@the-open-engine/zeroshot 6.30.2 → 6.31.0

package/src/agent-cli-provider/adapters/omp-policy.ts

@@ -0,0 +1,45 @@
+export const OMP_CREDENTIAL_ENV_KEYS: readonly string[] = [
+  'AIMLAPI_API_KEY', 'AI_GATEWAY_API_KEY', 'ALIBABA_CODING_PLAN_API_KEY', 'ALIBABA_TOKEN_PLAN_API_KEY',
+  'ANTHROPIC_API_KEY', 'ANTHROPIC_FOUNDRY_API_KEY', 'ANTHROPIC_OAUTH_TOKEN', 'ANTHROPIC_SEARCH_API_KEY',
+  'AWS_ACCESS_KEY_ID', 'AWS_BEARER_TOKEN_BEDROCK', 'AWS_SECRET_ACCESS_KEY', 'AZURE_OPENAI_API_KEY',
+  'BAILIAN_TOKEN_PLAN_API_KEY', 'BRAVE_API_KEY', 'CEREBRAS_API_KEY', 'CLAUDE_CODE_CLIENT_CERT',
+  'CLAUDE_CODE_CLIENT_KEY', 'CLOUDFLARE_AI_GATEWAY_API_KEY', 'COPILOT_GITHUB_TOKEN', 'CURSOR_ACCESS_TOKEN',
+  'DEEPSEEK_API_KEY', 'EXA_API_KEY', 'FIREPASS_API_KEY', 'FIREWORKS_API_KEY', 'GEMINI_API_KEY', 'GH_TOKEN',
+  'GITHUB_TOKEN', 'GITLAB_TOKEN', 'GOOGLE_API_KEY', 'GOOGLE_APPLICATION_CREDENTIALS', 'GOOGLE_CLOUD_API_KEY',
+  'GROQ_API_KEY', 'HF_TOKEN', 'HUGGINGFACE_HUB_TOKEN', 'JINA_API_KEY', 'KAGI_API_KEY', 'KILO_API_KEY',
+  'KIMI_SEARCH_API_KEY', 'LITELLM_API_KEY', 'LLAMA_CPP_API_KEY', 'LM_STUDIO_API_KEY', 'MINIMAX_API_KEY',
+  'MINIMAX_CODE_API_KEY', 'MINIMAX_CODE_CN_API_KEY', 'MISTRAL_API_KEY', 'MOONSHOT_API_KEY',
+  'MOONSHOT_SEARCH_API_KEY', 'NANO_GPT_API_KEY', 'NOVITA_API_KEY', 'NVIDIA_API_KEY', 'OLLAMA_API_KEY',
+  'OLLAMA_CLOUD_API_KEY', 'OMP_AUTH_BROKER_TOKEN', 'OPENAI_API_KEY', 'OPENCODE_API_KEY', 'OPENROUTER_API_KEY',
+  'PARALLEL_API_KEY', 'PERPLEXITY_API_KEY', 'PERPLEXITY_COOKIES', 'QIANFAN_API_KEY', 'QWEN_OAUTH_TOKEN',
+  'QWEN_PORTAL_API_KEY', 'SEARXNG_BASIC_PASSWORD', 'SEARXNG_TOKEN', 'SILICONFLOW_API_KEY',
+  'SILICONFLOW_CN_API_KEY', 'SMITHERY_API_KEY', 'SYNTHETIC_API_KEY', 'TAVILY_API_KEY',
+  'TOGETHER_API_KEY', 'UMANS_AI_CODING_PLAN_API_KEY', 'VENICE_API_KEY', 'VLLM_API_KEY',
+  'WAFER_SERVERLESS_API_KEY', 'XAI_API_KEY', 'XAI_OAUTH_TOKEN', 'XIAOMI_API_KEY',
+  'XIAOMI_TOKEN_PLAN_AMS_API_KEY', 'XIAOMI_TOKEN_PLAN_CN_API_KEY', 'XIAOMI_TOKEN_PLAN_SGP_API_KEY',
+  'ZAI_API_KEY', 'ZENMUX_API_KEY', 'ZHIPU_API_KEY',
+];
+
+export const OMP_RETRYABLE_PATTERNS: readonly RegExp[] = [
+  /\brate(?:[_ -]?limit| limited)\b/i, /\bquota\b/i, /\bresource[_ -]?exhausted\b/i,
+  /\btemporar(?:y|ily)\b/i, /\boverloaded\b/i, /\bservice unavailable\b/i,
+];
+
+export const OMP_PERMANENT_PATTERNS: readonly RegExp[] = [
+  /\bunsupported-protocol\b/i, /\bunsupported-limits\b/i, /\bunsupported-provider-cli\b/i,
+  /\bunsupported-ui-method\b/i, /\bunsupported-capability\b/i, /\bunsafe-config\b/i,
+  /\bmalformed-response\b/i, /\bmalformed-extension-ui-request\b/i, /\bmalformed-host-tool-call\b/i,
+  /\bmalformed-host-uri-request\b/i, /\bextension-error\b/i, /\blocal-only-prompt\b/i,
+  /\blifetime-request-id-exceeded\b/i, /\bpending-request-exceeded\b/i, /\bspawn-hook-failed\b/i,
+  /\bphysical-frame-too-large\b/i, /\bmalformed-physical-frame\b/i, /\binvalid-chunk-metadata\b/i,
+  /\binvalid-chunk-data\b/i, /\bchunk-sequence-must-start-at-zero\b/i, /\bchunk-sequence-mismatch\b/i,
+  /\bchunk-sequence-exceeds-declared-length\b/i, /\bchunk-sequence-length-mismatch\b/i,
+  /\bmalformed-json-in-reassembled-frame\b/i, /\bnon-object-reassembled-frame\b/i,
+  /\binvalid-utf8-in-reassembled-frame\b/i, /\binflight-reassembly-bytes-exceeded\b/i,
+  /\binterleaved-chunk-sequence\b/i, /\binterrupted-chunk-sequence\b/i,
+  /\bincomplete-physical-frame\b/i, /\bincomplete-chunk-sequence\b/i, /\boutbound-frame-too-large\b/i,
+  /\bpre-negotiation-rpc-chunk\b/i, /\b[\w-]+-bound-exceeded\b/i, /\bno available authenticated\b/i,
+  /\bno keyless model\b/i, /\bno valid authentication\b/i, /\bmissing api key\b/i,
+  /\brun\s*\/login\b/i, /\bunknown option\b/i, /\bfailed to load\b/i,
+  /\bcannot find module\b/i, /\bno such file or directory\b/i,
+];

package/src/agent-cli-provider/adapters/omp.ts

@@ -2,9 +2,9 @@ import { contractError } from '../contract-errors';
 import { UnsupportedProviderCapabilityError } from '../errors';
 import { appendJsonSchemaPrompt } from '../schema';
 import { isRecord, unknownToMessage } from '../json';
-import { OMP_REMEDIATION, OMP_SUPPORTED_VERSION } from '../omp-release';
-import { parseNormalizedOmpRpcEventLine } from '../omp-rpc-events';
-import type { OmpSessionLaunch } from '../omp-rpc-session';
+import { OMP_REMEDIATION, OMP_SUPPORTED_VERSION } from '../omp/release';
+import { parseNormalizedOmpRpcEventLine } from '../omp/rpc-events';
+import type { OmpSessionLaunch } from '../omp/rpc-session';
 import {
   InvalidProviderModelError,
   type BuildProviderCommandOptions,
@@ -29,6 +29,11 @@ import {
   resolveModelSpecWithConfig,
   warning,
 } from './common';
+import {
+  OMP_CREDENTIAL_ENV_KEYS,
+  OMP_PERMANENT_PATTERNS,
+  OMP_RETRYABLE_PATTERNS,
+} from './omp-policy';
 
 interface OmpConfigOverlay {
   readonly dir: string;
@@ -65,99 +70,7 @@ const LEVEL_MAPPING: Readonly<Record<ModelLevel, LevelModelSpec>> = {
   level3: { rank: 3, model: '@slow' },
 };
 
-// Verified against tagged v17.2.1 source: docs/environment-variables.md ("Model/provider
-// authentication", "GitHub/Copilot tokens", "Auth broker", web-search credentials, Bedrock,
-// Azure, Vertex sections) plus docs/providers.md's provider/env-var map. This is the full
-// official host credential inventory OMP itself resolves credentials from — distinct from
-// (and broader than) any narrower automatic Docker env-passthrough allowlist — because OMP
-// routes to 70+ downstream model/search providers and every one of their credential env vars
-// must be detected and redacted from Zeroshot logs/output, not just the handful Zeroshot's
-// own cluster config commonly sets.
-const CREDENTIAL_ENV_KEYS: readonly string[] = [
-  'AIMLAPI_API_KEY',
-  'AI_GATEWAY_API_KEY',
-  'ALIBABA_CODING_PLAN_API_KEY',
-  'ALIBABA_TOKEN_PLAN_API_KEY',
-  'ANTHROPIC_API_KEY',
-  'ANTHROPIC_FOUNDRY_API_KEY',
-  'ANTHROPIC_OAUTH_TOKEN',
-  'ANTHROPIC_SEARCH_API_KEY',
-  'AWS_ACCESS_KEY_ID',
-  'AWS_BEARER_TOKEN_BEDROCK',
-  'AWS_SECRET_ACCESS_KEY',
-  'AZURE_OPENAI_API_KEY',
-  'BAILIAN_TOKEN_PLAN_API_KEY',
-  'BRAVE_API_KEY',
-  'CEREBRAS_API_KEY',
-  'CLAUDE_CODE_CLIENT_CERT',
-  'CLAUDE_CODE_CLIENT_KEY',
-  'CLOUDFLARE_AI_GATEWAY_API_KEY',
-  'COPILOT_GITHUB_TOKEN',
-  'CURSOR_ACCESS_TOKEN',
-  'DEEPSEEK_API_KEY',
-  'EXA_API_KEY',
-  'FIREPASS_API_KEY',
-  'FIREWORKS_API_KEY',
-  'GEMINI_API_KEY',
-  'GH_TOKEN',
-  'GITHUB_TOKEN',
-  'GITLAB_TOKEN',
-  'GOOGLE_API_KEY',
-  'GOOGLE_APPLICATION_CREDENTIALS',
-  'GOOGLE_CLOUD_API_KEY',
-  'GROQ_API_KEY',
-  'HF_TOKEN',
-  'HUGGINGFACE_HUB_TOKEN',
-  'JINA_API_KEY',
-  'KAGI_API_KEY',
-  'KILO_API_KEY',
-  'KIMI_SEARCH_API_KEY',
-  'LITELLM_API_KEY',
-  'LLAMA_CPP_API_KEY',
-  'LM_STUDIO_API_KEY',
-  'MINIMAX_API_KEY',
-  'MINIMAX_CODE_API_KEY',
-  'MINIMAX_CODE_CN_API_KEY',
-  'MISTRAL_API_KEY',
-  'MOONSHOT_API_KEY',
-  'MOONSHOT_SEARCH_API_KEY',
-  'NANO_GPT_API_KEY',
-  'NOVITA_API_KEY',
-  'NVIDIA_API_KEY',
-  'OLLAMA_API_KEY',
-  'OLLAMA_CLOUD_API_KEY',
-  'OMP_AUTH_BROKER_TOKEN',
-  'OPENAI_API_KEY',
-  'OPENCODE_API_KEY',
-  'OPENROUTER_API_KEY',
-  'PARALLEL_API_KEY',
-  'PERPLEXITY_API_KEY',
-  'PERPLEXITY_COOKIES',
-  'QIANFAN_API_KEY',
-  'QWEN_OAUTH_TOKEN',
-  'QWEN_PORTAL_API_KEY',
-  'SEARXNG_BASIC_PASSWORD',
-  'SEARXNG_TOKEN',
-  'SILICONFLOW_API_KEY',
-  'SILICONFLOW_CN_API_KEY',
-  'SMITHERY_API_KEY',
-  'SYNTHETIC_API_KEY',
-  'TAVILY_API_KEY',
-  'TOGETHER_API_KEY',
-  'UMANS_AI_CODING_PLAN_API_KEY',
-  'VENICE_API_KEY',
-  'VLLM_API_KEY',
-  'WAFER_SERVERLESS_API_KEY',
-  'XAI_API_KEY',
-  'XAI_OAUTH_TOKEN',
-  'XIAOMI_API_KEY',
-  'XIAOMI_TOKEN_PLAN_AMS_API_KEY',
-  'XIAOMI_TOKEN_PLAN_CN_API_KEY',
-  'XIAOMI_TOKEN_PLAN_SGP_API_KEY',
-  'ZAI_API_KEY',
-  'ZENMUX_API_KEY',
-  'ZHIPU_API_KEY',
-];
+const CREDENTIAL_ENV_KEYS = OMP_CREDENTIAL_ENV_KEYS;
 
 const VERSION_TOKEN_PATTERN = /(?<![\w.])17\.2\.1(?![\w.])/;
 const MODEL_ID_PATTERN = /^@?[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/u;
@@ -335,66 +248,7 @@ function validateModelId(modelId: string | null | undefined): string | null | un
   return modelId;
 }
 
-const OMP_RETRYABLE_PATTERNS: readonly RegExp[] = [
-  /\brate(?:[_ -]?limit| limited)\b/i,
-  /\bquota\b/i,
-  /\bresource[_ -]?exhausted\b/i,
-  /\btemporar(?:y|ily)\b/i,
-  /\boverloaded\b/i,
-  /\bservice unavailable\b/i,
-];
 
-const OMP_PERMANENT_PATTERNS: readonly RegExp[] = [
-  // Driver stopReason tokens (see omp-rpc-driver.ts) that always indicate a permanent,
-  // non-retryable failure: bad binary/protocol/version/limits/selector/config, malformed or
-  // over-bound frames, and missing auth/model evidence.
-  /\bunsupported-protocol\b/i,
-  /\bunsupported-limits\b/i,
-  /\bunsupported-provider-cli\b/i,
-  /\bunsupported-ui-method\b/i,
-  /\bunsupported-capability\b/i,
-  /\bunsafe-config\b/i,
-  /\bmalformed-response\b/i,
-  /\bmalformed-extension-ui-request\b/i,
-  /\bmalformed-host-tool-call\b/i,
-  /\bmalformed-host-uri-request\b/i,
-  /\bextension-error\b/i,
-  /\blocal-only-prompt\b/i,
-  /\blifetime-request-id-exceeded\b/i,
-  /\bpending-request-exceeded\b/i,
-  /\bspawn-hook-failed\b/i,
-  // Frame decoder codes (omp-rpc-protocol.ts OmpRpcProtocolError.code values) — every one of
-  // these means the wire traffic itself is invalid or out-of-bounds, never a transient condition.
-  /\bphysical-frame-too-large\b/i,
-  /\bmalformed-physical-frame\b/i,
-  /\binvalid-chunk-metadata\b/i,
-  /\binvalid-chunk-data\b/i,
-  /\bchunk-sequence-must-start-at-zero\b/i,
-  /\bchunk-sequence-mismatch\b/i,
-  /\bchunk-sequence-exceeds-declared-length\b/i,
-  /\bchunk-sequence-length-mismatch\b/i,
-  /\bmalformed-json-in-reassembled-frame\b/i,
-  /\bnon-object-reassembled-frame\b/i,
-  /\binvalid-utf8-in-reassembled-frame\b/i,
-  /\binflight-reassembly-bytes-exceeded\b/i,
-  /\binterleaved-chunk-sequence\b/i,
-  /\binterrupted-chunk-sequence\b/i,
-  /\bincomplete-physical-frame\b/i,
-  /\bincomplete-chunk-sequence\b/i,
-  /\boutbound-frame-too-large\b/i,
-  /\bpre-negotiation-rpc-chunk\b/i,
-  /\b[\w-]+-bound-exceeded\b/i,
-  // Auth/model absence and permission/usage errors surfaced verbatim in OMP output.
-  /\bno available authenticated\b/i,
-  /\bno keyless model\b/i,
-  /\bno valid authentication\b/i,
-  /\bmissing api key\b/i,
-  /\brun\s*\/login\b/i,
-  /\bunknown option\b/i,
-  /\bfailed to load\b/i,
-  /\bcannot find module\b/i,
-  /\bno such file or directory\b/i,
-];
 
 function classifyError(error: unknown): ErrorClassification {
   const message = unknownToMessage(error);

package/src/agent-cli-provider/adapters/pi.ts

@@ -1,16 +1,15 @@
 import { appendJsonSchemaPrompt } from '../schema';
 import { contractError } from '../contract-errors';
 import {
-  getArray,
-  getBoolean,
-  getNumber,
-  getOptionalString,
-  getRecord,
-  getString,
-  isRecord,
-  tryParseJson,
-  unknownToMessage,
-} from '../json';
+  emitAssistantSnapshot,
+  parseAssistantDelta,
+  parseToolExecutionEnd,
+  parseToolExecutionStart,
+  parseToolExecutionUpdate,
+  parseTurnEndResult,
+  resetAssistantSnapshot,
+} from '../assistant-stream';
+import { getRecord, getString, isRecord, tryParseJson, unknownToMessage } from '../json';
 import {
   type BuildProviderCommandOptions,
   type CommandSpec,
@@ -152,138 +151,13 @@ function createPiState(): ProviderParserState {
   };
 }
 
-function assistantSnapshot(message: Record<string, unknown>): { text: string; thinking: string } {
-  if (getString(message, 'role') !== 'assistant') return { text: '', thinking: '' };
-
-  let text = '';
-  let thinking = '';
-  for (const item of getArray(message, 'content')) {
-    if (!isRecord(item)) continue;
-    const type = getString(item, 'type');
-    if (type === 'text') {
-      text += getString(item, 'text') ?? '';
-    } else if (type === 'thinking') {
-      thinking += getString(item, 'thinking') ?? '';
-    }
-  }
-
-  return { text, thinking };
-}
-
-function snapshotDelta(previous: string, current: string): string | null {
-  if (!current) return null;
-  if (previous === current) return null;
-  if (current.startsWith(previous)) return current.slice(previous.length) || null;
-  return current;
-}
-
-function emitAssistantSnapshot(
-  message: Record<string, unknown>,
-  state: ProviderParserState
-): readonly OutputEvent[] {
-  const snapshot = assistantSnapshot(message);
-  const events: OutputEvent[] = [];
-
-  const textDelta = snapshotDelta(state.lastAssistantText ?? '', snapshot.text);
-  if (textDelta) events.push({ type: 'text', text: textDelta });
-  state.lastAssistantText = snapshot.text;
-
-  const thinkingDelta = snapshotDelta(state.lastAssistantThinking ?? '', snapshot.thinking);
-  if (thinkingDelta) events.push({ type: 'thinking', text: thinkingDelta });
-  state.lastAssistantThinking = snapshot.thinking;
-
-  return events;
-}
-
-function parseAssistantEvent(
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): OutputEvent | null {
-  const type = getString(event, 'type');
-  if (type === 'text_delta') {
-    const delta = getString(event, 'delta');
-    if (!delta) return null;
-    state.lastAssistantText += delta;
-    return { type: 'text', text: delta };
-  }
-  if (type === 'thinking_delta') {
-    const delta = getString(event, 'delta');
-    if (!delta) return null;
-    state.lastAssistantThinking += delta;
-    return { type: 'thinking', text: delta };
-  }
-  return null;
-}
-
-function parseToolExecutionStart(
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): OutputEvent {
-  const toolId = getOptionalString(event, 'toolCallId');
-  state.lastToolId = toolId;
-  return {
-    type: 'tool_call',
-    toolName: getOptionalString(event, 'toolName'),
-    toolId,
-    input: event.args ?? {},
-  };
-}
-
-function parseToolExecutionUpdate(
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): OutputEvent | null {
-  const toolId = getOptionalString(event, 'toolCallId') ?? state.lastToolId;
-  if (toolId !== undefined) state.lastToolId = toolId;
-  if (!Object.prototype.hasOwnProperty.call(event, 'partialResult')) return null;
-  return {
-    type: 'tool_result',
-    toolId,
-    content: event.partialResult,
-    isError: false,
-  };
-}
-
-function parseToolExecutionEnd(
-  event: Record<string, unknown>,
-  state: ProviderParserState
-): OutputEvent {
-  const toolId = getOptionalString(event, 'toolCallId') ?? state.lastToolId;
-  return {
-    type: 'tool_result',
-    toolId,
-    content: event.result ?? '',
-    isError: getBoolean(event, 'isError') ?? false,
-  };
-}
-
-function parseTurnEnd(
+function parsePiTurnEnd(
   event: Record<string, unknown>,
   state: ProviderParserState
 ): readonly OutputEvent[] {
   const message = getRecord(event, 'message');
-  const events: OutputEvent[] = [];
-  if (message !== null) {
-    events.push(...emitAssistantSnapshot(message, state));
-  }
-
-  const usage = message ? getRecord(message, 'usage') ?? {} : {};
-  const stopReason = message ? getString(message, 'stopReason') : null;
-  const errorMessage = message ? getString(message, 'errorMessage') : null;
-  const snapshot = message ? assistantSnapshot(message) : { text: '', thinking: '' };
-  const success = stopReason !== 'error' && stopReason !== 'aborted' && !errorMessage;
-  events.push({
-    type: 'result',
-    success,
-    result: success ? snapshot.text || null : null,
-    error: success ? null : (errorMessage ?? stopReason ?? 'Pi turn failed'),
-    inputTokens: getNumber(usage, 'input') ?? 0,
-    outputTokens: getNumber(usage, 'output') ?? 0,
-    cacheReadInputTokens: getNumber(usage, 'cacheRead') ?? 0,
-    cacheCreationInputTokens: getNumber(usage, 'cacheWrite') ?? 0,
-    cost: getRecord(usage, 'cost') ?? null,
-    modelUsage: usage,
-  });
+  const events = message === null ? [] : [...emitAssistantSnapshot(message, state)];
+  events.push(parseTurnEndResult(event, { failureMessage: 'Pi turn failed' }));
   return events;
 }
 
@@ -293,18 +167,14 @@ function parseMessageEvent(
   state: ProviderParserState
 ): readonly OutputEvent[] | OutputEvent | null | undefined {
   if (type === 'message_start') {
-    const message = getRecord(event, 'message');
-    if (message !== null && getString(message, 'role') === 'assistant') {
-      state.lastAssistantText = '';
-      state.lastAssistantThinking = '';
-    }
+    resetAssistantSnapshot(getRecord(event, 'message'), state);
     return null;
   }
 
   if (type === 'message_update') {
     const assistantMessageEvent = getRecord(event, 'assistantMessageEvent');
     if (assistantMessageEvent !== null) {
-      const assistantEvent = parseAssistantEvent(assistantMessageEvent, state);
+      const assistantEvent = parseAssistantDelta(assistantMessageEvent, state);
       if (assistantEvent !== null) return assistantEvent;
     }
     const message = getRecord(event, 'message');
@@ -343,7 +213,7 @@ function parseEvent(
   const toolEvent = parseToolEvent(type, parsed, state);
   if (toolEvent !== undefined) return toolEvent;
 
-  if (type === 'turn_end') return parseTurnEnd(parsed, state);
+  if (type === 'turn_end') return parsePiTurnEnd(parsed, state);
   return null;
 }
 

package/src/agent-cli-provider/assistant-stream.ts

@@ -0,0 +1,155 @@
+import {
+  getArray,
+  getBoolean,
+  getNumber,
+  getOptionalString,
+  getRecord,
+  getString,
+  isRecord,
+} from './json';
+import type { OutputEvent, ResultEvent } from './types';
+export interface AssistantStreamState {
+  lastAssistantText?: string | undefined;
+  lastAssistantThinking?: string | undefined;
+  lastToolId?: string | null | undefined;
+}
+
+export interface AssistantSnapshot {
+  readonly text: string;
+  readonly thinking: string;
+}
+
+export function assistantSnapshot(message: Record<string, unknown>): AssistantSnapshot {
+  if (getString(message, 'role') !== 'assistant') return { text: '', thinking: '' };
+
+  let text = '';
+  let thinking = '';
+  for (const item of getArray(message, 'content')) {
+    if (!isRecord(item)) continue;
+    const type = getString(item, 'type');
+    if (type === 'text') text += getString(item, 'text') ?? '';
+    else if (type === 'thinking') thinking += getString(item, 'thinking') ?? '';
+  }
+  return { text, thinking };
+}
+
+export function snapshotDelta(previous: string, current: string): string | null {
+  if (!current || previous === current) return null;
+  if (current.startsWith(previous)) return current.slice(previous.length) || null;
+  return current;
+}
+
+export function resetAssistantSnapshot(
+  message: Record<string, unknown> | null,
+  state: AssistantStreamState
+): void {
+  if (message !== null && getString(message, 'role') === 'assistant') {
+    state.lastAssistantText = '';
+    state.lastAssistantThinking = '';
+  }
+}
+
+export function parseAssistantDelta(
+  event: Record<string, unknown>,
+  state: AssistantStreamState
+): OutputEvent | null {
+  const type = getString(event, 'type');
+  const delta = getString(event, 'delta');
+  if (!delta) return null;
+  if (type === 'text_delta') {
+    state.lastAssistantText = (state.lastAssistantText ?? '') + delta;
+    return { type: 'text', text: delta };
+  }
+  if (type === 'thinking_delta') {
+    state.lastAssistantThinking = (state.lastAssistantThinking ?? '') + delta;
+    return { type: 'thinking', text: delta };
+  }
+  return null;
+}
+
+export interface AssistantSnapshotOptions {
+  readonly retainPreviousOnEmpty?: boolean;
+}
+
+export function emitAssistantSnapshot(
+  message: Record<string, unknown>,
+  state: AssistantStreamState,
+  options: AssistantSnapshotOptions = {}
+): readonly OutputEvent[] {
+  const snapshot = assistantSnapshot(message);
+  const events: OutputEvent[] = [];
+  const textDelta = snapshotDelta(state.lastAssistantText ?? '', snapshot.text);
+  if (textDelta) events.push({ type: 'text', text: textDelta });
+  if (!options.retainPreviousOnEmpty || snapshot.text) state.lastAssistantText = snapshot.text;
+  const thinkingDelta = snapshotDelta(state.lastAssistantThinking ?? '', snapshot.thinking);
+  if (thinkingDelta) events.push({ type: 'thinking', text: thinkingDelta });
+  if (!options.retainPreviousOnEmpty || snapshot.thinking) {
+    state.lastAssistantThinking = snapshot.thinking;
+  }
+  return events;
+}
+
+export function parseToolExecutionStart(
+  event: Record<string, unknown>,
+  state: AssistantStreamState
+): OutputEvent {
+  const toolId = getOptionalString(event, 'toolCallId');
+  state.lastToolId = toolId;
+  return {
+    type: 'tool_call',
+    toolName: getOptionalString(event, 'toolName'),
+    toolId,
+    input: event.args ?? {},
+  };
+}
+
+export function parseToolExecutionUpdate(
+  event: Record<string, unknown>,
+  state: AssistantStreamState
+): OutputEvent | null {
+  const toolId = getOptionalString(event, 'toolCallId') ?? state.lastToolId;
+  if (toolId !== undefined) state.lastToolId = toolId;
+  if (!Object.prototype.hasOwnProperty.call(event, 'partialResult')) return null;
+  return { type: 'tool_result', toolId, content: event.partialResult, isError: false };
+}
+
+export function parseToolExecutionEnd(
+  event: Record<string, unknown>,
+  state: AssistantStreamState
+): OutputEvent {
+  return {
+    type: 'tool_result',
+    toolId: getOptionalString(event, 'toolCallId') ?? state.lastToolId,
+    content: event.result ?? '',
+    isError: getBoolean(event, 'isError') ?? false,
+  };
+}
+
+export interface TurnEndOptions {
+  readonly failureMessage: string;
+  readonly resultFallback?: string | null;
+}
+
+export function parseTurnEndResult(
+  event: Record<string, unknown>,
+  options: TurnEndOptions
+): ResultEvent {
+  const message = getRecord(event, 'message');
+  const usage = message ? (getRecord(message, 'usage') ?? {}) : {};
+  const stopReason = message ? getString(message, 'stopReason') : null;
+  const errorMessage = message ? getString(message, 'errorMessage') : null;
+  const snapshot = message ? assistantSnapshot(message) : { text: '', thinking: '' };
+  const success = stopReason !== 'error' && stopReason !== 'aborted' && !errorMessage;
+  return {
+    type: 'result',
+    success,
+    result: success ? snapshot.text || options.resultFallback || null : null,
+    error: success ? null : (errorMessage ?? stopReason ?? options.failureMessage),
+    inputTokens: getNumber(usage, 'input') ?? 0,
+    outputTokens: getNumber(usage, 'output') ?? 0,
+    cacheReadInputTokens: getNumber(usage, 'cacheRead') ?? 0,
+    cacheCreationInputTokens: getNumber(usage, 'cacheWrite') ?? 0,
+    cost: getRecord(usage, 'cost') ?? null,
+    modelUsage: usage,
+  };
+}

package/src/agent-cli-provider/contract-actions.ts

@@ -1,3 +1,5 @@
+import * as fs from 'node:fs';
+
 import { classifyProviderError } from './adapters';
 import { envRedactions, commandRedactions } from './contract-env';
 import { contractError } from './contract-errors';
@@ -15,7 +17,7 @@ import {
   schemaMode,
   type RequestData,
 } from './contract-support';
-import { extractErrorStatus } from './errors';
+import { extractErrorStatus, UnsupportedProviderCapabilityError } from './errors';
 import { probeRuntimeProviderCli } from './single-agent-runtime';
 import { getString, isRecord, unknownToMessage } from './json';
 import type { ErrorClassification } from './types';
@@ -25,7 +27,17 @@ function runBuildCommand(
   request: RequestData,
   runtimeSettings?: Record<string, unknown>
 ): ContractEnvelope {
-  const { adapter, commandSpec, options } = buildCommandSpec(request, runtimeSettings);
+  const prepared = buildCommandSpec(request, runtimeSettings);
+  if (prepared.invoke.parser === 'omp-sdk-ndjson') {
+    const privateRoot = prepared.privateArtifacts?.root;
+    if (privateRoot !== undefined) fs.rmSync(privateRoot, { recursive: true, force: true });
+    throw new UnsupportedProviderCapabilityError(
+      'omp',
+      'buildCommand',
+      'OMP SDK invocations cannot be exported by build-command because invoke owns the private request, minimal environment, protocol, containment, and cleanup. Use invoke instead.'
+    );
+  }
+  const { adapter, commandSpec, options } = prepared;
   const webSearch = {
     requested: options.webSearch === true,
     effective: options.webSearch === true && options.cliFeatures?.supportsWebSearch === true,