 1; return { text: "[]", provider: "claude", model: "cold" }; },
+  });
+  assert.strictEqual(warmResult.source, "warm");
+  assert.strictEqual(warmCalls, 1);
+  assert.strictEqual(coldCalls, 0);
+
+  const coldCodex = makeProvider("codex");
+  const codexWarmProbe = { checked: 0, walked: 0 };
+  const coldResult = await discoverer.runWalker("cold prompt", {
+    provider: "codex",
+    resolveUtilityProvider: () => ({ provider: coldCodex, providerId: "codex", model: coldCodex.tierModel("low") }),
+    warmWalker: {
+      isEnabled(provider) { codexWarmProbe.checked += 1; return provider.capabilities.persistentUtilityStream.support === "native"; },
+      walkWarm: async () => { codexWarmProbe.walked += 1; return { text: "[]" }; },
+    },
+    spawnUtilityAgent: async () => ({ text: "[]", provider: "codex", model: coldCodex.tierModel("low") }),
+  });
+  assert.strictEqual(coldResult.source, "cold");
+  assert.strictEqual(codexWarmProbe.checked, 1);
+  assert.strictEqual(codexWarmProbe.walked, 0, "unsupported Codex persistent stream is never attempted");
+
+  assert.strictEqual(warmWalker.isEnabled(coldCodex), false);
+  assert.strictEqual(warmWalker.isEnabled(warmClaude), false, "operator switch can disable even a native warm transport");
+  process.env.RECALL_WARM_WALKER = "on";
+  assert.strictEqual(warmWalker.isEnabled(warmClaude), true, "Claude warm path requires an advertised native capability");
+  assert.strictEqual(warmWalker.isEnabled(coldCodex), false, "Codex remains cold when persistentUtilityStream is unsupported");
+  process.env.RECALL_WARM_WALKER = "off";
+
+  metrics._resetForTest();
+  metrics.logTurn({
+    engine: "discoverer",
+    provider: "codex",
+    model: "codex-low-model",
+    query: "metric",
+    tier: "full",
+    seeds: [], activated: [], cand: [], kept: [],
+  });
+  const metricRecord = JSON.parse(fs.readFileSync(metrics.LOG_FILE, "utf8").trim());
+  assert.strictEqual(metricRecord.provider, "codex");
+  assert.strictEqual(metricRecord.model, "codex-low-model");
+
+  const recall = require("./core/recall");
+  const originalGetEngine = recall.getEngine;
+  let admittedProvider = null;
+  let releaseEngine;
+  const engineGate = new Promise((resolve) => { releaseEngine = resolve; });
+  recall.getEngine = () => ({
+    name: "fixture",
+    async run(ctx) {
+      admittedProvider = ctx.provider;
+      await engineGate;
+      assert.strictEqual(ctx.provider, "codex", "async recall keeps its admitted provider identity");
+      return { packBlock: "", entityBlock: "", toolBlock: "", episodeBlock: "", packMatches: [], entityMatches: [] };
+    },
+  });
+  const mutableState = {
+    userId: "fixture-user",
+    currentSession: { name: "project-a", dir: root },
+    settings: { backend: "claude", recallEngine: "discoverer" },
+  };
+  const recallBuild = systemPrompt.buildOptionalRecallContext("provider race", {
+    state: mutableState,
+    runContext: { provider: "codex", project: { name: "project-a", dir: root }, sessionId: null, runId: "recall-race" },
+    provider: coldCodex,
+  });
+  mutableState.settings.backend = "claude";
+  releaseEngine();
+  await recallBuild;
+  recall.getEngine = originalGetEngine;
+  assert.strictEqual(admittedProvider, "codex");
+
+  for (const file of ["core/recall-filter.js", "core/recall/discoverer.js", "core/recall/warm-walker.js"]) {
+    const source = fs.readFileSync(path.join(__dirname, file), "utf8");
+    assert.ok(!source.includes("spawnSubagent"), `${file} no longer uses the compatibility sub-agent path`);
+    assert.ok(!source.includes("CLAUDE_PATH"), `${file} has no hard-coded Claude executable dependency`);
+  }
+
+  console.log("provider recall OK");
+}
+
+main().catch((error) => {
+  console.error(error.stack || error.message);
+  process.exitCode = 1;
+}).finally(async () => {
+  try { await warmWalker.shutdown(); } catch (_) {}
+  fs.rmSync(root, { recursive: true, force: true });
+});

package/test-provider-registry.js

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const {
+  CAPABILITY_KEYS,
+  ProviderContractError,
+  validateInvocation,
+  validateProvider,
+} = require("./core/providers/contract");
+const {
+  ProviderRegistry,
+  ProviderRegistryError,
+} = require("./core/providers");
+
+function capabilities(overrides = {}) {
+  const result = {};
+  for (const key of CAPABILITY_KEYS) {
+    result[key] = {
+      support: "unsupported",
+      reason: `${key} is not implemented by this fixture`,
+      ...(key === "effort" ? { values: [] } : {}),
+    };
+  }
+  result.resume = { support: "native", reason: null };
+  result.readOnlyMode = { support: "native", reason: null };
+  return { ...result, ...overrides };
+}
+
+function provider(id, overrides = {}) {
+  return {
+    id,
+    label: id === "claude" ? "Claude Code" : "OpenAI Codex",
+    isAvailable: () => overrides.available !== false,
+    executable: () => `/fixture/${id}`,
+    defaultModel: () => `${id}-default`,
+    tierModel: (tier) => `${id}-${tier}`,
+    modelChoices: () => [`${id}-default`],
+    compatibilityStatus: () => {
+      if (overrides.compatibilityError) throw new Error(overrides.compatibilityError);
+      return overrides.compatibility || {
+        state: "compatible",
+        version: "1.2.3",
+        reason: null,
+      };
+    },
+    capabilities: capabilities(overrides.capabilities),
+    buildMainInvocation: (context) => ({
+      binary: `/fixture/${id}`,
+      args: [context.userPrompt],
+      env: { PATH: "/fixture" },
+      stdin: null,
+      parserState: {},
+    }),
+    buildUtilityInvocation: (context) => ({
+      binary: `/fixture/${id}`,
+      args: [context.userPrompt],
+      env: { PATH: "/fixture" },
+      stdin: null,
+      parserState: {},
+    }),
+    createEventDecoder: () => ({ push: () => [], end: () => [] }),
+    normalizeEvent: () => [],
+    authStatus: () => {
+      if (overrides.authError) throw new Error(overrides.authError);
+      return overrides.auth || {
+        state: "authenticated",
+        reason: null,
+      };
+    },
+    authHelp: () => `${id} auth help`,
+  };
+}
+
+const claude = provider("claude");
+assert.strictEqual(validateProvider(claude), claude);
+assert.deepStrictEqual(Object.keys(claude.capabilities).sort(), [...CAPABILITY_KEYS].sort());
+
+const frozenContext = Object.freeze({ userPrompt: "registry sentinel" });
+assert.deepStrictEqual(validateInvocation(claude.buildMainInvocation(frozenContext)), {
+  binary: "/fixture/claude",
+  args: ["registry sentinel"],
+  env: { PATH: "/fixture" },
+  stdin: null,
+  parserState: {},
+});
+
+assert.throws(
+  () => validateProvider({ ...claude, buildUtilityInvocation: undefined }),
+  (error) => error instanceof ProviderContractError && error.code === "INVALID_PROVIDER_CONTRACT",
+);
+assert.throws(
+  () => validateProvider({ ...claude, tierModel: undefined }),
+  (error) => error instanceof ProviderContractError && error.code === "INVALID_PROVIDER_CONTRACT",
+);
+assert.throws(
+  () => validateProvider({ ...claude, capabilities: { ...claude.capabilities, effort: { support: "native", reason: null } } }),
+  (error) => error instanceof ProviderContractError && /effort\.values/.test(error.message),
+);
+assert.throws(
+  () => validateInvocation({ binary: "claude", args: [], env: {} }),
+  (error) => error instanceof ProviderContractError && /stdin/.test(error.message),
+);
+assert.throws(
+  () => validateInvocation({ binary: "claude", args: [], env: { BAD: undefined }, stdin: null, parserState: {} }),
+  (error) => error instanceof ProviderContractError && /env keys and values/.test(error.message),
+);
+assert.throws(
+  () => validateProvider({ ...claude, capabilities: { ...claude.capabilities, budget: { support: "unsupported", reason: null } } }),
+  (error) => error instanceof ProviderContractError && /must explain/.test(error.message),
+);
+
+const registry = new ProviderRegistry();
+assert.strictEqual(registry.registerProvider(claude), claude);
+assert.strictEqual(registry.registerProvider(provider("codex")), registry.getProvider("codex"));
+assert.deepStrictEqual(registry.listProviders().map((entry) => entry.id), ["claude", "codex"]);
+assert.deepStrictEqual(registry.availableProviders().map((entry) => entry.id), ["claude", "codex"]);
+
+const claudeStatus = registry.providerStatus("claude");
+assert.deepStrictEqual(claudeStatus.availability, { state: "available", executable: "/fixture/claude", reason: null });
+assert.strictEqual(claudeStatus.compatibility.state, "compatible");
+assert.strictEqual(claudeStatus.auth.state, "authenticated");
+assert.strictEqual(registry.resolveProviderForRun().id, "claude");
+assert.strictEqual(registry.resolveProviderForRun("codex").id, "codex");
+
+assert.throws(
+  () => registry.registerProvider(provider("claude")),
+  (error) => error instanceof ProviderRegistryError && error.code === "DUPLICATE_PROVIDER",
+);
+assert.throws(
+  () => registry.registerProvider(provider("cursor")),
+  (error) => error instanceof ProviderRegistryError && error.code === "UNKNOWN_PROVIDER",
+);
+assert.throws(
+  () => registry.getProvider("missing"),
+  (error) => error instanceof ProviderRegistryError && error.code === "UNKNOWN_PROVIDER",
+);
+
+const unavailable = new ProviderRegistry();
+unavailable.registerProvider(provider("claude", { available: false }));
+unavailable.registerProvider(provider("codex", { available: false }));
+assert.deepStrictEqual(unavailable.availableProviders(), []);
+assert.throws(
+  () => unavailable.resolveProviderForRun(),
+  (error) => error instanceof ProviderRegistryError && error.code === "NO_AVAILABLE_PROVIDER",
+);
+
+const incompatible = new ProviderRegistry();
+incompatible.registerProvider(provider("claude", {
+  compatibility: { state: "incompatible", version: "0.1.0", reason: "fixture version is too old" },
+}));
+assert.throws(
+  () => incompatible.resolveProviderForRun("claude"),
+  (error) => error instanceof ProviderRegistryError && error.code === "PROVIDER_INCOMPATIBLE",
+);
+
+const unauthenticated = new ProviderRegistry();
+unauthenticated.registerProvider(provider("codex", {
+  auth: { state: "unauthenticated", reason: "fixture is logged out" },
+}));
+assert.throws(
+  () => unauthenticated.resolveProviderForRun("codex"),
+  (error) => error instanceof ProviderRegistryError && error.code === "PROVIDER_UNAUTHENTICATED",
+);
+
+const noForegroundFallback = new ProviderRegistry();
+noForegroundFallback.registerProvider(provider("claude", {
+  auth: { state: "unauthenticated", reason: "login required" },
+}));
+noForegroundFallback.registerProvider(provider("codex"));
+assert.throws(
+  () => noForegroundFallback.resolveProviderForRun(),
+  (error) => error instanceof ProviderRegistryError && error.code === "PROVIDER_UNAUTHENTICATED" && error.details.providerId === "claude",
+);
+
+const brokenCompatibility = new ProviderRegistry();
+brokenCompatibility.registerProvider(provider("claude", { compatibilityError: "broken version output" }));
+assert.strictEqual(brokenCompatibility.providerStatus("claude").compatibility.state, "unknown");
+const brokenAuth = new ProviderRegistry();
+brokenAuth.registerProvider(provider("codex", { authError: "broken login status" }));
+assert.strictEqual(brokenAuth.providerStatus("codex").auth.state, "unknown");
+
+// Status caching: healthy auth-probed results are cached for the TTL so
+// per-message admission does not respawn CLI probes; anything unhealthy
+// re-probes every call so installs/logins recover immediately.
+{
+  let clock = 0;
+  let compatProbes = 0;
+  let authProbes = 0;
+  const counted = provider("claude");
+  const innerCompat = counted.compatibilityStatus;
+  const innerAuth = counted.authStatus;
+  counted.compatibilityStatus = () => { compatProbes += 1; return innerCompat(); };
+  counted.authStatus = () => { authProbes += 1; return innerAuth(); };
+  const cachingRegistry = new ProviderRegistry({ statusTtlMs: 1000, now: () => clock });
+  cachingRegistry.registerProvider(counted);
+
+  cachingRegistry.providerStatus("claude");
+  cachingRegistry.providerStatus("claude");
+  cachingRegistry.resolveProviderForRun("claude");
+  assert.strictEqual(compatProbes, 1, "healthy status must be probed once within the TTL");
+  assert.strictEqual(authProbes, 1, "healthy auth must be probed once within the TTL");
+
+  const noAuthView = cachingRegistry.providerStatus("claude", { probeAuth: false });
+  assert.strictEqual(noAuthView.auth.state, "not_checked", "cache-served no-auth view must not leak auth state");
+  assert.strictEqual(compatProbes, 1);
+
+  const refreshed = cachingRegistry.providerStatus("claude", { refresh: true });
+  assert.strictEqual(refreshed.auth.state, "authenticated");
+  assert.strictEqual(compatProbes, 2, "refresh must bypass the cache");
+
+  clock = 5000;
+  cachingRegistry.providerStatus("claude");
+  assert.strictEqual(compatProbes, 3, "an expired entry must re-probe");
+
+  // Disappearance mid-TTL must be detected immediately: availability is a
+  // cheap lookup that always runs fresh, and it invalidates the cache.
+  let vanished = false;
+  counted.isAvailable = () => !vanished;
+  cachingRegistry.providerStatus("claude");
+  vanished = true;
+  assert.strictEqual(cachingRegistry.providerStatus("claude").availability.state, "missing",
+    "a cached healthy status must not mask a provider that disappeared");
+  vanished = false;
+  cachingRegistry.providerStatus("claude");
+  assert.strictEqual(compatProbes, 4, "disappearance must evict the cached status");
+
+  let coldProbes = 0;
+  const loggedOutProvider = provider("codex", { auth: { state: "unauthenticated", reason: "fixture is logged out" } });
+  const loggedOutCompat = loggedOutProvider.compatibilityStatus;
+  loggedOutProvider.compatibilityStatus = () => { coldProbes += 1; return loggedOutCompat(); };
+  cachingRegistry.registerProvider(loggedOutProvider);
+  cachingRegistry.providerStatus("codex");
+  cachingRegistry.providerStatus("codex");
+  assert.strictEqual(coldProbes, 2, "unhealthy status must never be cached");
+
+  // A no-auth probe must not seed the cache for auth-requiring callers.
+  let seedAuthProbes = 0;
+  const seeded = provider("claude");
+  const seededAuth = seeded.authStatus;
+  seeded.authStatus = () => { seedAuthProbes += 1; return seededAuth(); };
+  const seedRegistry = new ProviderRegistry({ statusTtlMs: 1000, now: () => 0 });
+  seedRegistry.registerProvider(seeded);
+  seedRegistry.providerStatus("claude", { probeAuth: false });
+  assert.strictEqual(seedAuthProbes, 0);
+  seedRegistry.resolveProviderForRun("claude");
+  assert.strictEqual(seedAuthProbes, 1, "auth-requiring callers must trigger a real auth probe after a no-auth probe");
+}
+
+console.log("provider registry OK");

package/test-provider-resume-parity.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+
+"use strict";
+
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const { createCodexProvider } = require("./core/providers/codex");
+
+const baselinePath = path.join(__dirname, "test-fixtures", "current-provider-parity.json");
+assert.ok(fs.existsSync(baselinePath), "current provider-parity baseline fixture must exist");
+const baseline = JSON.parse(fs.readFileSync(baselinePath, "utf8"));
+assert.strictEqual(baseline.codexResumedPlan.knownDefect, true);
+assert.strictEqual(baseline.codexResumedPlan.invertInTask, 7);
+
+const provider = createCodexProvider({
+  hookTransport: false,
+  resolveExecutable: () => "/fixture/codex",
+  buildEnv: () => ({ PATH: "/fixture" }),
+  getAuthStatus: () => ({ state: "authenticated", reason: null }),
+});
+const invocation = provider.buildMainInvocation(Object.freeze({
+  coreInstructions: "OPEN CLAUDIA CORE",
+  dynamicContext: "",
+  userPrompt: baseline.codexResumedPlan.promptSentinel,
+  resumeSessionId: baseline.codexResumedPlan.sessionId,
+  providerSettings: Object.freeze({ permissionMode: "plan" }),
+}));
+
+const args = invocation.args;
+const sessionAt = args.indexOf(baseline.codexResumedPlan.sessionId);
+const sandboxConfigAt = args.indexOf(baseline.codexResumedPlan.targetConstraints.configurationValue);
+const developerConfigAt = args.indexOf(`developer_instructions=${JSON.stringify("OPEN CLAUDIA CORE")}`);
+assert.ok(sessionAt > 0, "resumed invocation contains the session id");
+assert.ok(sandboxConfigAt > 0 && args[sandboxConfigAt - 1] === "-c", "plan mode uses the documented config override");
+assert.ok(sandboxConfigAt < sessionAt, "resume options precede the positional session id");
+assert.ok(developerConfigAt > 0 && developerConfigAt < sessionAt, "developer instructions are present on resume");
+assert.ok(!args.includes("--sandbox"), "resume never receives the unsupported --sandbox flag");
+assert.strictEqual(args.at(-1), baseline.codexResumedPlan.promptSentinel);
+
+console.log("provider resume parity OK");