crosscheck-mcp 0.2.28 → 0.2.30

package/dist/node-stdio.d.cts

@@ -1,5 +1,6 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { P as Provider } from './types-HA3W47O4.cjs';
 
 interface PricingDoc {
     /** `<provider>` -> `<model>` -> ModelRates. */
@@ -322,81 +323,6 @@ interface Storage extends StorageRead, StorageWrite {
     close(): Promise<void>;
 }
 
-/** One provider call's token + cost record. Mirrors `Usage.to_dict()`
- *  output exactly. */
-interface Usage {
-    provider: string;
-    model: string;
-    prompt_tokens: number;
-    completion_tokens: number;
-    cached_tokens: number;
-    total_tokens: number;
-    cost_usd: number;
-    estimated: boolean;
-    purpose: string;
-}
-
-/** Inbound message shape — chat-completions style. */
-interface ChatMessage {
-    role: "system" | "user" | "assistant" | string;
-    content: string;
-    [k: string]: unknown;
-}
-/** A successful `send()` result. */
-interface SendResult {
-    /** Concatenated text from the provider response. */
-    text: string;
-    /** Number of HTTP attempts that produced this result (>= 1). */
-    attempts: number;
-    /** Parsed + cost-augmented usage record. */
-    usage: Usage;
-}
-/** Args passed into every `Provider.send()` call. Mirrors the Python
- *  `send(messages, max_tokens, temperature, purpose='worker')` signature
- *  plus an optional `signal` for cancellation. */
-interface SendArgs {
-    messages: readonly ChatMessage[];
-    maxTokens: number;
-    temperature: number;
-    purpose?: string;
-    /** Optional AbortSignal so callers can cancel long-running calls. */
-    signal?: AbortSignal;
-    /** Optional one-call model override. Used by the cheap-mode tier
-     *  picker (see core/retarget.ts) to route a node to a cheaper model
-     *  without mutating the provider's default. */
-    modelOverride?: string;
-    /** F4b: optional JSON Schema that the response MUST conform to.
-     *  When set, provider adapters that support native structured output
-     *  (currently: openai-compatible adapter with provider=openai) wire
-     *  it into the request as `response_format: {type: "json_schema"}`
-     *  or the provider's equivalent. Adapters that don't support native
-     *  structured mode silently ignore this field — the schema-in-prompt
-     *  + F4c tolerant parser path still works as the universal fallback.
-     *  Mirror of OpenAI's json_schema spec; downstream adapters normalise
-     *  to their own provider's native shape. */
-    jsonSchema?: Record<string, unknown>;
-}
-/** Provider adapter. */
-interface Provider {
-    /** Lowercased identifier (e.g. "anthropic", "openai"). */
-    readonly name: string;
-    /** Default model for this provider (env-resolved at factory time). */
-    readonly model: string;
-    /** Ordered fallback models — "greenlight" candidates to try, in order,
-     *  when `model` comes back with a model-access failure (the account/
-     *  project doesn't have it enabled) rather than any other kind of
-     *  error. Env-resolved at factory time from `<PROVIDER>_MODEL_
-     *  FALLBACKS`, or set from a user's/org's configured chain. Empty for
-     *  most providers — a bad key or rate limit isn't fixed by switching
-     *  models, so this is only ever consulted for that one failure mode
-     *  (see core/model-fallback.ts). */
-    readonly fallbackModels?: readonly string[];
-    /** Make a request and return the parsed result. Throws `ProviderError`
-     *  on classified failures (auth, rate_limit, timeout, server, parse,
-     *  network, client). */
-    send(args: SendArgs): Promise<SendResult>;
-}
-
 interface FetchConfig {
     enabled?: boolean;
     url_allowlist?: readonly string[];

package/dist/node-stdio.d.ts

@@ -1,5 +1,6 @@
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { P as Provider } from './types-HA3W47O4.js';
 
 interface PricingDoc {
     /** `<provider>` -> `<model>` -> ModelRates. */
@@ -322,81 +323,6 @@ interface Storage extends StorageRead, StorageWrite {
     close(): Promise<void>;
 }
 
-/** One provider call's token + cost record. Mirrors `Usage.to_dict()`
- *  output exactly. */
-interface Usage {
-    provider: string;
-    model: string;
-    prompt_tokens: number;
-    completion_tokens: number;
-    cached_tokens: number;
-    total_tokens: number;
-    cost_usd: number;
-    estimated: boolean;
-    purpose: string;
-}
-
-/** Inbound message shape — chat-completions style. */
-interface ChatMessage {
-    role: "system" | "user" | "assistant" | string;
-    content: string;
-    [k: string]: unknown;
-}
-/** A successful `send()` result. */
-interface SendResult {
-    /** Concatenated text from the provider response. */
-    text: string;
-    /** Number of HTTP attempts that produced this result (>= 1). */
-    attempts: number;
-    /** Parsed + cost-augmented usage record. */
-    usage: Usage;
-}
-/** Args passed into every `Provider.send()` call. Mirrors the Python
- *  `send(messages, max_tokens, temperature, purpose='worker')` signature
- *  plus an optional `signal` for cancellation. */
-interface SendArgs {
-    messages: readonly ChatMessage[];
-    maxTokens: number;
-    temperature: number;
-    purpose?: string;
-    /** Optional AbortSignal so callers can cancel long-running calls. */
-    signal?: AbortSignal;
-    /** Optional one-call model override. Used by the cheap-mode tier
-     *  picker (see core/retarget.ts) to route a node to a cheaper model
-     *  without mutating the provider's default. */
-    modelOverride?: string;
-    /** F4b: optional JSON Schema that the response MUST conform to.
-     *  When set, provider adapters that support native structured output
-     *  (currently: openai-compatible adapter with provider=openai) wire
-     *  it into the request as `response_format: {type: "json_schema"}`
-     *  or the provider's equivalent. Adapters that don't support native
-     *  structured mode silently ignore this field — the schema-in-prompt
-     *  + F4c tolerant parser path still works as the universal fallback.
-     *  Mirror of OpenAI's json_schema spec; downstream adapters normalise
-     *  to their own provider's native shape. */
-    jsonSchema?: Record<string, unknown>;
-}
-/** Provider adapter. */
-interface Provider {
-    /** Lowercased identifier (e.g. "anthropic", "openai"). */
-    readonly name: string;
-    /** Default model for this provider (env-resolved at factory time). */
-    readonly model: string;
-    /** Ordered fallback models — "greenlight" candidates to try, in order,
-     *  when `model` comes back with a model-access failure (the account/
-     *  project doesn't have it enabled) rather than any other kind of
-     *  error. Env-resolved at factory time from `<PROVIDER>_MODEL_
-     *  FALLBACKS`, or set from a user's/org's configured chain. Empty for
-     *  most providers — a bad key or rate limit isn't fixed by switching
-     *  models, so this is only ever consulted for that one failure mode
-     *  (see core/model-fallback.ts). */
-    readonly fallbackModels?: readonly string[];
-    /** Make a request and return the parsed result. Throws `ProviderError`
-     *  on classified failures (auth, rate_limit, timeout, server, parse,
-     *  network, client). */
-    send(args: SendArgs): Promise<SendResult>;
-}
-
 interface FetchConfig {
     enabled?: boolean;
     url_allowlist?: readonly string[];

package/dist/node-stdio.js

@@ -1269,6 +1269,11 @@ function reasoningSharesOutputBudget(provider) {
 
 // src/providers/types.ts
 init_esm_shims();
+var IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+function imagesOf(m) {
+  if (m.role !== "user" || !Array.isArray(m.images)) return [];
+  return m.images.filter((i) => Boolean(i) && typeof i.data === "string" && i.data.length > 0 && IMAGE_MEDIA_TYPES.includes(i.mediaType));
+}
 var ProviderError = class extends Error {
   name = "ProviderError";
   kind;
@@ -1593,6 +1598,52 @@ function rejectsDisabledThinking(model) {
   const m = model.toLowerCase();
   return ADAPTIVE_THINKING_PREFIXES.some((p) => m.startsWith(p));
 }
+var NO_FORCED_TOOL_PREFIXES = [
+  "claude-fable-5-1",
+  "claude-mythos-5-1",
+  "claude-opus-5-5",
+  "claude-sonnet-5-5"
+];
+function rejectsForcedToolUse(model) {
+  const m = model.toLowerCase();
+  return NO_FORCED_TOOL_PREFIXES.some((p) => m.startsWith(p));
+}
+var UNSUPPORTED_SCHEMA_KEYS = /* @__PURE__ */ new Set([
+  "minimum",
+  "maximum",
+  "exclusiveMinimum",
+  "exclusiveMaximum",
+  "multipleOf",
+  "minLength",
+  "maxLength",
+  "pattern",
+  "minItems",
+  "maxItems",
+  "uniqueItems",
+  "minProperties",
+  "maxProperties",
+  "$schema"
+]);
+function toStructuredOutputSchema(schema) {
+  const walk = (node) => {
+    if (Array.isArray(node)) return node.map(walk);
+    if (!node || typeof node !== "object") return node;
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+      if (UNSUPPORTED_SCHEMA_KEYS.has(k)) continue;
+      if (k === "properties" && v && typeof v === "object") {
+        out[k] = Object.fromEntries(Object.entries(v).map(([pk, pv]) => [pk, walk(pv)]));
+      } else if (["items", "anyOf", "allOf", "oneOf", "not", "$defs", "definitions"].includes(k)) {
+        out[k] = k === "$defs" || k === "definitions" ? Object.fromEntries(Object.entries(v ?? {}).map(([dk, dv]) => [dk, walk(dv)])) : walk(v);
+      } else {
+        out[k] = v;
+      }
+    }
+    if (out["type"] === "object" || "properties" in out) out["additionalProperties"] = false;
+    return out;
+  };
+  return walk(schema);
+}
 var ANTHROPIC_STRUCTURED_TOOL_NAME = "structured_output";
 function applyPromptCaching(body, env = process.env) {
   const flag = (env["CROSSCHECK_ANTHROPIC_PROMPT_CACHE"] ?? "").trim();
@@ -1622,7 +1673,12 @@ function buildAnthropicRequest(opts) {
       }
       continue;
     }
-    convo.push({ role: m.role, content: typeof m.content === "string" ? m.content : "" });
+    const text = typeof m.content === "string" ? m.content : "";
+    const images = imagesOf(m);
+    convo.push(images.length ? { role: m.role, content: [
+      ...images.map((i) => ({ type: "image", source: { type: "base64", media_type: i.mediaType, data: i.data } })),
+      { type: "text", text }
+    ] } : { role: m.role, content: text });
   }
   const body = {
     model: opts.model,
@@ -1644,7 +1700,12 @@ function buildAnthropicRequest(opts) {
       body.thinking = { type: "disabled" };
     }
   }
-  if (opts.jsonSchema) {
+  if (opts.jsonSchema && rejectsForcedToolUse(opts.model)) {
+    body.output_config = {
+      ...body.output_config ?? {},
+      format: { type: "json_schema", schema: toStructuredOutputSchema(opts.jsonSchema) }
+    };
+  } else if (opts.jsonSchema) {
     body.tools = [{
       name: ANTHROPIC_STRUCTURED_TOOL_NAME,
       description: "Emit a single JSON object matching the requested schema.",
@@ -1858,7 +1919,10 @@ function buildGeminiRequest(opts) {
     const role = m.role === "user" ? "user" : "model";
     contents.push({
       role,
-      parts: [{ text: typeof m.content === "string" ? m.content : "" }]
+      parts: [
+        ...imagesOf(m).map((i) => ({ inline_data: { mime_type: i.mediaType, data: i.data } })),
+        { text: typeof m.content === "string" ? m.content : "" }
+      ]
     });
   }
   const body = {
@@ -2027,10 +2091,11 @@ function supportsNativeJsonSchema(provider, model) {
   return true;
 }
 function buildOpenAICompatibleRequest(opts) {
-  const msgs = opts.messages.map((m) => ({
-    role: m.role,
-    content: typeof m.content === "string" ? m.content : ""
-  }));
+  const msgs = opts.messages.map((m) => {
+    const text = typeof m.content === "string" ? m.content : "";
+    const images = imagesOf(m);
+    return images.length ? { role: m.role, content: [{ type: "text", text }, ...images.map((i) => ({ type: "image_url", image_url: { url: `data:${i.mediaType};base64,${i.data}` } }))] } : { role: m.role, content: text };
+  });
   const body = {
     model: opts.model,
     messages: msgs
@@ -2047,7 +2112,15 @@ function buildOpenAICompatibleRequest(opts) {
       json_schema: {
         name: "structured_output",
         schema: opts.jsonSchema,
-        strict: true
+        // NOT strict. Strict mode requires `additionalProperties: false` on
+        // every object and every property listed in `required` — the
+        // engine's schemas don't meet that, so every structured OpenAI call
+        // (planner, judges, synthesis) was a 400, unnoticed until the canary
+        // grew a structured check (2026-10-11). Non-strict still shapes the
+        // reply to the schema, and structured.ts validates it against the
+        // full schema regardless, so strictness added a failure mode and no
+        // safety.
+        strict: false
       }
     };
   }
@@ -2435,7 +2508,7 @@ import { z } from "zod";
 // src/server-meta.ts
 init_esm_shims();
 var SERVER_NAME = "crosscheck-agent";
-var SERVER_VERSION = true ? "0.2.28" : "0.0.0-dev";
+var SERVER_VERSION = true ? "0.2.30" : "0.0.0-dev";
 
 // src/tools/audit.ts
 init_esm_shims();
@@ -5444,6 +5517,7 @@ async function pickAutoPanel(storage, purpose, n, providers, allowlist) {
 
 // src/core/super-mode.ts
 init_esm_shims();
+import { AsyncLocalStorage } from "async_hooks";
 var SUPER_MODELS = {
   // Fable 5.1 verified present on the account; 5 as the fallback for accounts
   // that haven't been granted 5.1 yet.
@@ -5486,7 +5560,9 @@ function parseChain(v) {
   }
   return out;
 }
-function superChainFor(provider, env = process.env) {
+var superEnvStore = new AsyncLocalStorage();
+var currentEnv = () => superEnvStore.getStore() ?? process.env;
+function superChainFor(provider, env = currentEnv()) {
   const varName = SUPER_ENV_VARS[provider];
   const user = varName ? parseChain(env[varName]) : [];
   if (user.length > 0) {
@@ -5495,14 +5571,14 @@ function superChainFor(provider, env = process.env) {
   }
   return SUPER_MODELS[provider] ?? [];
 }
-function superPrimary(provider, env = process.env) {
+function superPrimary(provider, env = currentEnv()) {
   return superChainFor(provider, env)[0];
 }
 var SUPER_PROVIDER_NAMES = Object.keys(SUPER_MODELS);
 function isSuperRequested(args) {
   return args["super"] === true;
 }
-function retargetForSuper(p, env = process.env) {
+function retargetForSuper(p, env = currentEnv()) {
   const chain = superChainFor(p.name, env);
   if (chain.length === 0) return p;
   const [primary, ...fallbacks] = chain;
@@ -7590,9 +7666,9 @@ import { performance as performance7 } from "perf_hooks";
 
 // src/core/progress.ts
 init_esm_shims();
-import { AsyncLocalStorage } from "async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 import { performance as performance6 } from "perf_hooks";
-var progressStorage = new AsyncLocalStorage();
+var progressStorage = new AsyncLocalStorage2();
 async function withProgress(token, sendNotification, fn) {
   if (token === void 0 || token === null) {
     return fn();
@@ -9139,6 +9215,16 @@ function buildCallContext(args) {
 var CREATE_DOC_MAX_BYTES = 32 * 1024;
 var CREATE_AUDIT_THRESHOLD = 0.7;
 async function runCreate(args, opts) {
+  const subEnvelopes = [];
+  const tracked = (fn) => async (...a) => {
+    const out = await fn(...a);
+    subEnvelopes.push(out);
+    return out;
+  };
+  const confer = tracked(runConfer);
+  const orchestrate = tracked(runOrchestrate);
+  const review = tracked(runReview);
+  const audit = tracked(runAudit);
   const instruction = typeof args["instruction"] === "string" ? args["instruction"] : String(args["instruction"] ?? "");
   if (!instruction) {
     return errorEnvelope6(
@@ -9175,7 +9261,7 @@ ${constraints}
 
 ` : "") + `DOCUMENTS (${okCount} of ${descriptors.length} ingested):
 ${documentsPayload}`;
-  const scope = await runConfer({
+  const scope = await confer({
     question: "We are about to orchestrate a full plan->build->review->audit lifecycle for this instruction. List 3-6 concrete sub-tasks (each with a one-line description and a difficulty: low|med|high), any critical assumptions, and any missing-information risks. Be concise and decisive \u2014 your output will be used to build the orchestration DAG.\n\nINSTRUCTION:\n" + instruction,
     context: contextBlock,
     ...providers !== void 0 ? { providers } : {},
@@ -9202,7 +9288,7 @@ ${scopeAnswer || "(none)"}
   };
   if (providers !== void 0) orchestrateArgs["providers"] = providers;
   if (planOnly) orchestrateArgs["plan_only"] = true;
-  let orchestration = await runOrchestrate(orchestrateArgs, {
+  let orchestration = await orchestrate(orchestrateArgs, {
     providers: opts.providers,
     allowlist: opts.allowlist ?? null,
     moderator,
@@ -9231,7 +9317,7 @@ ${scopeAnswer || "(none)"}
   }
   let reviewEnvelope = null;
   if (!skipReview && typeof orchestration["final"] === "string" && orchestration["final"]) {
-    reviewEnvelope = await runReview({
+    reviewEnvelope = await review({
       snippet: orchestration["final"],
       intent: `final deliverable for: ${instruction}`,
       ...providers !== void 0 ? { providers } : {},
@@ -9251,7 +9337,7 @@ ${scopeAnswer || "(none)"}
     const panelExhausted = producingPanel.length > 0 && producingPanel.every(
       (p) => p in opts.providers || Object.keys(opts.providers).includes(p.toLowerCase())
     ) && producingPanel.length >= Object.keys(opts.providers).length;
-    auditEnvelope = await runAudit({
+    auditEnvelope = await audit({
       output_to_audit: orchestration["final"],
       producing_panelists: producingPanel,
       ...auditRubric !== void 0 ? { rubric: auditRubric } : {},
@@ -9280,7 +9366,7 @@ ${retryConstraints}
 DOCUMENTS:
 ${documentsPayload}`
       };
-      const retryOrchestration = await runOrchestrate(
+      const retryOrchestration = await orchestrate(
         retryOrchestrateArgs,
         {
           providers: opts.providers,
@@ -9294,7 +9380,7 @@ ${documentsPayload}`
       if (typeof retryOrchestration["final"] === "string" && retryOrchestration["final"]) {
         const retryPanel = computeProducingPanel(retryOrchestration);
         const retryPanelExhausted = retryPanel.length > 0 && retryPanel.length >= Object.keys(opts.providers).length;
-        auditEnvelope = await runAudit({
+        auditEnvelope = await audit({
           output_to_audit: retryOrchestration["final"],
           producing_panelists: retryPanel,
           ...auditRubric !== void 0 ? { rubric: auditRubric } : {},
@@ -9369,9 +9455,28 @@ ${documentsPayload}`
       ["auditor", "items", "overall_score", "passed", "rubric"]
     ),
     artifacts,
-    warnings
+    warnings,
+    ...combinedUsage(subEnvelopes)
   };
 }
+function combinedUsage(envelopes) {
+  const usages = [];
+  const byCallTiming = [];
+  let wall = 0, cpu = 0;
+  for (const env of envelopes) {
+    const e = env ?? {};
+    const calls = e["usage"]?.["by_call"] ?? [];
+    const t = e["timing"] ?? {};
+    const timing = Array.isArray(t["by_call"]) ? t["by_call"] : [];
+    if (!Array.isArray(calls) || calls.length === 0) continue;
+    usages.push(...calls);
+    if (timing.length === calls.length) byCallTiming.push(...timing);
+    else for (const c of calls) byCallTiming.push({ provider: c.provider, model: c.model, purpose: c.purpose ?? null, wall_ms: 0, cpu_ms: 0, cache_hit: false });
+    wall += Number(t["wall_ms"] ?? 0) || 0;
+    cpu += Number(t["cpu_ms"] ?? 0) || 0;
+  }
+  return { usage: aggregateUsage(usages), timing: { wall_ms: wall, cpu_ms: cpu, by_call: byCallTiming } };
+}
 async function ingestDocuments(documents, sessionId, opts) {
   if (documents.length === 0) return [];
   const out = [];
@@ -12868,7 +12973,7 @@ var CHECK_INTERVAL_SECONDS = 3 * 24 * 60 * 60;
 var DEFAULT_PACKAGE = "crosscheck-cli";
 var FETCH_TIMEOUT_MS = 3e3;
 function engineVersion() {
-  return true ? "0.2.28" : "0.0.0-dev";
+  return true ? "0.2.30" : "0.0.0-dev";
 }
 function defaultUpdateCachePath() {
   const base = process.env["CROSSCHECK_DATA_DIR"] || path10.join(os.homedir() || os.tmpdir(), ".crosscheck");