@the-open-engine/zeroshot 6.29.0 → 6.29.1

package/lib/target/target-session.js

@@ -1,163 +1,75 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LoginRequiredError = void 0;
+exports.TargetSessionManager = exports.LoginRequiredError = void 0;
 exports.targetLogin = targetLogin;
 exports.refreshAccessToken = refreshAccessToken;
 exports.getAccessTokenProvider = getAccessTokenProvider;
 exports.revokeAndCleanup = revokeAndCleanup;
-const device_flow_ts_1 = require("./device-flow.js");
-const credential_store_ts_1 = require("./credential-store.js");
-const target_registry_ts_1 = require("./target-registry.js");
-class LoginRequiredError extends Error {
-    targetName;
-    constructor(targetName) {
-        super(`Login required. Run: zeroshot target login ${targetName}`);
-        this.name = 'LoginRequiredError';
-        this.targetName = targetName;
-    }
+const target_session_manager_js_1 = require("./target-session-manager.js");
+var target_session_manager_js_2 = require("./target-session-manager.js");
+Object.defineProperty(exports, "LoginRequiredError", { enumerable: true, get: function () { return target_session_manager_js_2.LoginRequiredError; } });
+Object.defineProperty(exports, "TargetSessionManager", { enumerable: true, get: function () { return target_session_manager_js_2.TargetSessionManager; } });
+function transientSettings(targetName, target) {
+    const state = {
+        _targets: { [targetName]: target },
+    };
+    return {
+        load: () => state,
+        mutate: (mutator) => mutator(state),
+    };
 }
-exports.LoginRequiredError = LoginRequiredError;
-async function targetLogin(targetName, target, credentialStore, acquireLock, settings, deps) {
-    const { http, clock, browserOpener, stderr, discoveryEndpoints } = deps;
-    const { deviceAuthorizationEndpoint, tokenEndpoint, clientId } = discoveryEndpoints;
-    const codeResponse = await (0, device_flow_ts_1.requestDeviceCode)(deviceAuthorizationEndpoint, clientId, http);
-    stderr.write(`\nOpen this URL to authorize:\n  ${codeResponse.verification_uri}\n\nEnter code: ${codeResponse.user_code}\n\n`);
-    if (codeResponse.verification_uri_complete) {
-        try {
-            await browserOpener.open(codeResponse.verification_uri_complete);
-        }
-        catch {
-            // Browser open is best-effort
-        }
-    }
-    const tokenResponse = await (0, device_flow_ts_1.pollForToken)(tokenEndpoint, clientId, codeResponse.device_code, codeResponse.interval, codeResponse.expires_in, http, clock, undefined, { token: target.deviceToken, label: 'Zeroshot CLI' });
-    if (!tokenResponse.organization) {
-        throw new device_flow_ts_1.UnboundSessionError(codeResponse.verification_uri);
-    }
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-    }
-    finally {
-        await release();
-    }
-    (0, target_registry_ts_1.updateTargetOrganization)(targetName, tokenResponse.organization, settings);
-    return { organization: tokenResponse.organization };
+function legacyManager(init) {
+    const clock = init.clock ?? init.deps.clock ?? { now: () => Date.now() };
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName: init.targetName,
+        target: init.target,
+        credentialStore: init.credentialStore,
+        acquireLock: init.acquireLock,
+        settings: init.deps.settings ?? transientSettings(init.targetName, init.target),
+        deps: {
+            http: init.deps.http,
+            clock,
+            browserOpener: { open: () => Promise.resolve() },
+            stderr: { write: () => undefined },
+            discoveryEndpoints: init.deps.discoveryEndpoints,
+        },
+    });
 }
-async function refreshAccessToken(targetName, target, credentialStore, acquireLock, deps) {
-    const { http, discoveryEndpoints } = deps;
-    const { tokenEndpoint, revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const currentRefreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (!currentRefreshToken) {
-            throw new LoginRequiredError(targetName);
-        }
-        const body = new URLSearchParams({
-            grant_type: 'refresh_token',
-            refresh_token: currentRefreshToken,
-            client_id: clientId,
-            audience: 'capsule',
-        });
-        let tokenResponse;
-        const response = await http.fetch(tokenEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-        if (!response.ok) {
-            const errorBody = (await response.json().catch(() => ({ error: 'unknown' })));
-            if (errorBody.error === 'invalid_grant') {
-                await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-                throw new LoginRequiredError(targetName);
-            }
-            throw new Error(`Token refresh failed (${response.status}): ${errorBody.error}`);
-        }
-        tokenResponse = (await response.json());
-        try {
-            await credentialStore.set(serviceKey, credential_store_ts_1.TARGET_ACCOUNT, tokenResponse.refresh_token);
-        }
-        catch {
-            await bestEffortRevoke(tokenResponse.refresh_token, revocationEndpoint, clientId, http);
-            await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-            throw new LoginRequiredError(targetName);
-        }
-        return { accessToken: tokenResponse.access_token, expiresIn: tokenResponse.expires_in };
-    }
-    finally {
-        await release();
-    }
+function targetLogin(...args) {
+    const [targetName, target, credentialStore, acquireLock, settings, deps] = args;
+    return new target_session_manager_js_1.TargetSessionManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        settings,
+        deps,
+    }).login();
 }
-async function bestEffortRevoke(token, revocationEndpoint, clientId, http) {
-    if (!revocationEndpoint)
-        return;
-    try {
-        const body = new URLSearchParams({
-            token,
-            client_id: clientId,
-            token_type_hint: 'refresh_token',
-        });
-        await http.fetch(revocationEndpoint, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-            redirect: 'error',
-        });
-    }
-    catch {
-        // Best-effort
-    }
+async function refreshAccessToken(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).getAccessTokenWithLifetime('capsule');
 }
-function getAccessTokenProvider(targetName, target, credentialStore, acquireLock, deps, clock = { now: () => Date.now() }) {
-    let cachedToken = null;
-    let expiresAt = 0;
-    return {
-        async getAccessToken(_signal) {
-            if (cachedToken && clock.now() < expiresAt - 30_000) {
-                return cachedToken;
-            }
-            const result = await refreshAccessToken(targetName, target, credentialStore, acquireLock, deps);
-            cachedToken = result.accessToken;
-            expiresAt = clock.now() + result.expiresIn * 1000;
-            return result.accessToken;
-        },
-    };
+function getAccessTokenProvider(...args) {
+    const [targetName, target, credentialStore, acquireLock, deps, clock] = args;
+    return legacyManager({
+        targetName,
+        target,
+        credentialStore,
+        acquireLock,
+        deps,
+        ...(clock === undefined ? {} : { clock }),
+    }).tokenProvider('capsule');
 }
-async function revokeAndCleanup(target, credentialStore, acquireLock, deps, force) {
-    const { http, discoveryEndpoints } = deps;
-    const { revocationEndpoint, clientId } = discoveryEndpoints;
-    const serviceKey = (0, credential_store_ts_1.targetServiceKey)(target.id);
-    const release = await acquireLock();
-    try {
-        const refreshToken = await credentialStore.get(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-        if (refreshToken && revocationEndpoint) {
-            const body = new URLSearchParams({
-                token: refreshToken,
-                client_id: clientId,
-                token_type_hint: 'refresh_token',
-            });
-            try {
-                const response = await http.fetch(revocationEndpoint, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                    body: body.toString(),
-                    redirect: 'error',
-                });
-                if (!response.ok && !force) {
-                    throw new Error(`Remote revocation failed (${response.status}). Use --force to remove anyway.`);
-                }
-            }
-            catch (err) {
-                if (!force)
-                    throw err;
-            }
-        }
-        await credentialStore.delete(serviceKey, credential_store_ts_1.TARGET_ACCOUNT);
-    }
-    finally {
-        await release();
-    }
+function revokeAndCleanup(...args) {
+    const [target, credentialStore, acquireLock, deps, force] = args;
+    const targetName = deps.targetName ?? target.id;
+    return legacyManager({ targetName, target, credentialStore, acquireLock, deps }).revoke(force);
 }

package/lib/target/token-response.cjs

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.d.cts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.mts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.d.ts

@@ -0,0 +1,7 @@
+export interface TokenResponse {
+    readonly access_token: string;
+    readonly refresh_token: string;
+    readonly token_type: 'Bearer';
+    readonly expires_in: number;
+}
+export declare function parseTokenResponse(value: unknown): TokenResponse;

package/lib/target/token-response.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTokenResponse = parseTokenResponse;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/lib/target/token-response.mjs

@@ -0,0 +1,48 @@
+const MAX_TOKEN_BYTES = 16 * 1024;
+const TOKEN_RESPONSE_FIELDS = [
+    'access_token',
+    'refresh_token',
+    'token_type',
+    'expires_in',
+    'refresh_expires_in',
+    'scope',
+];
+function boundedString(value, maxBytes) {
+    return typeof value === 'string' && value.length > 0 &&
+        new TextEncoder().encode(value).byteLength <= maxBytes;
+}
+function tokenFieldsValid(token) {
+    const fields = Object.keys(token);
+    return fields.length === TOKEN_RESPONSE_FIELDS.length &&
+        fields.every((key) => TOKEN_RESPONSE_FIELDS.includes(key));
+}
+function tokenLifetimesValid(token) {
+    return Number.isSafeInteger(token.expires_in) &&
+        token.expires_in > 0 &&
+        token.expires_in <= 86_400 &&
+        Number.isSafeInteger(token.refresh_expires_in) &&
+        token.refresh_expires_in > 0 &&
+        token.refresh_expires_in <= 31_536_000;
+}
+function tokenStringsValid(token) {
+    return boundedString(token.access_token, MAX_TOKEN_BYTES) &&
+        boundedString(token.refresh_token, MAX_TOKEN_BYTES) &&
+        token.token_type === 'Bearer' &&
+        boundedString(token.scope, 512) &&
+        !/[\u0000-\u001f\u007f]/.test(token.scope);
+}
+export function parseTokenResponse(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Token response is malformed');
+    }
+    const token = value;
+    if (!tokenFieldsValid(token) || !tokenLifetimesValid(token) || !tokenStringsValid(token)) {
+        throw new Error('Token response is malformed');
+    }
+    return Object.freeze({
+        access_token: token.access_token,
+        refresh_token: token.refresh_token,
+        token_type: 'Bearer',
+        expires_in: token.expires_in,
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.29.0",
+  "version": "6.29.1",
   "description": "Multi-agent orchestration engine for Claude, Codex, and Gemini",
   "main": "src/orchestrator.js",
   "bin": {
@@ -44,20 +44,20 @@
     "typecheck:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.json",
     "typecheck:hosted-target": "tsc --project tsconfig.hosted-target.json",
     "typecheck:hosted-session": "tsc --project tsconfig.hosted-session.json",
-    "test:hosted-target": "node --test tests/hosted-target/*.test.ts",
+    "test:hosted-target": "npm run build:cluster && node --test tests/hosted-target/*.test.ts",
     "test:target": "npm run build:agent-cli-provider && npm run build:target && node --test tests/target/*.test.ts",
     "typecheck:target": "tsc --project tsconfig.target.json",
     "typecheck:cluster": "tsc --project tsconfig.cluster.json",
     "lint:agent-cli-provider": "eslint \"src/agent-cli-provider/**/*.ts\" \"tests/agent-cli-provider/**/*.ts\"",
     "build:agent-cli-provider": "tsc --project tsconfig.agent-cli-provider.build.json",
     "build:target": "tsc --project tsconfig.target.build.json",
-    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
+    "build:cluster": "npm run protocol:generate && tsc --project tsconfig.cluster.cjs.json && tsc --project tsconfig.cluster.esm.json && tsc --project tsconfig.hosted-target.cjs.json && tsc --project tsconfig.hosted-target.esm.json && tsc --project tsconfig.hosted-session.cjs.json && tsc --project tsconfig.hosted-session.esm.json && node scripts/build-cluster.js",
     "test:agent-cli-provider": "node --test tests/agent-cli-provider/*.test.js",
     "test:omp": "npm run build:agent-cli-provider && node --test tests/agent-cli-provider/omp-*.test.js && node tests/run-tests.js tests/omp-rpc-watcher.test.js tests/omp-isolation-capability.test.js tests/omp-docker-auth.test.js tests/omp-docker-fresh-only.test.js",
     "test:providers:live": "npm run build:agent-cli-provider && node scripts/live-provider-smoke.js",
     "check:agent-cli-provider": "npm run check:agent-cli-provider:ci",
     "check:agent-cli-provider:ci": "npm run typecheck:agent-cli-provider && npm run lint:agent-cli-provider && npm run build:agent-cli-provider && npm run test:agent-cli-provider",
-    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js",
+    "test:cluster-client": "npm run build:cluster && node --test tests/cluster/client.test.js tests/cluster/client-lifecycle.test.js tests/cluster/parity.test.js tests/cluster/architecture.test.js tests/cluster/verifier-regressions.test.js tests/cluster/request-validation.test.js tests/hosted-session/coordinator.test.js tests/hosted-session/coordinator-cancellation.test.js",
     "test:cluster-package": "npm run build:agent-cli-provider && npm run build:cluster && npm run build:target && node --test tests/cluster/package.test.js",
     "dev:link": "npm link",
     "opcore:status": "opcore status --repo . --json",
@@ -157,9 +157,6 @@
   "files": [
     "src/",
     "lib/",
-    "!src/target/register-hosted-commands.ts",
-    "!lib/target/register-hosted-commands.js",
-    "!lib/target/register-hosted-commands.d.ts",
     "bin/",
     "cli/",
     "task-lib/",

package/scripts/build-cluster.js

@@ -6,8 +6,11 @@ const path = require('node:path');
 const root = path.resolve(__dirname, '..');
 const clusterBuildRoot = path.join(root, '.cluster-build');
 const hostedSessionBuildRoot = path.join(root, '.hosted-session-build');
+const hostedTargetBuildRoot = path.join(root, '.hosted-target-build');
 const clusterOutputRoot = path.join(root, 'lib/cluster');
 const hostedSessionOutputRoot = path.join(root, 'lib/hosted-session');
+const hostedTargetOutputRoot = path.join(root, 'lib/hosted-target');
+const targetOutputRoot = path.join(root, 'lib/target');
 
 function filesBelow(directory) {
   const entries = fs.readdirSync(directory, { withFileTypes: true });
@@ -17,6 +20,15 @@ function filesBelow(directory) {
   });
 }
 
+function declarationContent(source, localExtension) {
+  return fs
+    .readFileSync(source, 'utf8')
+    .replace(/(["'])(\.\.?\/[^"']+)\.ts\1/g, (_match, quote, specifier) => {
+      const extension = specifier.startsWith('../target/') ? '.js' : localExtension;
+      return `${quote}${specifier}${extension}${quote}`;
+    });
+}
+
 function copyBuild(sourceRoot, outputRoot, mode) {
   for (const source of filesBelow(sourceRoot)) {
     const relative = path.relative(sourceRoot, source);
@@ -32,15 +44,18 @@ function copyBuild(sourceRoot, outputRoot, mode) {
       fs.mkdirSync(path.dirname(target), { recursive: true });
       fs.writeFileSync(target, content);
     } else if (mode === 'cjs' && extension === '.ts' && relative.endsWith('.d.ts')) {
-      const target = path.join(outputRoot, relative);
-      fs.mkdirSync(path.dirname(target), { recursive: true });
-      fs.copyFileSync(source, target);
+      const base = path.join(outputRoot, relative.slice(0, -5));
+      fs.mkdirSync(path.dirname(base), { recursive: true });
+      fs.writeFileSync(`${base}.d.ts`, declarationContent(source, '.js'));
+      fs.writeFileSync(`${base}.d.cts`, declarationContent(source, '.cjs'));
+      fs.writeFileSync(`${base}.d.mts`, declarationContent(source, '.mjs'));
     }
   }
 }
 
 fs.rmSync(clusterOutputRoot, { recursive: true, force: true });
 fs.rmSync(hostedSessionOutputRoot, { recursive: true, force: true });
+fs.rmSync(hostedTargetOutputRoot, { recursive: true, force: true });
 copyBuild(path.join(clusterBuildRoot, 'cjs'), clusterOutputRoot, 'cjs');
 copyBuild(path.join(clusterBuildRoot, 'esm'), clusterOutputRoot, 'esm');
 copyBuild(
@@ -53,5 +68,10 @@ copyBuild(
   hostedSessionOutputRoot,
   'esm'
 );
+copyBuild(path.join(hostedTargetBuildRoot, 'cjs', 'hosted-target'), hostedTargetOutputRoot, 'cjs');
+copyBuild(path.join(hostedTargetBuildRoot, 'esm', 'hosted-target'), hostedTargetOutputRoot, 'esm');
+copyBuild(path.join(hostedTargetBuildRoot, 'cjs', 'target'), targetOutputRoot, 'cjs');
+copyBuild(path.join(hostedTargetBuildRoot, 'esm', 'target'), targetOutputRoot, 'esm');
 fs.rmSync(clusterBuildRoot, { recursive: true, force: true });
 fs.rmSync(hostedSessionBuildRoot, { recursive: true, force: true });
+fs.rmSync(hostedTargetBuildRoot, { recursive: true, force: true });

package/scripts/opcore-introduced-check.js

@@ -197,8 +197,6 @@ function createRequest(repo, baseline, changes, options) {
   for (const change of changes) {
     normalizeBaselineRename(baseline, change);
     if (change.kind === 'D') {
-      overlays.push({ action: 'delete', path: change.path });
-      files.push(change.path);
       continue;
     }
     const content = readAfter(repo, change, options.staged);

package/src/agent-cli-provider/adapters/codex.ts

@@ -28,7 +28,6 @@ import { parseCodexEvent } from './codex-parser';
 
 const MODEL_CATALOG: Readonly<Record<string, ModelCatalogEntry>> = {
   'gpt-5.4': { rank: 2 },
-  'openai/gpt-5.4': { rank: 2 },
   'gpt-5.5': { rank: 3 },
   'gpt-5.6': { rank: 3 },
   'gpt-5.6-sol': { rank: 3 },

package/src/cluster/client.ts

@@ -1,20 +1,23 @@
+/// <reference path="./ws.d.ts" />
 import { PROTOCOL_VERSION } from './generated/protocol.js';
 import type {
   AgentAttachParams, AgentAttachResult, ApplyParams, ApplyResult, DeleteParams, DeleteResult,
   GetParams, GetResult, InitializeParams, InitializeResult, LogsParams, LogsResult,
   PlanParams, PlanResult, ResubmitParams, ResubmitResult, RetryParams, RetryResult,
-  StopParams, StopResult, UpdateParams, UpdateResult, WatchParams, WatchResult,
+  StopParams, StopResult, UpdateParams, UpdateResult, WatchParams,
 } from './generated/protocol.js';
 import { Connection } from './connection.js';
 import type { CallOptions } from './connection.js';
-import { addSocketListener } from './socket.js';
+import { addSocketEmitterListener, addSocketListener } from './socket.js';
 import type { WebSocketLike } from './socket.js';
-import { ClusterConfigError, ClusterProtocolError, ClusterTransportError } from './errors.js';
+import { ClusterConfigError, ClusterProtocolError, ClusterTransportError, ClusterUpgradeError } from './errors.js';
 import {
   AgentAttachSubscriptionStream,
   LogsSubscriptionStream,
   WatchSubscriptionStream,
 } from './subscriptions.js';
+import type { WatchSubscription } from './subscriptions.js';
+export type { WatchSubscription } from './subscriptions.js';
 
 export interface WebSocketFactoryOptions {
   readonly headers?: Readonly<Record<string, string>>;
@@ -26,7 +29,6 @@ export interface ConnectOptions {
   readonly initialize?: InitializeParams;
   readonly headers?: Readonly<Record<string, string>>;
 }
-export interface WatchSubscription { readonly result: WatchResult; readonly stream: WatchSubscriptionStream; }
 export interface LogsSubscription { readonly result: LogsResult; readonly stream: LogsSubscriptionStream; }
 export interface AgentAttachSubscription { readonly result: AgentAttachResult; readonly stream: AgentAttachSubscriptionStream; }
 export interface CoherentWatchSubscription extends WatchSubscription { readonly snapshot: GetResult; }
@@ -131,13 +133,7 @@ async function defaultWebSocketFactory(
       protocols?: string | readonly string[],
     ) => WebSocketLike;
   }).WebSocket;
-  if (globalWebSocket) {
-    if (options?.headers && Object.keys(options.headers).length > 0) {
-      throw new ClusterConfigError(
-        'WebSocket upgrade headers require the ws library; the browser WebSocket API cannot carry request headers',
-        'HEADERS_UNSUPPORTED',
-      );
-    }
+  if (globalWebSocket && (!options?.headers || Object.keys(options.headers).length === 0)) {
     return new globalWebSocket(url, protocols);
   }
   try {
@@ -175,6 +171,7 @@ async function waitForOpen(socket: WebSocketLike, signal?: AbortSignal): Promise
   await new Promise<void>((resolve, reject) => {
     let settled = false;
     const removers: Array<() => void> = [];
+    let upgradeFailure: ClusterUpgradeError | ClusterTransportError | undefined;
     const settle = (fn: () => void) => {
       if (settled) return;
       settled = true;
@@ -186,15 +183,45 @@ async function waitForOpen(socket: WebSocketLike, signal?: AbortSignal): Promise
       'connect aborted locally; the server may still have committed this request',
       'AbortError',
     )));
+    const onUnexpectedResponse = (...args: unknown[]) => {
+      const response = args.find(
+        (value) => value !== null && typeof value === 'object' && 'statusCode' in value,
+      ) as { statusCode?: unknown; resume?: () => void } | undefined;
+      const status = response?.statusCode;
+      upgradeFailure = typeof status === 'number'
+        ? new ClusterUpgradeError(status)
+        : new ClusterTransportError('WebSocket upgrade rejected', 'UPGRADE_REJECTED');
+      response?.resume?.();
+      if (socket.terminate) {
+        socket.terminate();
+      } else {
+        settle(() => reject(upgradeFailure));
+      }
+    };
     removers.push(
       addSocketListener(socket, 'open', () => settle(resolve)),
-      addSocketListener(socket, 'error', (error) => settle(() => reject(new ClusterTransportError('WebSocket failed to open', 'OPEN_FAILED', { cause: error })))),
-      addSocketListener(socket, 'close', () => settle(() => reject(new ClusterTransportError('WebSocket closed before opening', 'OPEN_FAILED')))),
+      addSocketListener(socket, 'error', (error) => settle(() => reject(
+        upgradeFailure ??
+          new ClusterTransportError('WebSocket failed to open', 'OPEN_FAILED', { cause: error }),
+      ))),
+      addSocketListener(socket, 'close', () => settle(() => reject(
+        upgradeFailure ??
+          new ClusterTransportError('WebSocket closed before opening', 'OPEN_FAILED'),
+      ))),
+      addSocketEmitterListener(socket, 'unexpected-response', onUnexpectedResponse),
     );
     signal?.addEventListener('abort', onAbort, { once: true });
   });
 }
 
+async function disposeFailedSocket(socket: WebSocketLike): Promise<void> {
+  if (socket.readyState === 0 && socket.terminate) {
+    socket.terminate();
+  } else {
+    await socket.close();
+  }
+}
+
 export async function connect(url: string, options: ConnectOptions = {}): Promise<Connection> {
   const factory = options.webSocketFactory ?? defaultWebSocketFactory;
   let socket: WebSocketLike | undefined;
@@ -209,7 +236,7 @@ export async function connect(url: string, options: ConnectOptions = {}): Promis
     return connection;
   } catch (error) {
     if (socket) {
-      try { await socket.close(); }
+      try { await disposeFailedSocket(socket); }
       catch { /* preserve the construction error */ }
     }
     throw error;
@@ -231,7 +258,7 @@ export async function connectInitialized(url: string, options: ConnectOptions =
     return { connection, client, initializeResult };
   } catch (error) {
     if (socket) {
-      try { await socket.close(); }
+      try { await disposeFailedSocket(socket); }
       catch { /* preserve the construction error */ }
     }
     throw error;