@oar-sh/oar 0.9.1 → 0.9.3

package/server/claude-worker/fixtures/workflow-run-record.json

@@ -1 +0,0 @@
-{"runId":"wf_d8a3315d-fd5","timestamp":"2026-08-17T15:47:41.320Z","taskId":"wic26ymi4","script":"export const meta = {\n  name: 'review-shared-model-modules',\n  description: 'Review shared/model-* modules for correctness bugs via parallel lensed reviewers plus adversarial verification',\n  phases: [\n    { title: 'Review' },\n    { title: 'Verify' },\n  ],\n}\n\nconst FILES = [\n  '/workspace/copilot-remote/shared/model-catalog-freshness.mjs',\n  '/workspace/copilot-remote/shared/model-descriptors.mjs',\n  '/workspace/copilot-remote/shared/model-id.mjs',\n  '/workspace/copilot-remote/shared/model-refresh.mjs',\n]\n\nconst CONTEXT_NOTE = `This review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only use Read/Grep/Bash(read-only inspection) tools.\n\nTarget modules to review for CORRECTNESS BUGS (not style, not simplification):\n${FILES.map(f => `- ${f}`).join('\\n')}\n\nFor context, each module has a sibling test file (e.g. model-id.test.mjs) in the same shared/ directory — you may read those to understand intended behavior, but do not report bugs in the test files themselves, only in the four modules listed above. Also feel free to grep the wider repo (rg -n \"modelId\\\\(\" or similar) to see how these modules are actually called, since a \"correctness bug\" claim is much stronger when you can point at a real call site that would misbehave.`\n\nconst FINDINGS_SCHEMA = {\n  type: 'object',\n  properties: {\n    findings: {\n      type: 'array',\n      items: {\n        type: 'object',\n        properties: {\n          file: { type: 'string', description: 'absolute path' },\n          line: { type: 'number' },\n          summary: { type: 'string', description: 'one sentence statement of the defect' },\n          failure_scenario: { type: 'string', description: 'concrete input/state that triggers wrong output or a crash' },\n        },\n        required: ['file', 'summary', 'failure_scenario'],\n      },\n    },\n  },\n  required: ['findings'],\n}\n\nconst VERDICT_SCHEMA = {\n  type: 'object',\n  properties: {\n    refuted: { type: 'boolean', description: 'true if this is NOT a real bug (false positive, intended behavior, unreachable, etc.)' },\n    reasoning: { type: 'string' },\n  },\n  required: ['refuted', 'reasoning'],\n}\n\nconst LENSES = [\n  {\n    key: 'logic',\n    prompt: `Review these modules for general logic/correctness bugs: wrong conditionals, off-by-one errors, incorrect boolean logic, wrong operator precedence, mis-ordered comparisons, incorrect return values, or logic that contradicts the module's apparent intent (infer intent from naming, comments, and the sibling test file).\\n\\n${CONTEXT_NOTE}`,\n  },\n  {\n    key: 'async-error-handling',\n    prompt: `Review these modules for async/concurrency/error-handling bugs: unhandled promise rejections, missing awaits, race conditions, incorrect error propagation/swallowing, incorrect use of try/catch, stale closures over mutable state, or timing assumptions that don't hold.\\n\\n${CONTEXT_NOTE}`,\n  },\n  {\n    key: 'edge-cases-data',\n    prompt: `Review these modules for edge-case and data-validation bugs: null/undefined handling, malformed or unexpected input shapes, boundary conditions (empty arrays/strings, zero, negative numbers), incorrect assumptions about external data (e.g. API responses, file contents, env vars), and mutation of shared/cached state that could leak across calls.\\n\\n${CONTEXT_NOTE}`,\n  },\n]\n\nphase('Review')\nconst reviews = await parallel(LENSES.map(l => () =>\n  agent(l.prompt, { label: `review:${l.key}`, phase: 'Review', schema: FINDINGS_SCHEMA })\n))\n\nconst allFindings = reviews.filter(Boolean).flatMap(r => r.findings || [])\nlog(`${allFindings.length} raw findings from ${LENSES.length} reviewers, verifying each...`)\n\nif (allFindings.length === 0) {\n  return { confirmed: [], raw: [] }\n}\n\nphase('Verify')\nconst verified = await parallel(allFindings.map(f => () =>\n  agent(\n    `Adversarially verify this correctness-bug claim about ${f.file}${f.line ? ` (near line ${f.line})` : ''}.\\n\\nClaim: ${f.summary}\\nAlleged failure scenario: ${f.failure_scenario}\\n\\nRead the actual file (and its sibling test file, and real call sites elsewhere in the repo if useful) and determine whether this is a REAL bug or a false positive. Be skeptical — default to refuted=true if you cannot concretely demonstrate the failure scenario actually occurs given the real code. Do not modify any files.`,\n    { label: `verify:${f.file.split('/').pop()}`, phase: 'Verify', schema: VERDICT_SCHEMA }\n  ).then(v => ({ ...f, verdict: v }))\n))\n\nconst confirmed = verified.filter(Boolean).filter(v => v.verdict && v.verdict.refuted === false)\n\nreturn { confirmed, totalRaw: allFindings.length, totalConfirmed: confirmed.length }\n","scriptPath":"/workspace/.claude/projects/-workspace-copilot-remote/00000000-0000-4000-8000-000000000000/workflows/scripts/review-shared-model-modules-wf_d8a3315d-fd5.js","result":{"confirmed":[{"file":"/workspace/copilot-remote/shared/model-id.mjs","line":108,"summary":"canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.","failure_scenario":"canonicalizeModelId('openai/o1') returns 'openai/o1' instead of 'o1' (compare canonicalizeModelId('openai/o1-preview') -> 'o1-preview', which strips correctly). Root cause: BASE_MODEL_PREFIXES (line 17) is derived by filtering MODEL_ID_PREFIXES down to entries without '/', giving ['gpt-','chatgpt-','claude-','gemini-','mai-','o1-','o3-','o4-','codex-'] — only the dash-suffixed 'o1-'/'o3-' forms, not the bare 'o1'/'o3' ids that isLikelyModelIdPrefix (line 39) and isOpenAIModelId (line 96) explicitly special-case as valid standalone model ids. As a result, in canonicalizeModelId's loop (lines 111-118), stripped='o1' never matches any BASE_MODEL_PREFIXES entry via startsWith, so the function falls through to `return candidate` and keeps the redundant 'openai/' prefix. Concretely: filterValidModelIds(['o1', 'openai/o1']) returns ['o1', 'openai/o1'] as two distinct entries instead of deduping to one, defeating the documented intent of filterValidModelIds ('filterValidModelIds dedupes case and provider aliases' per the sibling test) for exactly the two model ids ('o1'/'o3') the file goes out of its way to special-case elsewhere. This is not a purely theoretical shape: server/services/session-worker-launch-service.mjs:34-41 (resolveOpenAIWireApi) explicitly normalizes and compares against both the bare and 'openai/'-prefixed forms of 'o1'/'o3', confirming provider-prefixed bare ids are a real input shape in this codebase; any catalog/dedup path built on canonicalizeModelId (e.g. server-runtime.mjs's baseModelId/model-metadata maps keyed by canonicalizeModelId) would treat 'o1' and 'openai/o1' as two separate models instead of one.","verdict":{"reasoning":"Directly reproduced the failure by running the real module: canonicalizeModelId('openai/o1') === 'openai/o1' (unstripped) while canonicalizeModelId('openai/o1-preview') === 'o1-preview' (stripped), and filterValidModelIds(['o1','openai/o1']) === ['o1','openai/o1'] (two entries instead of one). Root cause matches the claim exactly: BASE_MODEL_PREFIXES (derived from MODEL_ID_PREFIXES filtered to entries without '/') only contains the dashed forms 'o1-'/'o3-', so the startsWith check in canonicalizeModelId's stripping loop never matches the bare stripped remainder 'o1'/'o3', even though isLikelyModelIdPrefix and isOpenAIModelId in the same file explicitly special-case bare 'o1'/'o3' as valid standalone OpenAI model ids. This is an inconsistency within the module's own stated design (provider prefixes should be redundant/stripped for known base model families) for exactly the two families it special-cases elsewhere. Confirmed the sibling test file (shared/model-id.test.mjs) has a test 'filterValidModelIds dedupes case and provider aliases' that verifies this dedup behavior for gpt-*/claude-* families but does not cover o1/o3, so this gap is untested and the existing test suite passes despite the bug. Also confirmed bare/prefixed 'o1'/'o3' handling is a real, non-hypothetical shape used elsewhere (server/services/session-worker-launch-service.mjs resolveOpenAIWireApi explicitly strips 'openai/' and checks both bare and dashed o1/o3 forms), and canonicalizeModelId/filterValidModelIds are used in real dedup/catalog paths in server/server-runtime.mjs and shared/model-refresh.mjs. This is a real, concretely demonstrated correctness bug.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-id.mjs","line":108,"summary":"canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.","failure_scenario":"canonicalizeModelId('openai/o1') returns 'openai/o1' unchanged: it only strips a provider prefix when the remainder starts with one of BASE_MODEL_PREFIXES (line 17), and every one of those prefixes requires a trailing '-', e.g. 'o1-', so bare 'o1' never matches. canonicalizeModelId('o1') separately returns 'o1'. Both 'o1' and 'openai/o1' independently pass isValidModelId (isLikelyModelIdPrefix at line 37 and isOpenAIModelId at line 94 both special-case bare 'o1'/'o3'), so filterValidModelIds(['o1', 'openai/o1']) returns ['o1', 'openai/o1'] as two distinct entries instead of collapsing to one, unlike every other provider-prefixed pair (verified: filterValidModelIds(['GPT-5.4','openai/gpt-5.4']) correctly collapses to a single 'gpt-5.4'). Any caller merging model lists that mix bare and provider-prefixed o1/o3 ids (e.g. selectModelIdsForVariantRefresh's snapshotModels, or server-runtime.mjs's validatedModelIdList) will surface the same underlying model twice.","verdict":{"reasoning":"Directly executed the real code from shared/model-id.mjs (Node, --input-type=module) and reproduced the exact scenario: canonicalizeModelId('openai/o1') === 'openai/o1' (unchanged) while canonicalizeModelId('o1') === 'o1'; both pass isValidModelId (true special-casing of bare o1/o3 in isLikelyModelIdPrefix line 37-41 and isOpenAIModelId line 94-106); filterValidModelIds(['o1','openai/o1']) returns ['o1','openai/o1'] (2 entries) whereas the analogous filterValidModelIds(['GPT-5.4','openai/gpt-5.4']) correctly collapses to ['gpt-5.4']. Root cause verified by reading the code: BASE_MODEL_PREFIXES (line 17) is derived from MODEL_ID_PREFIXES entries that lack '/', giving ['gpt-','chatgpt-','claude-','gemini-','mai-','o1-','o3-','o4-','codex-'] — all require a trailing '-', so stripping 'openai/' from 'openai/o1' leaves 'o1', which does not start with 'o1-', so the strip-and-return branch in canonicalizeModelId (line 108-120) never fires and the function falls through to returning the original unstripped candidate. This asymmetry does not occur for any other prefix family (verified openai/o1-mini -> o1-mini works fine) because those always retain their trailing dash in the stripped remainder. Confirmed this is reachable via real call sites: shared/model-refresh.mjs's selectModelIdsForVariantRefresh merges snapshotModels with currentModel/defaultModel through filterValidModelIds, and server/server-runtime.mjs's validatedModelIdList wraps filterValidModelIds identically, matching the claim's alleged caller impact. Also confirmed provider-prefixed ids like 'openai/gpt-5.4' are real formats already used elsewhere in the repo (server/relay.mjs, web-relay model-switching.mjs), making the prefixed input plausible rather than purely synthetic. Ran the full existing test suite (14 tests, all passing) and confirmed there is no test covering the bare-vs-prefixed o1/o3 dedup case, despite adjacent tests explicitly covering bare o1/o3 validity and provider-alias dedup for other families separately — a clear coverage gap consistent with an unintended bug rather than documented/intended behavior. All specifics in the claim (line numbers, function names, exact input/output values) check out against the real file contents and real execution. This is a concrete, reproducible correctness bug, not a false positive.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-descriptors.mjs","line":77,"summary":"extractModelDescriptors' context-limit fallback (findContextLimitTokens) recurses into the same container keys ('data'/'models'/'list'/etc.) that extractModelDescriptors itself uses to find sibling model entries, so a model with no usable pricing/limits fields of its own can silently inherit a sibling model's context-window value.","failure_scenario":"For raw = { id: 'gpt-5.4', data: [ { id: 'gpt-5.4-mini', contextWindow: 8000 } ] }, extractModelDescriptors(raw) yields contextLimitTokens: 8000 for BOTH the 'gpt-5.4' and 'gpt-5.4-mini' descriptors (reproduced by running the module directly), even though the 8000-token window only belongs to 'gpt-5.4-mini'. This happens because contextLimitForTier() (lines 62-78) falls back to findContextLimitTokens(value) (line 77) whenever a model object has no tokenPrices/limits fields of its own; findContextLimitTokens (lines 9-28) then walks every nested object property of the model, including the same containerKeys ('data','models','list','available','items','entries','result','response' at line 81) that extractModelDescriptors (lines 107-109) separately recurses into to discover additional sibling models. Any upstream RPC/API shape that nests a list of related models under one of those container keys inside an outer model-shaped object (plausible given extractModelDescriptors explicitly supports several heterogeneous list-wrapper shapes across client.listModels()/models.list/modelApi.list in server/relay.mjs) will cross-contaminate context-limit data between unrelated models.","verdict":{"reasoning":"I read shared/model-descriptors.mjs in full and directly executed the unmodified module with the exact reproduction case from the claim: extractModelDescriptors({ id: 'gpt-5.4', data: [{ id: 'gpt-5.4-mini', contextWindow: 8000 }] }). The output shows both 'gpt-5.4' and 'gpt-5.4-mini' get contextLimitTokens: 8000, confirming the claim's central assertion exactly.\n\nMechanism verified by code inspection: contextLimitForTier (line 62-78) falls back to findContextLimitTokens(value) at line 77 when a model object has no own limits/tokenPrices fields, passing the model's *entire* raw object (including any container-key properties it happens to carry). findContextLimitTokens (lines 9-28) recurses into Object.values(value) with zero awareness of the containerKeys array ['data','models','list','available','items','entries','result','response'] that extractModelDescriptors (lines 80-81, 107-109) separately uses to walk into sibling model lists. So when a model-shaped object (has its own valid id) also happens to carry one of those container keys holding sibling model data, findContextLimitTokens will happily discover and return the sibling's contextWindow/maxContextTokens/etc. value as if it belonged to the outer model. This is a genuine, unambiguous logic defect in the shared helper — not a misreading of the code.\n\nI additionally checked reachability against real call sites (server/relay.mjs, .github/extensions/web-relay/model-api/model-switching.mjs, and the installed @github/copilot SDK's rpc.d.ts/types.d.ts for Model/ModelInfo/ModelList). Today's actual known upstream shape is `{ models: Model[] }`, where the wrapper object itself has no id/modelId/model field (so it's never treated as a \"model\" whose fallback search would run), and each individual Model/ModelInfo only carries id/name/capabilities/policy/billing — never a nested container-key list of sibling models inside a single model object. So the specific pathological input isn't produced by any currently-known real RPC response in this repo, and the existing test suite (model-switching.test.mjs) doesn't cover it. However, the claim itself is hedged appropriately (\"any upstream RPC/API shape that nests...\") and the function is explicitly written as a generic, defensive parser meant to tolerate multiple heterogeneous list-wrapper shapes across several different call sites/providers, so this is a real latent correctness defect in shared code (silent cross-contamination of per-model metadata) rather than a purely theoretical/unreachable construct — I concretely reproduced it against the real, unmodified source exactly as alleged.","refuted":false}},{"file":"/workspace/copilot-remote/shared/model-descriptors.mjs","line":59,"summary":"normalizePricing() treats an object that only has an inherited batchSize (no actual input/output/cache rates) as 'has pricing', because its emptiness check counts batchSize as a real price field.","failure_scenario":"For tokenPrices = { batchSize: 100, longContext: { maxPromptTokens: 500000 } } (a longContext entry that only carries a prompt-token budget, no rates of its own), normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) computes { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: 100 }. Because Object.values(pricing).some(entry => entry !== null) (line 59) is true (batchSize is non-null), the function returns this object instead of null, so extractModelDescriptors' pricing.longContext ends up non-null with every rate field null. A consumer that treats a non-null pricing.longContext as 'this model has distinct long-context pricing' will show/act on pricing that doesn't actually exist.","verdict":{"reasoning":"Empirically reproduced the exact scenario from the claim by executing the real code (node -e importing shared/model-descriptors.mjs): normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) with a longContext object containing only maxPromptTokens returns { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: <inherited> } instead of null, because the emptiness check at line 59 (Object.values(pricing).some(entry => entry !== null)) iterates over all five pricing keys including batchSize, and batchSize is always populated via the fallbackBatchSize parameter inherited from the parent tokenPrices object. This is a genuine logic defect: batchSize is meant only as a conversion factor for when real per-tier rates exist, not as evidence that the tier itself carries distinct pricing, so it should be excluded from the emptiness check. I additionally traced a concrete real-world consumer (server/public/app/bootstrap.js updateModelPricingDetails) that treats a non-null pricing.longContext as present, and due to Number(null) === 0 being finite, it would render '0 credits' for every rate field rather than skipping display — an actively misleading UI outcome, not just an inert data-shape quirk. The existing test suite (model-switching.test.mjs) only covers longContext objects that DO have explicit inputPrice/outputPrice, so this edge case is untested and unguarded. This is a real, demonstrable bug, not a false positive.","refuted":false}}],"totalRaw":4,"totalConfirmed":4},"agentCount":7,"logs":["4 raw findings from 3 reviewers, verifying each..."],"durationMs":927637,"summary":"Review shared/model-* modules for correctness bugs via parallel lensed reviewers plus adversarial verification","workflowName":"review-shared-model-modules","status":"completed","startTime":1786980733680,"phases":[{"title":"Review"},{"title":"Verify"}],"defaultModel":"claude-sonnet-5","workflowProgress":[{"type":"workflow_phase","index":1,"title":"Review"},{"type":"workflow_phase","index":2,"title":"Verify"},{"type":"workflow_agent","index":1,"label":"review:logic","phaseIndex":1,"phaseTitle":"Review","agentId":"aea17f1059dee40cc","model":"claude-sonnet-5","state":"done","startedAt":1786980733726,"queuedAt":1786980733706,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for general logic/correctness bugs: wrong conditionals, off-by-one errors, incorrect boolean logic, wrong operator precedence, mis-ordered comparisons, incorrect return values, or logic that contradicts the module's apparent intent (infer intent from naming, comments, and the sibling test file).\n\nThis review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only …","lastProgressAt":1786980993780,"tokens":62208,"toolCalls":27,"durationMs":260054,"resultPreview":"{\"findings\":[{\"file\":\"/workspace/copilot-remote/shared/model-id.mjs\",\"line\":108,\"summary\":\"canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.\",\"failure_scenario\":\"canonicalizeModelId('openai/o1') returns 'op…"},{"type":"workflow_agent","index":2,"label":"review:async-error-handling","phaseIndex":1,"phaseTitle":"Review","agentId":"ad1e58c72b13f1015","model":"claude-sonnet-5","state":"done","startedAt":1786980733728,"queuedAt":1786980733707,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for async/concurrency/error-handling bugs: unhandled promise rejections, missing awaits, race conditions, incorrect error propagation/swallowing, incorrect use of try/catch, stale closures over mutable state, or timing assumptions that don't hold.\n\nThis review is READ-ONLY. Do not edit, write, or otherwise modify any file. Only use Read/Grep/Bash(read-only inspection) tools.\n\n…","lastProgressAt":1786980852956,"tokens":39063,"toolCalls":17,"durationMs":119228,"resultPreview":"{\"findings\":[]}"},{"type":"workflow_agent","index":3,"label":"review:edge-cases-data","phaseIndex":1,"phaseTitle":"Review","agentId":"ac360fa786779ed28","model":"claude-sonnet-5","state":"done","startedAt":1786980852958,"queuedAt":1786980733707,"attempt":1,"lastToolName":"StructuredOutput","promptPreview":"Review these modules for edge-case and data-validation bugs: null/undefined handling, malformed or unexpected input shapes, boundary conditions (empty arrays/strings, zero, negative numbers), incorrect assumptions about external data (e.g. API responses, file contents, env vars), and mutation of shared/cached state that could leak across calls.\n\nThis review is READ-ONLY. Do not edit, write, or oth…","lastProgressAt":1786981287222,"tokens":71437,"toolCalls":26,"durationMs":434264,"resultPreview":"{\"findings\":[{\"file\":\"/workspace/copilot-remote/shared/model-id.mjs\",\"line\":108,\"summary\":\"canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.\",\"failure_scenario\":\"canonicalizeModelId('openai/o1') returns 'openai/o1' unchanged: it only strips a provider prefix whe…"},{"type":"workflow_agent","index":4,"label":"verify:model-id.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a5391ad841f01a0ed","model":"claude-sonnet-5","state":"done","startedAt":1786981287253,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Directly reproduced the failure by running the real module:…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-id.mjs (near line 108).\n\nClaim: canonicalizeModelId fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' canonicalize to different strings even though the rest of the module treats bare 'o1'/'o3' as first-class, equivalent model ids.\nAlleged failure scenario: canon…","lastProgressAt":1786981398337,"tokens":31376,"toolCalls":13,"durationMs":111084,"resultPreview":"{\"reasoning\":\"Directly reproduced the failure by running the real module: canonicalizeModelId('openai/o1') === 'openai/o1' (unstripped) while canonicalizeModelId('openai/o1-preview') === 'o1-preview' (stripped), and filterValidModelIds(['o1','openai/o1']) === ['o1','openai/o1'] (two entries instead of one). Root cause matches the claim exactly: BASE_MODEL_PREFIXES (derived from MODEL_ID_PREFIXES f…"},{"type":"workflow_agent","index":5,"label":"verify:model-id.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"acb2d28c2e0ed0942","model":"claude-sonnet-5","state":"done","startedAt":1786981287255,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Directly executed the real code from shared/model-id.mjs (N…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-id.mjs (near line 108).\n\nClaim: canonicalizeModelId() fails to strip the provider prefix from bare 'o1'/'o3' model ids, so 'openai/o1' and 'o1' are treated as two different canonical ids instead of deduping to one.\nAlleged failure scenario: canonicalizeModelId('openai/o1') returns 'openai/o1' unchange…","lastProgressAt":1786981407901,"tokens":30236,"toolCalls":17,"durationMs":120646,"resultPreview":"{\"reasoning\":\"Directly executed the real code from shared/model-id.mjs (Node, --input-type=module) and reproduced the exact scenario: canonicalizeModelId('openai/o1') === 'openai/o1' (unchanged) while canonicalizeModelId('o1') === 'o1'; both pass isValidModelId (true special-casing of bare o1/o3 in isLikelyModelIdPrefix line 37-41 and isOpenAIModelId line 94-106); filterValidModelIds(['o1','openai…"},{"type":"workflow_agent","index":6,"label":"verify:model-descriptors.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a811a30b41823ae7d","model":"claude-sonnet-5","state":"done","startedAt":1786981398339,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"I read shared/model-descriptors.mjs in full and directly ex…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-descriptors.mjs (near line 77).\n\nClaim: extractModelDescriptors' context-limit fallback (findContextLimitTokens) recurses into the same container keys ('data'/'models'/'list'/etc.) that extractModelDescriptors itself uses to find sibling model entries, so a model with no usable pricing/limits fields o…","lastProgressAt":1786981661319,"tokens":52733,"toolCalls":29,"durationMs":262979,"resultPreview":"{\"reasoning\":\"I read shared/model-descriptors.mjs in full and directly executed the unmodified module with the exact reproduction case from the claim: extractModelDescriptors({ id: 'gpt-5.4', data: [{ id: 'gpt-5.4-mini', contextWindow: 8000 }] }). The output shows both 'gpt-5.4' and 'gpt-5.4-mini' get contextLimitTokens: 8000, confirming the claim's central assertion exactly.\\n\\nMechanism verified…"},{"type":"workflow_agent","index":7,"label":"verify:model-descriptors.mjs","phaseIndex":2,"phaseTitle":"Verify","agentId":"a07c1f8a2c0589996","model":"claude-sonnet-5","state":"done","startedAt":1786981407902,"queuedAt":1786981287226,"attempt":1,"lastToolName":"StructuredOutput","lastToolSummary":"Empirically reproduced the exact scenario from the claim by…","promptPreview":"Adversarially verify this correctness-bug claim about /workspace/copilot-remote/shared/model-descriptors.mjs (near line 59).\n\nClaim: normalizePricing() treats an object that only has an inherited batchSize (no actual input/output/cache rates) as 'has pricing', because its emptiness check counts batchSize as a real price field.\nAlleged failure scenario: For tokenPrices = { batchSize: 100, long…","lastProgressAt":1786981552276,"tokens":34445,"toolCalls":15,"durationMs":144374,"resultPreview":"{\"reasoning\":\"Empirically reproduced the exact scenario from the claim by executing the real code (node -e importing shared/model-descriptors.mjs): normalizePricing(tokenPrices.longContext, tokenPrices.batchSize) with a longContext object containing only maxPromptTokens returns { input: null, output: null, cacheRead: null, cacheWrite: null, batchSize: <inherited> } instead of null, because the emp…"}],"totalTokens":321498,"totalToolCalls":144}

package/server/copilot-worker/copilot-sdk-test-harness.mjs

@@ -1,329 +0,0 @@
-// Spawn-free stand-ins for the Copilot SDK, per DEVELOPING.md: no test in this
-// directory starts a runtime process, imports the installed SDK, or talks to a
-// relay. The injection seam is a constructor option on
-// `createCopilotSdkSessionRunner` (`startClientImpl`), not a module mock.
-//
-// Deliberately NOT named `*.test.mjs` so `node --test`'s glob skips it.
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { createCopilotSdkSessionRunner } from './copilot-sdk-session-process.mjs';
-
-const FIXTURE_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fixtures');
-
-/** Load a scrubbed phase-0 event dump as an array of `SessionEvent`s. */
-export function loadFixture(name) {
-  return JSON.parse(fs.readFileSync(path.join(FIXTURE_DIR, `${name}.json`), 'utf8'));
-}
-
-export function tick(ms = 5) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-export async function waitFor(predicate, { timeoutMs = 3000, label = 'condition' } = {}) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (await predicate()) return true;
-    await tick(2);
-  }
-  throw new Error(`waitFor timed out: ${label}`);
-}
-
-/**
- * Records every relay call; `failRoutes` makes a route throw, like a 500.
- *
- * `routeResponses` maps a route to its response body, or to a function of
- * `(body, callIndexForThatRoute)` — which is how a test drives a route that
- * answers differently per attempt (`/api/continuation-turn`'s retry loop).
- * Unlisted routes answer `{}`, as before.
- */
-export function makeApiStub({ failRoutes = new Set(), routeResponses = {} } = {}) {
-  const calls = [];
-  const routeCounts = new Map();
-  async function api(method, routePath, body) {
-    calls.push({ method, routePath, body });
-    const route = String(routePath).split('?')[0];
-    if (failRoutes.has(route)) throw new Error(`stub route failure: ${route}`);
-    const attempt = routeCounts.get(route) || 0;
-    routeCounts.set(route, attempt + 1);
-    const canned = routeResponses[route];
-    if (typeof canned === 'function') return canned(body, attempt);
-    return canned === undefined ? {} : canned;
-  }
-  api.calls = calls;
-  api.bodiesFor = (routePath) => calls.filter((c) => c.routePath === routePath).map((c) => c.body);
-  return api;
-}
-
-/**
- * An api stub that mints synthetic queue rows, so a test can exercise the
- * continuation path end to end. `POST /api/continuation-turn` answers with a
- * fresh `messageId`, exactly as the relay route does.
- */
-export function makeContinuationApiStub({
-  conversationId = 'conv-1',
-  messageIds = ['cont-1', 'cont-2', 'cont-3'],
-  ...options
-} = {}) {
-  const minted = [];
-  const stub = makeApiStub({
-    ...options,
-    routeResponses: {
-      '/api/continuation-turn': (body, attempt) => {
-        const messageId = messageIds[Math.min(attempt, messageIds.length - 1)];
-        minted.push({ messageId, body });
-        return { ok: true, messageId, conversationId };
-      },
-      ...(options.routeResponses || {}),
-    },
-  });
-  stub.mintedContinuations = minted;
-  return stub;
-}
-
-/**
- * A fake CopilotSession. `send()` accepts one `MessageOptions` object (the
- * real signature: there is no second parameter) and, like the real SDK,
- * resolves immediately — the turn's completion arrives on the event callback,
- * which is what `onSend` is for.
- */
-export function createFakeCopilotSession({ config, onSend = null, onAbort = null }) {
-  const session = {
-    sessionId: config?.sessionId || 'fake-session',
-    config,
-    sends: [],
-    abortCalls: 0,
-    setModelCalls: [],
-    disconnected: false,
-    emit(event) {
-      config?.onEvent?.(event);
-    },
-    replay(events) {
-      for (const event of events) session.emit(event);
-    },
-    async send(options) {
-      session.sends.push(options);
-      // Scheduled rather than synchronous so the runner's `await session.send`
-      // resolves before the events land, matching the real ordering.
-      setTimeout(() => { onSend?.(session, options); }, 0);
-      return 'fake-message-id';
-    },
-    async abort() {
-      session.abortCalls += 1;
-      setTimeout(() => { onAbort?.(session); }, 0);
-    },
-    async setModel(model) {
-      session.setModelCalls.push(model);
-    },
-    async disconnect() {
-      session.disconnected = true;
-    },
-  };
-  return session;
-}
-
-/**
- * The two ways `resumeSession` fails, which the runner MUST tell apart.
- *
- *  - `missing`   — the runtime has no state under this id. Shaped like the
- *                  real thing: the runtime throws `Session not found: <id>`
- *                  and JSON-RPC wraps it as a generic InternalError (-32603),
- *                  so the message is the only signal.
- *  - `transient` — the call itself failed (connection dropped). Falling
- *                  through to `createSession` here would blank a live
- *                  conversation.
- */
-export function makeResumeFailure(flavor, sessionId = 'conv-1') {
-  if (flavor === 'transient') {
-    const error = new Error('Pending response rejected since connection got disposed');
-    error.code = -32097;
-    return error;
-  }
-  const error = new Error(`Request session.resume failed with message: Session not found: ${sessionId}`);
-  error.code = -32603;
-  return error;
-}
-
-/**
- * A fake CopilotClient. `resumeAvailable: false` models a brand-new
- * conversation (the runtime has no state to resume), which is what makes the
- * runner fall through to `createSession`. `resumeFailure: 'transient'` models
- * the RPC itself failing, which must NOT fall through.
- */
-export function createFakeCopilotClient({
-  resumeAvailable = false,
-  resumeFailure = 'missing',
-  onSend = null,
-  onAbort = null,
-} = {}) {
-  const client = {
-    stopped: 0,
-    resumeAttempts: [],
-    createAttempts: [],
-    sessions: [],
-    resumeAvailable,
-    resumeFailure,
-    async resumeSession(sessionId, config) {
-      client.resumeAttempts.push({ sessionId, config });
-      if (!client.resumeAvailable) throw makeResumeFailure(client.resumeFailure, sessionId);
-      const session = createFakeCopilotSession({ config, onSend, onAbort });
-      session.resumed = true;
-      client.sessions.push(session);
-      // A session that exists once exists forever, so later reconnects resume.
-      client.resumeAvailable = true;
-      return session;
-    },
-    async createSession(config) {
-      client.createAttempts.push(config);
-      const session = createFakeCopilotSession({ config, onSend, onAbort });
-      client.sessions.push(session);
-      client.resumeAvailable = true;
-      return session;
-    },
-    async stop() {
-      client.stopped += 1;
-      return [];
-    },
-  };
-  Object.defineProperty(client, 'session', {
-    get: () => client.sessions[client.sessions.length - 1] || null,
-  });
-  return client;
-}
-
-export const FAKE_SDK_PATHS = {
-  sdkDir: '/opt/copilot/pkg/linux-x64/1.0.82/copilot-sdk',
-  sdkEntry: '/opt/copilot/pkg/linux-x64/1.0.82/copilot-sdk/index.js',
-  versionDir: '/opt/copilot/pkg/linux-x64/1.0.82',
-  runtimeEntry: '/opt/copilot/pkg/linux-x64/1.0.82/app.js',
-  version: '1.0.82',
-};
-
-/** Frozen delivery message; tests derive variants by spread. */
-export const baseMessage = Object.freeze({
-  id: 'q-1',
-  conversationId: 'conv-1',
-  relayMode: 'agent',
-  text: 'hello',
-  model: 'gpt-5-mini',
-});
-
-/**
- * A stand-in for the relay question bridge.
- *
- * `answers` maps a matcher to a canned reply, so a test can drive `ask_user`
- * and ask-mode tool approvals without a relay. Every call is recorded.
- */
-export function makeFakeQuestionBridge({
-  userInputAnswer = 'the human answer',
-  userInputTimedOut = false,
-  approve = true,
-  approvalTimedOut = false,
-  approvalFeedback = 'The user declined this action.',
-  onAsk = null,
-} = {}) {
-  const bridge = {
-    userInputCalls: [],
-    approvalCalls: [],
-    cancelledCount: 0,
-    async askUserInput(request, options) {
-      bridge.userInputCalls.push({ request, options });
-      if (onAsk) await onAsk(request, options);
-      const choices = Array.isArray(request?.choices) ? request.choices : [];
-      const answer = typeof userInputAnswer === 'function' ? userInputAnswer(request) : userInputAnswer;
-      return {
-        answer,
-        wasFreeform: userInputTimedOut ? true : !choices.includes(answer),
-        timedOut: userInputTimedOut,
-      };
-    },
-    async askToolApproval(request, options) {
-      bridge.approvalCalls.push({ request, options });
-      if (onAsk) await onAsk(request, options);
-      return {
-        approved: approvalTimedOut ? false : approve,
-        answer: approve ? 'Approve' : 'Deny',
-        feedback: approvalFeedback,
-        timedOut: approvalTimedOut,
-        description: 'a tool',
-      };
-    },
-    async cancelPendingQuestions() {
-      bridge.cancelledCount += 1;
-      return 0;
-    },
-    pendingQuestionCount: () => 0,
-  };
-  return bridge;
-}
-
-/**
- * The relay-context prefix the runner prepends to every prompt, for tests that
- * assert on the prompt. `relayToolInstructions` defaults to '' in the harness,
- * so only the mode marker and the mode's standing instructions appear, and the
- * instructions only on the FIRST turn of a given relay mode.
- */
-export function expectedPromptPrefix(mode = 'agent', { includeInstructions = true } = {}) {
-  const marker = `[Relay mode: ${mode}]`;
-  if (!includeInstructions) return marker;
-  const instructions = {
-    agent: 'Proceed as an interactive coding agent and use tools as needed. If you need clarification, pause and ask through the web relay instead of stalling silently. These instructions remain in effect until relay mode changes.',
-    plan: 'Draft a concise plan only. Use read-only inspection tools (glob, rg, view) only when they materially improve plan quality; otherwise draft from provided context. Do not edit repository files or run mutating commands unless the user explicitly asks for implementation. If clarification is required, pause and ask through the web relay. These instructions remain in effect until relay mode changes.',
-    ask: 'Prioritize clarification questions before doing any implementation work. If the request is ambiguous or underspecified, pause and ask through the web relay before making assumptions. Do not make broad assumptions when a question would materially change the result. These instructions remain in effect until relay mode changes.',
-    autopilot: 'Act directly on the request and use tools when needed. Keep moving unless user input is truly blocking. These instructions remain in effect until relay mode changes.',
-  }[mode];
-  return `${marker} ${instructions}`;
-}
-
-/** The message body with the relay-context prefix in front, as sent. */
-export function promptWithPrefix(body, mode = 'agent', options = {}) {
-  return `${expectedPromptPrefix(mode, options)} ${body}`;
-}
-
-export function makeRunner({
-  stub,
-  client,
-  startWarning = null,
-  runtimeVersion = '1.0.82',
-  questionBridge = makeFakeQuestionBridge(),
-  ...overrides
-} = {}) {
-  const started = [];
-  return {
-    started,
-    questionBridge,
-    runner: createCopilotSdkSessionRunner({
-      api: stub,
-      sdkSessionId: 'conv-1',
-      cwd: '/tmp/relay-fixture-workspace',
-      resolvePathsImpl: () => FAKE_SDK_PATHS,
-      // Spawn-free and relay-free by default: no test reads the real
-      // relay-tools.md off disk or asks a relay whether previews are on.
-      relayToolInstructions: '',
-      getPreviewInstructionsImpl: () => '',
-      createQuestionBridgeImpl: () => questionBridge,
-      startClientImpl: async (options) => {
-        started.push(options);
-        return {
-          sdk: {},
-          client,
-          paths: options.paths,
-          // The real adapter never blocks client start on the version probe;
-          // it hands back a promise the runner logs when it settles.
-          versionReady: Promise.resolve({ runtimeVersion, versionSkewWarning: startWarning }),
-        };
-      },
-      ...overrides,
-    }),
-  };
-}
-
-/**
- * The events of a fixture up to and including the first one matching `type`.
- * Lets a test replay "everything through session.idle" without hand-listing.
- */
-export function eventsThrough(events, type) {
-  const index = events.findIndex((event) => event.type === type);
-  return index === -1 ? events.slice() : events.slice(0, index + 1);
-}