@oneharness/sdk 0.11.4 → 0.12.1

package/dist/generated/history.d.ts

@@ -8,7 +8,7 @@ export type HistoryRecord = ({
     [k: string]: unknown;
 } | ({
     error: string;
-    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 } & ({
     status?: "nonzero" | "timeout" | "cancelled" | "spawn-error" | "skipped" | undefined;
@@ -20,27 +20,40 @@ export type HistoryRecord = ({
     work?: null | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.7" | undefined;
+    schema_version?: "1.7" | "1.8" | undefined;
     status?: "nonzero" | "timeout" | "cancelled" | undefined;
     work: "done" | "none";
     [k: string]: unknown;
+}) & ({
+    observed_model?: null | undefined;
+    [k: string]: unknown;
+} | {
+    observed_model: string;
+    schema_version?: "1.8" | undefined;
+    [k: string]: unknown;
 }) & ({
     status?: "ok" | "nonzero" | "timeout" | "spawn-error" | "skipped" | "planned" | undefined;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.4" | "1.5" | "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & (({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch" | null;
+    [k: string]: unknown;
+} | {
+    schema_version?: "1.5" | "1.6" | "1.7" | "1.8" | undefined;
+    [k: string]: unknown;
+}) & ({
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "model_mismatch" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.5" | "1.6" | "1.7" | undefined;
+    schema_version?: "1.6" | "1.7" | "1.8" | undefined;
     [k: string]: unknown;
 }) & ({
-    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | null;
+    failure_kind?: "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | null;
     [k: string]: unknown;
 } | {
-    schema_version?: "1.6" | "1.7" | undefined;
+    schema_version?: "1.8" | undefined;
     [k: string]: unknown;
 })) & ({
     duration_ms: number;
@@ -113,7 +126,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms: number;
@@ -122,6 +138,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -137,7 +169,7 @@ export type HistoryRecord = ({
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -255,7 +287,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels1 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms: number;
@@ -264,6 +299,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -375,7 +426,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels2 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -384,6 +438,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -399,7 +469,7 @@ export type HistoryRecord = ({
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -483,7 +553,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels3 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -492,6 +565,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms: number;
     /**
      * The normalized approval mode requested for the run.
@@ -507,7 +596,7 @@ export type HistoryRecord = ({
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -591,7 +680,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels4 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -600,6 +692,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -615,7 +723,7 @@ export type HistoryRecord = ({
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.2" | "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -699,7 +807,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels5 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -708,6 +819,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -723,7 +850,7 @@ export type HistoryRecord = ({
      * run's single prompt).
      */
     prompt: string;
-    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7";
+    schema_version: "1.3" | "1.4" | "1.5" | "1.6" | "1.7" | "1.8";
     /**
      * The oneharness session id this run belongs to (the history file's stem).
      */
@@ -810,7 +937,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels6 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -819,6 +949,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -933,7 +1079,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels7 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: never | undefined;
@@ -942,6 +1091,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     observed_tool_ms?: never | undefined;
     /**
      * The normalized approval mode requested for the run.
@@ -1044,7 +1209,10 @@ export type HistoryRecord = ({
     history_id: string;
     labels?: HistoryLabels8 | undefined;
     /**
-     * The effective top-level model for the run, if any.
+     * The model this run **requested** — the value oneharness put on the
+     * harness's model flag or protocol frame — if any. Copied from
+     * [`RunResult::model`], so it keeps meaning the requested model even where
+     * `observed_model` below is present.
      */
     model: string | null;
     model_ms?: number | null | undefined;
@@ -1053,6 +1221,22 @@ export type HistoryRecord = ({
      * every record so a reader can resolve a session by name from any line.
      */
     name: string;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` /
+     * `thread/resume` response. Copied from [`RunResult::observed_model`]:
+     * never inferred and never copied from `model`, and omitted on the wire on
+     * every path that reports none.
+     *
+     * On a completed app-server turn the two agree, because a turn whose
+     * reported model differed from the requested one was refused before it
+     * ran (`model_mismatch`) — so a completed record's `model` is what codex
+     * ran, and the record can no longer say one model while another was
+     * billed. They differ only on such a refused record, and where no model
+     * was requested at all. Gated to [`FIRST_MODEL_OBSERVATION_SCHEMA_VERSION`].
+     */
+    observed_model?: string | null | undefined;
     /**
      * Union of tool intervals observed at the stdout pipe. Unlike `tool_ms`,
      * this is not provider-measured and has no model-latency counterpart.
@@ -1139,7 +1323,7 @@ export type TimingSource = "provider_measured" | "stdout_observed";
  * the report, history) one definition to share instead of scattered string
  * literals.
  */
-export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large";
+export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch";
 /**
  * The outcome of attempting to run one harness.
  */

package/dist/generated/run-stream-envelope.d.ts

@@ -79,7 +79,7 @@ export type ControlVerb = "interrupt";
  * new variant is a report `schema_version` bump like any other enum value, since
  * a consumer matching exhaustively learns of it only from the version.
  */
-export type FallThroughReason = "not-installed" | "spawn-error" | "auth" | "quota" | "session-not-found" | "untrusted-directory" | "input-too-large" | "model-not-found" | "rate-limit";
+export type FallThroughReason = "not-installed" | "spawn-error" | "auth" | "quota" | "session-not-found" | "untrusted-directory" | "input-too-large" | "model-mismatch" | "model-not-found" | "rate-limit";
 /**
  * The normalized, closed set of failure reasons oneharness can classify from a
  * harness's output. It is the single source for the `failure_kind` contract
@@ -91,7 +91,7 @@ export type FallThroughReason = "not-installed" | "spawn-error" | "auth" | "quot
  * the report, history) one definition to share instead of scattered string
  * literals.
  */
-export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large";
+export type FailureKind = "auth" | "rate_limit" | "model_not_found" | "quota" | "session_not_found" | "tool_deferred" | "untrusted_directory" | "input_too_large" | "model_mismatch";
 /**
  * How a harness emits its result, which decides how `text` is extracted.
  *
@@ -382,7 +382,8 @@ export interface FallbackReport {
      * The candidates fallen through because they could not run the task at all,
      * in priority order, each with why (`not-installed`, `spawn-error`, `auth`,
      * `quota`, `session-not-found`, `untrusted-directory`, `input-too-large`,
-     * and — on a model fan-out — `model-not-found` / `rate-limit`; see
+     * `model-mismatch`, and — on a model fan-out — `model-not-found` /
+     * `rate-limit`; see
      * [`crate::domain::fallback::startup_failure_reason`]).
      */
     fell_through: FallThrough[];
@@ -397,13 +398,16 @@ export interface FallbackReport {
      * [`RunResult::work`] read [`RunWork::None`] on a failure no classifier
      * recognized.
      *
-     * The chain still stops there, deliberately: re-running a task that may
-     * genuinely have failed for free would burn the next identity's quota on
-     * the same failure, which is worse than stopping (see
+     * The chain still stops there, deliberately — decided, not inherited:
+     * empty accounting is the absence of work evidence, not proof nothing was
+     * spent, so handing the candidate on could bill a task twice (the decision
+     * and its reasoning are stated once, at
      * [`crate::domain::fallback::startup_failure_reason`]). What this flag adds
      * is the *attribution* — without it a candidate that never got started reads
      * in the report exactly like one that tried the task and failed it, and the
-     * remaining candidates look untried for a reason nobody can name.
+     * remaining candidates look untried for a reason nobody can name — and the
+     * failure summary carries the candidate's own words beside it, so the
+     * reader left holding that one line can act on the cause.
      *
      * `false` whenever `ran` is `null` (no candidate ran at all — every one is
      * in `fell_through`, each with its reason).
@@ -489,7 +493,8 @@ export interface RunResult {
      * Best-effort failure reason; `null` when unclassified. Distinct from
      * `status`, which records oneharness's relationship to the process. Two
      * families: coarse reasons for a non-zero run (`auth`, `rate_limit`,
-     * `model_not_found`, `quota`, `session_not_found`), and `tool_deferred` — a run that exited
+     * `model_not_found`, `quota`, `session_not_found`, `untrusted_directory`,
+     * `input_too_large`, `model_mismatch`), and `tool_deferred` — a run that exited
      * *cleanly* but only deferred a builtin tool call instead of executing it
      * (Claude Code bridge/managed deployments), so it did no useful work. The
      * deferred case is the only `failure_kind` that can appear on a `status: ok`
@@ -519,6 +524,17 @@ export interface RunResult {
      * without parsing the argv.
      */
     model: string | null;
+    /**
+     * The model the harness **itself** reported the conversation would run
+     * under, read off its own protocol before any token was spent — for codex
+     * over `app-server`, `result.model` of the `thread/start` / `thread/resume`
+     * response. `null` on every path that reports none, which today is every
+     * path but codex's app-server. Never inferred and never copied from
+     * `model`: where both are set they are the requested model and the served
+     * one, and a difference between them is exactly the `model_mismatch`
+     * refusal, which this field then names the other half of.
+     */
+    observed_model: string | null;
     output_format: OutputFormat;
     /**
      * The prompt this result ran, set only on a **batch** run (one harness