@oar-sh/oar 0.9.0

package/server/claude-worker/claude-turn-publisher.mjs

@@ -0,0 +1,291 @@
+import fs from 'node:fs';
+import { countPlanLikeLines } from '../../shared/plan-lines.mjs';
+import { EMPTY_TURN_COMPLETION_NOTE } from '../../shared/empty-turn-completion.mjs';
+
+const PLAN_BOARD_ACTIONS = [
+  { id: 'autopilot', label: 'Implement in autopilot', mode: 'autopilot' },
+  { id: 'interactive', label: 'Stop here and prompt myself', mode: 'agent' },
+  { id: 'exit_only', label: 'Stop here', mode: 'agent' },
+];
+
+export function buildClaudePlanReadyBoardPayload({ message, planText = '' } = {}) {
+  const summary = String(planText || '').trim();
+  if (!summary) return null;
+  return {
+    queueId: message?.id,
+    messageId: message?.id,
+    conversationId: message?.conversationId,
+    mode: message?.relayMode || 'agent',
+    boardType: 'plan_ready',
+    title: 'Plan ready for review',
+    body: summary,
+    actions: PLAN_BOARD_ACTIONS,
+    recommendedAction: null,
+    context: {
+      source: 'exit_plan_mode',
+      queueMessageId: message?.id || null,
+      conversationId: message?.conversationId || null,
+      relayMode: message?.relayMode || 'agent',
+    },
+  };
+}
+
+/**
+ * The relay-facing half of a Claude turn: normalized actions in, HTTP calls to
+ * the relay's activity/stream/response channels out. Owns no turn or process
+ * state — every function takes the turn's relay message and the caller's
+ * mutable turn state, so the session process can run any number of turns
+ * (delivered or background-continuation) through one publisher.
+ */
+export function createClaudeTurnPublisher({ api, dbg = () => {}, takeWorkflowRuns = null } = {}) {
+  async function postActivity(message, text, subagentRunId = null, metadata = null) {
+    if (!text) return;
+    await api('POST', '/api/activity', {
+      messageId: message.id,
+      conversationId: message.conversationId,
+      mode: message.relayMode || 'agent',
+      text,
+      ...(subagentRunId ? { subagentRunId } : {}),
+      ...(metadata && typeof metadata === 'object' ? { metadata } : {}),
+    }).catch(() => {});
+  }
+
+  async function dispatchAction(message, action, state) {
+    const { channel, payload } = action;
+    if (channel === 'init') {
+      state.responseModel = payload.model || state.responseModel;
+      return;
+    }
+    if (channel === 'stream') {
+      // Only the main thread's text can stand in for the answer. Subagent text
+      // is forwarded too (forwardSubagentText), and letting it land here would
+      // publish a subagent's prose as the reply on the abort / error / no-result
+      // fallback paths below.
+      if (!payload.subagentRunId) state.lastStreamedText = payload.text;
+      await api('POST', '/api/stream', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        mode: message.relayMode || 'agent',
+        text: payload.text,
+        done: payload.done === true,
+        ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+      }).catch(() => {});
+      return;
+    }
+    if (channel === 'thought') {
+      await api('POST', '/api/thought', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        mode: message.relayMode || 'agent',
+        reasoningId: payload.reasoningId,
+        text: payload.text,
+        done: payload.done === true,
+        ...(payload.subagentRunId ? { subagentRunId: payload.subagentRunId } : {}),
+      }).catch(() => {});
+      return;
+    }
+    if (channel === 'activity') {
+      await postActivity(message, payload.text, payload.subagentRunId, payload.metadata || null);
+      return;
+    }
+    if (channel === 'subagent') {
+      await api('POST', '/api/subagent-run', {
+        messageId: message.id,
+        conversationId: message.conversationId,
+        subagentRunId: payload.subagentRunId,
+        parentSubagentId: payload.parentSubagentId || undefined,
+        displayName: payload.displayName || undefined,
+        status: payload.status,
+      }).catch(() => {});
+      return;
+    }
+    if (channel === 'result') {
+      state.result = payload;
+      state.modelUsage = payload.modelUsage || null;
+      const text = String(payload.text || '').trim();
+      if (text) state.resultTexts.push(text);
+    }
+  }
+
+  /**
+   * Ship the turn's context-window breakdown to the relay, which serves it back
+   * to the UI as the composer indicator and the context-usage modal. Advisory
+   * data: a failure here must not disturb the turn's response.
+   */
+  async function publishContextUsage({ message, state, model, sdkSessionId }) {
+    if (!state.contextUsage && !state.modelUsage) return;
+    await api('POST', '/api/claude-context-usage', {
+      conversationId: message.conversationId,
+      sdkSessionId,
+      model: state.responseModel || model || null,
+      contextUsage: state.contextUsage,
+      modelUsage: state.modelUsage,
+    }).catch((error) => {
+      dbg('context usage publish failed', error?.message || String(error));
+    });
+  }
+
+  /**
+   * Ship the session's plan usage (rate-limit windows + cost totals) to the
+   * relay. Falls back to the stable result fields when the experimental usage
+   * control request is unavailable, so the card still gets session cost.
+   * Advisory: a failure here must not disturb the turn's response.
+   */
+  async function publishPlanUsage({ message, state, sdkSessionId }) {
+    const totalCostUsd = state.result?.totalCostUsd ?? null;
+    // A cost with no per-model breakdown is still a usable fallback payload, so
+    // it has to count as a reason to publish or the card loses session cost on
+    // any turn the SDK reports without `modelUsage`.
+    if (!state.planUsage && !state.modelUsage && totalCostUsd === null) return;
+    await api('POST', '/api/claude-plan-usage', {
+      conversationId: message.conversationId,
+      sdkSessionId,
+      usage: state.planUsage,
+      modelUsage: state.modelUsage,
+      totalCostUsd,
+    }).catch((error) => {
+      dbg('plan usage publish failed', error?.message || String(error));
+    });
+  }
+
+  async function publishFinalStream(message, text) {
+    await api('POST', '/api/stream', {
+      messageId: message.id,
+      conversationId: message.conversationId,
+      mode: message.relayMode || 'agent',
+      text: String(text || ''),
+      done: true,
+    }).catch(() => {});
+  }
+
+  async function publishResponse(message, { text, model, terminalError = null, modelOrigin }) {
+    // Final digests of workflows that settled since the last response ride the
+    // next successful response publish — the summarizing turn is the natural
+    // transcript anchor for the "Finished background task" card. Terminal
+    // failures skip the drain so the digests stay buffered for a later turn;
+    // if this POST fails (→ requeue) or the process dies before any response
+    // publishes, the drained digests are lost — acceptable v1.
+    const workflowRuns = (!terminalError && typeof takeWorkflowRuns === 'function')
+      ? takeWorkflowRuns()
+      : null;
+    await api('POST', '/api/response', {
+      messageId: message.id,
+      conversationId: message.conversationId,
+      text: String(text || ''),
+      model: model || null,
+      modelOrigin: modelOrigin
+        || (String(message?.model || '').trim().toLowerCase() === 'auto' ? 'auto' : 'manual'),
+      ...(Array.isArray(workflowRuns) && workflowRuns.length ? { workflowRuns } : {}),
+      ...(terminalError ? { terminalError } : {}),
+    }).catch(async () => {
+      await api('POST', '/api/requeue', { messageId: message.id }).catch(() => {});
+    });
+  }
+
+  /**
+   * Post the plan-ready review board for an ExitPlanMode interception. The CLI
+   * sends both `plan` and `planFilePath`; the inline plan is authoritative, the
+   * plan file covers CLI versions that stop inlining it. Returns false when no
+   * plan text could be recovered so the caller's plan-shaped-final-text
+   * fallback still gets a chance to post the board.
+   */
+  async function publishPlanBoard(message, input) {
+    let planText = String(input?.plan || input?.summary || '').trim();
+    if (!planText) {
+      const planFilePath = String(input?.planFilePath || '').trim();
+      if (planFilePath) {
+        try {
+          planText = String(fs.readFileSync(planFilePath, 'utf8') || '').trim();
+        } catch (error) {
+          dbg('plan file read failed', planFilePath, error?.message || String(error));
+        }
+      }
+    }
+    const boardPayload = buildClaudePlanReadyBoardPayload({ message, planText });
+    if (!boardPayload) return false;
+    await api('POST', '/api/relay-board', boardPayload).catch((error) => {
+      dbg('plan board publish failed', error?.message || String(error));
+    });
+    return true;
+  }
+
+  /**
+   * Publish a completed (non-error, non-aborted) turn: final stream snapshot,
+   * plan-mode fallback board, response row. Mirrors the pre-session-process
+   * turn runner's tail exactly.
+   */
+  async function publishCompletedTurn({ message, state, responseModel, planBoardPosted }) {
+    const result = state.result;
+    const finalText = String(
+      state.resultTexts.join('\n\n') || result?.text || state.lastStreamedText || '',
+    ).trim();
+    if (
+      !planBoardPosted
+      && String(message.relayMode || '').trim().toLowerCase() === 'plan'
+      && countPlanLikeLines(finalText) >= 2
+    ) {
+      const boardPayload = buildClaudePlanReadyBoardPayload({ message, planText: finalText });
+      if (boardPayload) {
+        boardPayload.context.source = 'plan-mode-fallback';
+        await api('POST', '/api/relay-board', boardPayload).catch(() => {});
+      }
+    }
+    // Same reasoning as the Cursor worker: a terminal, non-error result with no
+    // prose is a completed turn (the model can end on tool activity alone), and
+    // requeuing it re-runs deterministically empty work until the retry cap
+    // fails the message with a misleading "Relay timeout".
+    const publishedText = finalText || EMPTY_TURN_COMPLETION_NOTE;
+    await publishFinalStream(message, publishedText);
+    await publishResponse(message, { text: publishedText, model: responseModel });
+  }
+
+  async function publishErrorResult({ message, state, responseModel }) {
+    const result = state.result;
+    const errorText = result.text
+      || `Claude turn failed (${result.subtype || 'unknown error'}).`;
+    await publishFinalStream(message, state.lastStreamedText);
+    await publishResponse(message, {
+      text: errorText,
+      model: responseModel,
+      terminalError: {
+        kind: 'claude-turn-failed',
+        code: result.subtype || 'unknown',
+        stableCode: `claude.${result.subtype || 'unknown'}`,
+        message: errorText,
+        failedAt: new Date().toISOString(),
+        queueMessageId: String(message.id || '') || null,
+      },
+    });
+  }
+
+  async function publishTurnException({ message, errorText }) {
+    const isAuthError = /authentication|logged in|login|credential|api key/i.test(errorText);
+    await publishResponse(message, {
+      text: isAuthError
+        ? `System note: the Claude runtime could not authenticate (${errorText}). Log in again from Settings → Providers → Claude → Relogin (or run \`claude\` on the relay host), then retry.`
+        : `System note: the Claude turn failed (${errorText}). Retry or send a new message.`,
+      model: null,
+      terminalError: {
+        kind: 'claude-turn-failed',
+        code: isAuthError ? 'authentication_failed' : 'turn-error',
+        stableCode: isAuthError ? 'claude.authentication_failed' : 'claude.turn-error',
+        message: errorText,
+        failedAt: new Date().toISOString(),
+        queueMessageId: String(message.id || '') || null,
+      },
+    });
+  }
+
+  return {
+    postActivity,
+    dispatchAction,
+    publishContextUsage,
+    publishPlanUsage,
+    publishFinalStream,
+    publishResponse,
+    publishPlanBoard,
+    publishCompletedTurn,
+    publishErrorResult,
+    publishTurnException,
+  };
+}

package/server/claude-worker/fixtures/workflow-run-record.json

@@ -0,0 +1 @@
+{"runId":"wf_d8a3315d-fd5","timestamp":"2026-08-17T15:47:41.320Z","taskId":"wic26ymi4","script":"export const meta = {\n  name: 'review-shared-model-modules',\n  description: 'Review shared/model-* modules for correctness bugs via parallel lensed reviewers plus adversarial verification',\n  phases: [\n    { title: 'Review' },\n    { title: 'Verify' },\n  ],\n}\n\nconst FILES = [\n  '/workspace/copilot-remote/shared/model-catalog-freshness.mjs',\n  '/workspace/copilot-remote/shared/model-descriptors.mjs',\n  '/workspace/copilot-remote/shared/model-id.mjs',\n  '/workspace/copilot-remote/shared/model-refresh.mjs',\n]\n\nconst CONTEXT_NOTE = `This review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only use Read/Grep/Bash(read-only inspection) tools.\n\nTarget modules to review for CORRECTNESS BUGS (not style, not simplification):\n${FILES.map(f => `- ${f}`).join('\\n')}\n\nFor context, each module has a sibling test file (e.g. model-id.test.mjs) in the same shared/ directory — you may read those to understand intended behavior, but do not report bugs in the test files themselves, only in the four modules listed above. Also feel free to grep the wider repo (rg -n \"modelId\\\\(\" or similar) to see how these modules are actually called, since a \"correctness bug\" claim is much stronger when you can point at a real call site that would misbehave.`\n\nconst FINDINGS_SCHEMA = {\n  type: 'object',\n  properties: {\n    findings: {\n      type: 'array',\n      items: {\n        type: 'object',\n        properties: {\n          file: { type: 'string', description: 'absolute path' },\n          line: { type: 'number' },\n          summary: { type: 'string', description: 'one sentence statement of the defect' },\n          failure_scenario: { type: 'string', description: 'concrete input/state that triggers wrong output or a crash' },\n        },\n        required: ['file', 'summary', 'failure_scenario'],\n      },\n    },\n  },\n  required: ['findings'],\n}\n\nconst VERDICT_SCHEMA = {\n  type: 'object',\n  properties: {\n    refuted: { type: 'boolean', description: 'true if this is NOT a real bug (false positive, intended behavior, unreachable, etc.)' },\n    reasoning: { type: 'string' },\n  },\n  required: ['refuted', 'reasoning'],\n}\n\nconst LENSES = [\n  {\n    key: 'logic',\n    prompt: `Review these modules for general logic/correctness bugs: wrong conditionals, off-by-one errors, incorrect boolean logic, wrong operator precedence, mis-ordered comparisons, incorrect return values, or logic that contradicts the module's apparent intent (infer intent from naming, comments, and the sibling test file).\\n\\n${CONTEXT_NOTE}`,\n  },\n  {\n    key: 'async-error-handling',\n    prompt: `Review these modules for async/concurrency/error-handling bugs: unhandled promise rejections, missing awaits, race conditions, incorrect error propagation/swallowing, incorrect use of try/catch, stale closures over mutable state, or timing assumptions that don't hold.\\n\\n${CONTEXT_NOTE}`,\n  },\n  {\n    key: 'edge-cases-data',\n    prompt: `Review these modules for edge-case and data-validation bugs: null/undefined handling, malformed or unexpected input shapes, boundary conditions (empty arrays/strings, zero, negative numbers), incorrect assumptions about external data (e.g. API responses, file contents, env vars), and mutation of shared/cached state that could leak across calls.\\n\\n${CONTEXT_NOTE}`,\n  },\n]\n\nphase('Review')\nconst reviews = await parallel(LENSES.map(l => () =>\n  agent(l.prompt, { label: `review:${l.key}`, phase: 'Review', schema: FINDINGS_SCHEMA })\n))\n\nconst allFindings = reviews.filter(Boolean).flatMap(r => r.findings || [])\nlog(`${allFindings.length} raw findings from ${LENSES.length} reviewers, verifying each...`)\n\nif (allFindings.length === 0) {\n  return { confirmed: [], raw: [] }\n}\n\nphase('Verify')\nconst verified = await parallel(allFindings.map(f => () =>\n  agent(\n    `Adversarially verify this correctness-bug claim about ${f.file}${f.line ? ` (near line ${f.line})` : ''}.\\n\\nClaim: ${f.summary}\\nAlleged failure scenario: ${f.failure_scenario}\\n\\nRead the actual file (and its sibling test file, and real call sites elsewhere in the repo if useful) and determine whether this is a REAL bug or a false positive. Be skeptical — default to refuted=true if you cannot concretely demonstrate the failure scenario actually occurs given the real code. Do not modify any files.`,\n    { label: `verify:${f.file.split('/').pop()}`, phase: 'Verify', schema: VERDICT_SCHEMA }\n  ).then(v => ({ ...f, verdict: v }))\n))\n\nconst confirmed = verified.filter(Boolean).filter(v => v.verdict && v.verdict.refuted === false)\n\nreturn { confirmed, totalRaw: allFindings.length, totalConfirmed: confirmed.length }\n","scriptPath":"/workspace/.claude/projects/-workspace-copilot-remote/00000000-0000-4000-8000-000000000000/workflows/scripts/review-shared-model-modules-wf_d8a3315d-fd5.js","result":{"confirmed":[{"file":"/workspace/copilot-remote/shared/model-id.mjs","line":108,"summary":"canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.","failure_scenario":"canonicalizeModelId('openai/o1') returns 'openai/o1' instead of 'o1' (compare canonicalizeModelId('openai/o1-preview') -> 'o1-preview', which strips correctly). Root cause: BASE_MODEL_PREFIXES (line 17) is derived by filtering MODEL_ID_PREFIXES down to entries without '/', giving ['gpt-','chatgpt-','claude-','gemini-','mai-','o1-','o3-','o4-','codex-'] — only the dash-suffixed 'o1-'/'o3-' forms, not the bare 'o1'/'o3' ids that isLikelyModelIdPrefix (line 39) and isOpenAIModelId (line 96) explicitly special-case as valid standalone model ids. As a result, in canonicalizeModelId's loop (lines 111-118), stripped='o1' never matches any BASE_MODEL_PREFIXES entry via startsWith, so the function falls through to `return candidate` and keeps the redundant 'openai/' prefix. Concretely: filterValidModelIds(['o1', 'openai/o1']) returns ['o1', 'openai/o1'] as two distinct entries instead of deduping to one, defeating the documented intent of filterValidModelIds ('filterValidModelIds dedupes case and provider aliases' per the sibling test) for exactly the two model ids ('o1'/'o3') the file goes out of its way to special-case elsewhere. This is not a purely theoretical shape: server/services/session-worker-launch-service.mjs:34-41 (resolveOpenAIWireApi) explicitly normalizes and compares against both the bare and 'openai/'-prefixed forms of 'o1'/'o3', confirming provider-prefixed bare ids are a real input shape in this codebase; any catalog/dedup path built on canonicalizeModelId (e.g. server-runtime.mjs's baseModelId/model-metadata maps keyed by canonicalizeModelId) would treat 'o1' and 'openai/o1' as two separate models instead of one.","verdict":{"reasoning":"Directly reproduced the failure by running the real module: canonicalizeModelId('openai/o1') === 'openai/o1' (unstripped) while canonicalizeModelId('openai/o1-preview') === 'o1-preview' (stripped), and filterValidModelIds(['o1','openai/o1']) === ['o1','openai/o1'] (two entries instead of one). Root cause matches the claim exactly: BASE_MODEL_PREFIXES (derived from MODEL_ID_PREFIXES filtered to entries without '/') only contains the dashed forms 'o1-'/'o3-', so the startsWith check in canonicalizeModelId's stripping loop never matches the bare stripped remainder 'o1'/'o3', even though isLikelyModelIdPrefix and isOpenAIModelId in the same file explicitly special-case bare 'o1'/'o3' as valid standalone OpenAI model ids. This is an inconsistency within the module's own stated design (provider prefixes should be redundant/stripped for known base model families) for exactly the two families it special-cases elsewhere. Confirmed the sibling test file (shared/model-id.test.mjs) has a test 'filterValidModelIds dedupes case and provider aliases' that verifies this dedup behavior for gpt-*/claude-* families but does not cover o1/o3, so this gap is untested and the existing test suite passes despite the bug. Also confirmed bare/prefixed 'o1'/'o3' handling is a real, non-hypothetical shape used elsewhere (server/services/session-worker-launch-service.mjs resolveOpenAIWireApi explicitly strips 'openai/' and checks both bare and dashed o1/o3 forms), and canonicalizeModelId/filterValidModelIds are used in real dedup/catalog paths in server/server-runtime.mjs and shared/model-refresh.mjs. This is a real, concretely demonstrated correctness bug.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-id.mjs","line":108,"summary":"canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.","failure_scenario":"canonicalizeModelId('openai/o1') returns 'openai/o1' unchanged: it only strips a provider prefix when the remainder starts with one of BASE_MODEL_PREFIXES (line 17), and every one of those prefixes requires a trailing '-', e.g. 'o1-', so bare 'o1' never matches. canonicalizeModelId('o1') separately returns 'o1'. Both 'o1' and 'openai/o1' independently pass isValidModelId (isLikelyModelIdPrefix at line 37 and isOpenAIModelId at line 94 both special-case bare 'o1'/'o3'), so filterValidModelIds(['o1', 'openai/o1']) returns ['o1', 'openai/o1'] as two distinct entries instead of collapsing to one, unlike every other provider-prefixed pair (verified: filterValidModelIds(['GPT-5.4','openai/gpt-5.4']) correctly collapses to a single 'gpt-5.4'). Any caller merging model lists that mix bare and provider-prefixed o1/o3 ids (e.g. selectModelIdsForVariantRefresh's snapshotModels, or server-runtime.mjs's validatedModelIdList) will surface the same underlying model twice.","verdict":{"reasoning":"Directly executed the real code from shared/model-id.mjs (Node, --input-type=module) and reproduced the exact scenario: canonicalizeModelId('openai/o1') === 'openai/o1' (unchanged) while canonicalizeModelId('o1') === 'o1'; both pass isValidModelId (true special-casing of bare o1/o3 in isLikelyModelIdPrefix line 37-41 and isOpenAIModelId line 94-106); filterValidModelIds(['o1','openai/o1']) returns ['o1','openai/o1'] (2 entries) whereas the analogous filterValidModelIds(['GPT-5.4','openai/gpt-5.4']) correctly collapses to ['gpt-5.4']. Root cause verified by reading the code: BASE_MODEL_PREFIXES (line 17) is derived from MODEL_ID_PREFIXES entries that lack '/', giving ['gpt-','chatgpt-','claude-','gemini-','mai-','o1-','o3-','o4-','codex-'] — all require a trailing '-', so stripping 'openai/' from 'openai/o1' leaves 'o1', which does not start with 'o1-', so the strip-and-return branch in canonicalizeModelId (line 108-120) never fires and the function falls through to returning the original unstripped candidate. This asymmetry does not occur for any other prefix family (verified openai/o1-mini -> o1-mini works fine) because those always retain their trailing dash in the stripped remainder. Confirmed this is reachable via real call sites: shared/model-refresh.mjs's selectModelIdsForVariantRefresh merges snapshotModels with currentModel/defaultModel through filterValidModelIds, and server/server-runtime.mjs's validatedModelIdList wraps filterValidModelIds identically, matching the claim's alleged caller impact. Also confirmed provider-prefixed ids like 'openai/gpt-5.4' are real formats already used elsewhere in the repo (server/relay.mjs, web-relay model-switching.mjs), making the prefixed input plausible rather than purely synthetic. Ran the full existing test suite (14 tests, all passing) and confirmed there is no test covering the bare-vs-prefixed o1/o3 dedup case, despite adjacent tests explicitly covering bare o1/o3 validity and provider-alias dedup for other families separately — a clear coverage gap consistent with an unintended bug rather than documented/intended behavior. All specifics in the claim (line numbers, function names, exact input/output values) check out against the real file contents and real execution. This is a concrete, reproducible correctness bug, not a false positive.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-descriptors.mjs","line":77,"summary":"extractModelDescriptors' context-limit fallback (findContextLimitTokens) recurses into the same container keys ('data'/'models'/'list'/etc.) that extractModelDescriptors itself uses to find sibling model entries, so a model with no usable pricing/limits fields of its own can silently inherit a sibling model's context-window value.","failure_scenario":"For raw = { id: 'gpt-5.4', data: [ { id: 'gpt-5.4-mini', contextWindow: 8000 } ] }, extractModelDescriptors(raw) yields contextLimitTokens: 8000 for BOTH the 'gpt-5.4' and 'gpt-5.4-mini' descriptors (reproduced by running the module directly), even though the 8000-token window only belongs to 'gpt-5.4-mini'. This happens because contextLimitForTier() (lines 62-78) falls back to findContextLimitTokens(value) (line 77) whenever a model object has no tokenPrices/limits fields of its own; findContextLimitTokens (lines 9-28) then walks every nested object property of the model, including the same containerKeys ('data','models','list','available','items','entries','result','response' at line 81) that extractModelDescriptors (lines 107-109) separately recurses into to discover additional sibling models. Any upstream RPC/API shape that nests a list of related models under one of those container keys inside an outer model-shaped object (plausible given extractModelDescriptors explicitly supports several heterogeneous list-wrapper shapes across client.listModels()/models.list/modelApi.list in server/relay.mjs) will cross-contaminate context-limit data between unrelated models.","verdict":{"reasoning":"I read shared/model-descriptors.mjs in full and directly executed the unmodified module with the exact reproduction case from the claim: extractModelDescriptors({ id: 'gpt-5.4', data: [{ id: 'gpt-5.4-mini', contextWindow: 8000 }] }). The output shows both 'gpt-5.4' and 'gpt-5.4-mini' get contextLimitTokens: 8000, confirming the claim's central assertion exactly.\n\nMechanism verified by code inspection: contextLimitForTier (line 62-78) falls back to findContextLimitTokens(value) at line 77 when a model object has no own limits/tokenPrices fields, passing the model's *entire* raw object (including any container-key properties it happens to carry). findContextLimitTokens (lines 9-28) recurses into Object.values(value) with zero awareness of the containerKeys array ['data','models','list','available','items','entries','result','response'] that extractModelDescriptors (lines 80-81, 107-109) separately uses to walk into sibling model lists. So when a model-shaped object (has its own valid id) also happens to carry one of those container keys holding sibling model data, findContextLimitTokens will happily discover and return the sibling's contextWindow/maxContextTokens/etc. value as if it belonged to the outer model. This is a genuine, unambiguous logic defect in the shared helper — not a misreading of the code.\n\nI additionally checked reachability against real call sites (server/relay.mjs, .github/extensions/web-relay/model-api/model-switching.mjs, and the installed @github/copilot SDK's rpc.d.ts/types.d.ts for Model/ModelInfo/ModelList). Today's actual known upstream shape is `{ models: Model[] }`, where the wrapper object itself has no id/modelId/model field (so it's never treated as a \"model\" whose fallback search would run), and each individual Model/ModelInfo only carries id/name/capabilities/policy/billing — never a nested container-key list of sibling models inside a single model object. So the specific pathological input isn't produced by any currently-known real RPC response in this repo, and the existing test suite (model-switching.test.mjs) doesn't cover it. However, the claim itself is hedged appropriately (\"any upstream RPC/API shape that nests...\") and the function is explicitly written as a generic, defensive parser meant to tolerate multiple heterogeneous list-wrapper shapes across several different call sites/providers, so this is a real latent correctness defect in shared code (silent cross-contamination of per-model metadata) rather than a purely theoretical/unreachable construct — I concretely reproduced it against the real, unmodified source exactly as alleged.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-descriptors.mjs","line":59,"summary":"normalizePricing() treats an object that only has an inherited batchSize (no actual input/output/cache rates) as 'has pricing', because its emptiness check counts batchSize as a real price field.","failure_scenario":"For tokenPrices = { batchSize: 100, longContext: { maxPromptTokens: 500000 } } (a longContext entry that only carries a prompt-token budget, no rates of its own), normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) computes { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: 100 }. Because Object.values(pricing).some(entry => entry !== null) (line 59) is true (batchSize is non-null), the function returns this object instead of null, so extractModelDescriptors' pricing.longContext ends up non-null with every rate field null. A consumer that treats a non-null pricing.longContext as 'this model has distinct long-context pricing' will show/act on pricing that doesn't actually exist.","verdict":{"reasoning":"Empirically reproduced the exact scenario from the claim by executing the real code (node -e importing shared/model-descriptors.mjs): normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) with a longContext object containing only maxPromptTokens returns { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: <inherited> } instead of null, because the emptiness check at line 59 (Object.values(pricing).some(entry => entry !== null)) iterates over all five pricing keys including batchSize, and batchSize is always populated via the fallbackBatchSize parameter inherited from the parent tokenPrices object. This is a genuine logic defect: batchSize is meant only as a conversion factor for when real per-tier rates exist, not as evidence that the tier itself carries distinct pricing, so it should be excluded from the emptiness check. I additionally traced a concrete real-world consumer (server/public/app/bootstrap.js updateModelPricingDetails) that treats a non-null pricing.longContext as present, and due to Number(null) === 0 being finite, it would render '0 credits' for every rate field rather than skipping display — an actively misleading UI outcome, not just an inert data-shape quirk. The existing test suite (model-switching.test.mjs) only covers longContext objects that DO have explicit inputPrice/outputPrice, so this edge case is untested and unguarded. This is a real, demonstrable bug, not a false positive.","refuted":false}}],"totalRaw":4,"totalConfirmed":4},"agentCount":7,"logs":["4 raw findings from 3 reviewers, verifying each..."],"durationMs":927637,"summary":"Review shared/model-* modules for correctness bugs via parallel lensed reviewers plus adversarial verification","workflowName":"review-shared-model-modules","status":"completed","startTime":1786980733680,"phases":[{"title":"Review"},{"title":"Verify"}],"defaultModel":"claude-sonnet-5","workflowProgress":[{"type":"workflow_phase","index":1,"title":"Review"},{"type":"workflow_phase","index":2,"title":"Verify"},{"type":"workflow_agent","index":1,"label":"review:logic","phaseIndex":1,"phaseTitle":"Review","agentId":"aea17f1059dee40cc","model":"claude-sonnet-5","state":"done","startedAt":1786980733726,"queuedAt":1786980733706,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for general logic/correctness bugs: wrong conditionals, off-by-one errors, incorrect boolean logic, wrong operator precedence, mis-ordered comparisons, incorrect return values, or logic that contradicts the module's apparent intent (infer intent from naming, comments, and the sibling test file).\n\nThis review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only …","lastProgressAt":1786980993780,"tokens":62208,"toolCalls":27,"durationMs":260054,"resultPreview":"{\"findings\":[{\"file\":\"/workspace/copilot-remote/shared/model-id.mjs\",\"line\":108,\"summary\":\"canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.\",\"failure_scenario\":\"canonicalizeModelId('openai/o1') returns 'op…"},{"type":"workflow_agent","index":2,"label":"review:async-error-handling","phaseIndex":1,"phaseTitle":"Review","agentId":"ad1e58c72b13f1015","model":"claude-sonnet-5","state":"done","startedAt":1786980733728,"queuedAt":1786980733707,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for async/concurrency/error-handling bugs: unhandled promise rejections, missing awaits, race conditions, incorrect error propagation/swallowing, incorrect use of try/catch, stale closures over mutable state, or timing assumptions that don't hold.\n\nThis review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only use Read/Grep/Bash(read-only inspection) tools.\n\n…","lastProgressAt":1786980852956,"tokens":39063,"toolCalls":17,"durationMs":119228,"resultPreview":"{\"findings\":[]}"},{"type":"workflow_agent","index":3,"label":"review:edge-cases-data","phaseIndex":1,"phaseTitle":"Review","agentId":"ac360fa786779ed28","model":"claude-sonnet-5","state":"done","startedAt":1786980852958,"queuedAt":1786980733707,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for edge-case and data-validation bugs: null/undefined handling, malformed or unexpected input shapes, boundary conditions (empty arrays/strings, zero, negative numbers), incorrect assumptions about external data (e.g. API responses, file contents, env vars), and mutation of shared/cached state that could leak across calls.\n\nThis review is READ-ONLY. Do not edit, write, or oth…","lastProgressAt":1786981287222,"tokens":71437,"toolCalls":26,"durationMs":434264,"resultPreview":"{\"findings\":[{\"file\":\"/workspace/copilot-remote/shared/model-id.mjs\",\"line\":108,\"summary\":\"canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.\",\"failure_scenario\":\"canonicalizeModelId('openai/o1') returns 'openai/o1' unchanged: it only strips a provider prefix whe…"},{"type":"workflow_agent","index":4,"label":"verify:model-id.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a5391ad841f01a0ed","model":"claude-sonnet-5","state":"done","startedAt":1786981287253,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Directly reproduced the failure by running the real module:…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-id.mjs (near line 108).\n\nClaim: canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.\nAlleged failure scenario: canon…","lastProgressAt":1786981398337,"tokens":31376,"toolCalls":13,"durationMs":111084,"resultPreview":"{\"reasoning\":\"Directly reproduced the failure by running the real module: canonicalizeModelId('openai/o1') === 'openai/o1' (unstripped) while canonicalizeModelId('openai/o1-preview') === 'o1-preview' (stripped), and filterValidModelIds(['o1','openai/o1']) === ['o1','openai/o1'] (two entries instead of one). Root cause matches the claim exactly: BASE_MODEL_PREFIXES (derived from MODEL_ID_PREFIXES f…"},{"type":"workflow_agent","index":5,"label":"verify:model-id.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"acb2d28c2e0ed0942","model":"claude-sonnet-5","state":"done","startedAt":1786981287255,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Directly executed the real code from shared/model-id.mjs (N…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-id.mjs (near line 108).\n\nClaim: canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.\nAlleged failure scenario: canonicalizeModelId('openai/o1') returns 'openai/o1' unchange…","lastProgressAt":1786981407901,"tokens":30236,"toolCalls":17,"durationMs":120646,"resultPreview":"{\"reasoning\":\"Directly executed the real code from shared/model-id.mjs (Node, --input-type=module) and reproduced the exact scenario: canonicalizeModelId('openai/o1') === 'openai/o1' (unchanged) while canonicalizeModelId('o1') === 'o1'; both pass isValidModelId (true special-casing of bare o1/o3 in isLikelyModelIdPrefix line 37-41 and isOpenAIModelId line 94-106); filterValidModelIds(['o1','openai…"},{"type":"workflow_agent","index":6,"label":"verify:model-descriptors.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a811a30b41823ae7d","model":"claude-sonnet-5","state":"done","startedAt":1786981398339,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"I read shared/model-descriptors.mjs in full and directly ex…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-descriptors.mjs (near line 77).\n\nClaim: extractModelDescriptors' context-limit fallback (findContextLimitTokens) recurses into the same container keys ('data'/'models'/'list'/etc.) that extractModelDescriptors itself uses to find sibling model entries, so a model with no usable pricing/limits fields o…","lastProgressAt":1786981661319,"tokens":52733,"toolCalls":29,"durationMs":262979,"resultPreview":"{\"reasoning\":\"I read shared/model-descriptors.mjs in full and directly executed the unmodified module with the exact reproduction case from the claim: extractModelDescriptors({ id: 'gpt-5.4', data: [{ id: 'gpt-5.4-mini', contextWindow: 8000 }] }). The output shows both 'gpt-5.4' and 'gpt-5.4-mini' get contextLimitTokens: 8000, confirming the claim's central assertion exactly.\\n\\nMechanism verified…"},{"type":"workflow_agent","index":7,"label":"verify:model-descriptors.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a07c1f8a2c0589996","model":"claude-sonnet-5","state":"done","startedAt":1786981407902,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Empirically reproduced the exact scenario from the claim by…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-descriptors.mjs (near line 59).\n\nClaim: normalizePricing() treats an object that only has an inherited batchSize (no actual input/output/cache rates) as 'has pricing', because its emptiness check counts batchSize as a real price field.\nAlleged failure scenario: For tokenPrices = { batchSize: 100, long…","lastProgressAt":1786981552276,"tokens":34445,"toolCalls":15,"durationMs":144374,"resultPreview":"{\"reasoning\":\"Empirically reproduced the exact scenario from the claim by executing the real code (node -e importing shared/model-descriptors.mjs): normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) with a longContext object containing only maxPromptTokens returns { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: <inherited> } instead of null, because the emp…"}],"totalTokens":321498,"totalToolCalls":144}