@vtxmacro/cli 2026.9.36 → 2026.9.38

package/bin/exo-harness.ts

@@ -36,6 +36,8 @@ type ExoModelModule = {
 };
 
 const record = (value: unknown): Json => value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Json : {};
+const validModel = (value: unknown): value is string => typeof value === 'string' && Boolean(value.trim())
+  && value.length <= 256 && !/[\u0000-\u001f\u007f]/u.test(value);
 const count = (value: unknown): number => {
   if (!Number.isSafeInteger(value) || Number(value) < 0) throw new Error('exo_usage_invalid');
   return Number(value);
@@ -286,7 +288,7 @@ export default {
             const choices = Array.isArray(raw.choices) ? raw.choices : [];
             const choice = record(choices[0]);
             terminalKnown = choices.length === 1 && ['stop', 'tool_calls', 'length', 'content_filter'].includes(String(choice.finish_reason));
-            if (raw.model !== input.providerModel || typeof raw.id !== 'string' || !raw.id) throw new Error('exo_response_identity_mismatch');
+            if (!validModel(raw.model) || typeof raw.id !== 'string' || !raw.id) throw new Error('exo_response_identity_mismatch');
             const controls = record(raw.venice_parameters);
             if (controls.disable_thinking !== true || controls.strip_thinking_response !== false
               || controls.include_venice_system_prompt !== false || controls.enable_web_search !== 'off'
@@ -298,7 +300,7 @@ export default {
             addUsage({ input_tokens: nativeUsage.prompt_tokens, output_tokens: nativeUsage.completion_tokens, total_tokens: nativeUsage.total_tokens,
               input_tokens_details: nativeUsage.prompt_tokens_details, output_tokens_details: nativeUsage.completion_tokens_details });
             lastCompletedResponseId = raw.id;
-            currentReceipt = { responseId: raw.id, providerModel: input.providerModel, reasoningEffort: input.reasoningEffort };
+            currentReceipt = { responseId: raw.id, providerModel: raw.model, reasoningEffort: input.reasoningEffort };
             // Exo synthesizes completed status for every Chat response. Inspect
             // the real terminal reason before that normalization can hide loss.
             if (choices.length !== 1 || !['stop', 'tool_calls'].includes(String(choice.finish_reason))) throw new Error('exo_response_incomplete');
@@ -333,14 +335,15 @@ export default {
         // model tool call to the broker, especially decision submission.
         if (response.status !== 'completed') throw new Error('exo_response_incomplete');
         terminalKnown = true;
-        if (response.model !== input.providerModel || typeof response.id !== 'string' || !response.id) throw new Error('exo_response_identity_mismatch');
+        if (!validModel(response.model) || typeof response.id !== 'string' || !response.id) throw new Error('exo_response_identity_mismatch');
         if (input.provider === 'openai') {
           const effectiveEffort = record(response.reasoning).effort ?? null;
           if (effectiveEffort !== input.nativeReasoningEffort) throw new Error('exo_response_effort_mismatch');
           addUsage(record(response.usage));
           lastCompletedResponseId = response.id;
-          currentReceipt = { responseId: response.id, providerModel: input.providerModel, reasoningEffort: input.reasoningEffort };
+          currentReceipt = { responseId: response.id, providerModel: response.model, reasoningEffort: input.reasoningEffort };
         }
+        if (!currentReceipt || currentReceipt.responseId !== response.id || currentReceipt.providerModel !== response.model) throw new Error('exo_response_identity_mismatch');
         const events = model.responseToLinguaEvents(response);
         await context.exoharness.current.turn.addEvents(input.provider === 'venice' ? chatResponseEvents(events) : events);
         const calls = model.responseToolCalls(response);
@@ -354,7 +357,7 @@ export default {
         if (input.mode !== 'agent' || calls.some((call) => !allowed.has(call.request.functionName))) throw new Error('exo_tool_not_allowed');
         for (const call of calls) {
           const result = await broker('/tool', { callId: call.toolCallId, tool: call.request.functionName, arguments: call.request.arguments,
-            effectiveModel: input.requestedModel, effectiveReasoningEffort: input.reasoningEffort }, input.deadlineAtMs);
+            effectiveModel: `${input.provider}/${currentReceipt!.providerModel}`, effectiveReasoningEffort: input.reasoningEffort }, input.deadlineAtMs);
           // Append the entire result directly. The default registry replaces
           // results over 8k with previews, which loses assignment data.
           await context.exoharness.current.turn.addEvents([harness.toolResultEvent(call.toolCallId,

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.9.36",
+  package_version: "2026.9.38",
   codex_package_name: "@openai/codex",
   codex_version: "0.153.3",
   copilot_sdk_package_name: "@github/copilot-sdk",