cuonztech-agent-harness 0.4.0 → 0.5.1

package/dist/proxy/interceptor.js

@@ -6,20 +6,130 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { VERSION } from "../version.js";
-import { createSession, incrementCall, addRecord, } from "../engine/state-machine.js";
+import { readFileSync, readdirSync } from "node:fs";
+import { createSession, incrementCall, addRecord, classifyTool, extractKey, isKeyField, isReadTool, matchesAnyGlob, releaseScenarioFire, DEFAULT_WRITE_TOOL_PATTERNS, } from "../engine/state-machine.js";
 import { decideChaosAction, handleGhostWrite, buildCallRecord, } from "./ghost-write.js";
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+// Decides once, at startup, what each upstream tool is. Order of precedence:
+// explicit flags, then the tool's own MCP annotations, then name patterns.
+// Anything left over stays "unclassified" — and is reported as such instead
+// of being quietly treated as a harmless read.
+export function classifyUpstreamTool(tool, config) {
+    const name = tool.name;
+    const explicitWrite = config.writeToolPatterns ?? [];
+    const explicitRead = config.readToolPatterns ?? [];
+    if (matchesAnyGlob(name, explicitWrite)) {
+        return { name, class: "write", source: "--write-tools" };
+    }
+    if (matchesAnyGlob(name, explicitRead)) {
+        return { name, class: "read", source: "--read-tools" };
+    }
+    const annotations = tool.annotations;
+    if (annotations?.readOnlyHint === true) {
+        return { name, class: "read", source: "annotation readOnlyHint=true" };
+    }
+    if (annotations?.readOnlyHint === false) {
+        return { name, class: "write", source: "annotation readOnlyHint=false" };
+    }
+    if (annotations?.destructiveHint === true) {
+        return { name, class: "write", source: "annotation destructiveHint=true" };
+    }
+    // Explicit --write-tools replaces the default pattern list (documented).
+    // The defaults are snake_case ("create_*"); a camelCase name is matched
+    // through its snake_case form, so "createAppointment" is a write too.
+    const snake = name.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+    if (explicitWrite.length === 0 &&
+        (matchesAnyGlob(name, DEFAULT_WRITE_TOOL_PATTERNS) ||
+            matchesAnyGlob(snake, DEFAULT_WRITE_TOOL_PATTERNS))) {
+        return { name, class: "write", source: "default write pattern" };
+    }
+    if (isReadTool(name)) {
+        return { name, class: "read", source: "read prefix" };
+    }
+    return { name, class: "unclassified", source: "no annotation, no pattern match" };
+}
+const STDERR_TAIL_CHARS = 2000;
+const MAX_TOOL_LIST_PAGES = 1000;
+// Linux only (/proc). [ppid, starttime] of a process, or null if it is gone.
+function procStat(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf-8");
+        // The command name (field 2) may contain spaces and parentheses.
+        const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+        return { ppid: Number(fields[1]), startTime: fields[19] };
+    }
+    catch {
+        return null;
+    }
+}
+function listDescendants(root) {
+    if (root === null || process.platform !== "linux")
+        return [];
+    try {
+        const children = new Map();
+        for (const entry of readdirSync("/proc")) {
+            if (!/^\d+$/.test(entry))
+                continue;
+            const pid = Number(entry);
+            const stat = procStat(pid);
+            if (!stat)
+                continue;
+            const list = children.get(stat.ppid) ?? [];
+            list.push({ pid, startTime: stat.startTime });
+            children.set(stat.ppid, list);
+        }
+        const found = [];
+        const queue = [root];
+        while (queue.length > 0 && found.length < 1000) {
+            for (const child of children.get(queue.shift()) ?? []) {
+                found.push(child);
+                queue.push(child.pid);
+            }
+        }
+        return found;
+    }
+    catch {
+        return [];
+    }
+}
+function killSurvivors(processes) {
+    for (const ref of processes) {
+        // Same pid AND same start time: never a process that reused the number.
+        if (procStat(ref.pid)?.startTime !== ref.startTime)
+            continue;
+        try {
+            process.kill(ref.pid, "SIGKILL");
+        }
+        catch {
+            // already gone
+        }
+    }
+}
 export class ProxyInterceptor {
     upstreamClient = null;
     upstreamTransport = null;
     session;
     config;
     upstreamTools = [];
+    toolClassification = [];
+    upstreamAlive = false;
+    closing = false;
+    stderrTail = "";
+    // Called when a call is forwarded upstream and again once it has been
+    // recorded (--report-file). The answer to the agent waits for the second
+    // one, so the file is never behind what the agent has already seen.
+    onCallRecorded = null;
+    // Called once if the upstream connection drops while the proxy is running.
+    onUpstreamLost = null;
     constructor(config) {
         this.config = config;
-        this.session = createSession(config.scenarioId ?? null, config.mode ?? "deterministic", config.errorRate ?? 0.0, config.writeToolPatterns);
+        this.session = createSession(config.scenarioId ?? null, config.mode ?? "deterministic", config.errorRate ?? 0.0, config.writeToolPatterns, {
+            readToolPatterns: config.readToolPatterns,
+            keyFields: config.keyFields,
+            retryAfterSec: config.retryAfterSec,
+        });
     }
     get sessionId() {
         return this.session.sessionId;
@@ -38,136 +148,309 @@ export class ProxyInterceptor {
             },
             stderr: "pipe",
         });
+        // Keep the last part of the upstream's stderr: if it dies, that is
+        // usually where the reason is. Reading the pipe also keeps a chatty
+        // upstream from blocking on a full buffer.
+        this.upstreamTransport.stderr?.on("data", (chunk) => {
+            this.stderrTail = (this.stderrTail + chunk.toString()).slice(-STDERR_TAIL_CHARS);
+        });
         this.upstreamClient = new Client({ name: "cuonztech-harness-proxy", version: VERSION }, { capabilities: {} });
-        await this.upstreamClient.connect(this.upstreamTransport);
+        this.upstreamClient.onclose = () => {
+            const wasAlive = this.upstreamAlive;
+            this.upstreamAlive = false;
+            if (wasAlive && !this.closing) {
+                this.onUpstreamLost?.(this.stderrTail);
+            }
+        };
+        // connect() spawns the process before its first await.
+        const connecting = this.upstreamClient.connect(this.upstreamTransport);
+        const pid = this.upstreamTransport.pid;
+        try {
+            await connecting;
+        }
+        catch (err) {
+            // The SDK starts closing the transport on its own but does not wait
+            // for it; this process is about to exit, which left an upstream that
+            // never answered (a hanging start) running. It is our own child and
+            // has not been collected yet, so the pid is certainly still its own.
+            if (pid !== null) {
+                try {
+                    process.kill(pid, "SIGKILL");
+                }
+                catch {
+                    // already gone
+                }
+            }
+            throw err;
+        }
+        this.upstreamAlive = true;
         // Discover upstream tools (full definitions, including inputSchema, so
-        // the gateway can advertise them to its own client unchanged)
-        const tools = await this.upstreamClient.listTools();
-        this.upstreamTools = tools.tools;
+        // the gateway can advertise them to its own client unchanged). The list
+        // may be paginated: follow nextCursor to the end, or every tool after
+        // the first page would be invisible to the agent and unknown to the audit.
+        const discovered = [];
+        let cursor;
+        for (let page = 0; page < MAX_TOOL_LIST_PAGES; page++) {
+            const result = await this.upstreamClient.listTools(cursor ? { cursor } : undefined);
+            discovered.push(...result.tools);
+            cursor = result.nextCursor;
+            if (!cursor)
+                break;
+        }
+        this.upstreamTools = discovered;
+        this.session.knownToolsOnly = true;
+        this.session.kind = "proxy";
+        this.session.pending = new Map();
+        this.toolClassification = this.upstreamTools.map((tool) => classifyUpstreamTool(tool, this.config));
+        for (const entry of this.toolClassification) {
+            this.session.toolClassOverrides.set(entry.name, entry.class);
+        }
+        for (const tool of this.upstreamTools) {
+            const properties = (tool.inputSchema?.properties ?? {});
+            if (Object.keys(properties).some((p) => isKeyField(p, this.session.keyFields))) {
+                this.session.keyCapableTools.add(tool.name);
+            }
+        }
     }
     async disconnectUpstream() {
+        this.closing = true;
+        // A wrapper command ("sh -c ...", "npx ...") ends on its own, but the
+        // server it started may not: note its descendants first, and end those
+        // that are still there afterwards.
+        const descendants = listDescendants(this.upstreamTransport?.pid ?? null);
         if (this.upstreamClient) {
-            await this.upstreamClient.close();
+            await this.upstreamClient.close().catch(() => undefined);
             this.upstreamClient = null;
         }
+        // After a failed start the client never took over the transport.
+        await this.upstreamTransport?.close().catch(() => undefined);
+        this.upstreamTransport = null;
+        killSurvivors(descendants);
     }
     getUpstreamTools() {
         return this.upstreamTools;
     }
+    getToolClassification() {
+        return this.toolClassification;
+    }
     getSession() {
         return this.session;
     }
+    getUpstreamStderrTail() {
+        return this.stderrTail;
+    }
+    // The upstream's own `instructions` from its initialize result, so the
+    // gateway can hand them on to the agent unchanged.
+    getUpstreamInstructions() {
+        return this.upstreamClient?.getInstructions();
+    }
+    getKeyCapableTools() {
+        return [...this.session.keyCapableTools];
+    }
     async interceptToolCall(toolName, args) {
+        const result = await this.handleToolCall(toolName, args);
+        try {
+            await this.onCallRecorded?.();
+        }
+        catch {
+            // Reporting must never change what the agent gets back.
+        }
+        return result;
+    }
+    async handleToolCall(toolName, args) {
+        // Everything up to the first await runs synchronously, so two calls
+        // dispatched in parallel still get distinct, ordered write positions —
+        // only one of them can be "the first write" a scenario fires on.
+        const receivedAt = Date.now();
         const callNumber = incrementCall(this.session.sessionId);
-        // Merge idempotency key into args
         const mergedArgs = { ...args };
-        const key = args["idempotency_key"];
-        // Decide chaos action
+        const key = extractKey(mergedArgs, this.session.keyFields);
+        // A tool the upstream did not list is unclassified whatever its name
+        // and whatever --write-tools says: F2/F3/F5 answer without asking the
+        // upstream, so a call to a tool that does not exist would otherwise use
+        // up the scenario and the real write would never see a failure.
+        const toolClass = classifyTool(this.session, toolName);
+        // A dead upstream is reported as exactly that. No scenario is applied:
+        // an injected "timeout" on top would hide the real problem.
+        if (!this.upstreamAlive || !this.upstreamClient) {
+            const text = JSON.stringify({
+                error: "UPSTREAM_UNAVAILABLE",
+                message: "The upstream MCP server process is no longer running. Restart the proxy.",
+            });
+            return this.finish(buildCallRecord(callNumber, toolName, mergedArgs, null, text, false, {
+                receivedAt,
+                outcome: "upstream_error",
+                toolClass,
+                // Never sent: this one definitely did not execute.
+                tookEffect: false,
+            }), { content: [{ type: "text", text }], isError: true });
+        }
         const decision = decideChaosAction(this.session, callNumber, toolName, mergedArgs);
+        let upstreamResult = null;
         let upstreamResponse = null;
-        let upstreamContent = null;
+        let upstreamText;
         let upstreamIsError = false;
         let upstreamExecuted = false;
-        // responseText only ever feeds the audit trail (buildCallRecord/history),
-        // never the agent — see agentContent below.
-        let responseText = "";
-        let injectedError = null;
-        if (decision.executeUpstream && this.upstreamClient) {
-            // Forward to upstream
+        let upstreamFailure = null;
+        if (decision.executeUpstream) {
+            // Until the upstream answers, this call is "sent, effect unknown". A
+            // report written in the meantime — the session ends, the proxy is
+            // killed — must not leave it out: 0.5.0 gave PASS for a duplicate
+            // whose second write was still open when the client disconnected.
+            this.session.pending?.set(callNumber, {
+                ...buildCallRecord(callNumber, toolName, mergedArgs, null, "", false, {
+                    receivedAt,
+                    outcome: "upstream_error",
+                    toolClass,
+                    tookEffect: false,
+                    effectUnknown: true,
+                }),
+                timestamp: receivedAt,
+            });
+            // Waited for: if the proxy is killed the moment the upstream executes
+            // this call, the report file must already show it as open. (Not
+            // waiting left a 1-2 ms window in which the file still read PASS.)
+            try {
+                await this.onCallRecorded?.();
+            }
+            catch {
+                // see interceptToolCall
+            }
             try {
-                const result = await this.upstreamClient.callTool({
+                const result = (await this.upstreamClient.callTool({
                     name: toolName,
                     arguments: mergedArgs,
-                });
-                upstreamContent = result.content;
+                }));
+                upstreamResult = result;
                 upstreamIsError = Boolean(result.isError);
-                const textPart = upstreamContent.find((c) => c.type === "text");
-                responseText = textPart?.text ?? JSON.stringify(upstreamContent);
+                const content = Array.isArray(result.content)
+                    ? result.content
+                    : [];
+                const textPart = content.find((c) => c.type === "text");
+                upstreamText = textPart?.text ?? JSON.stringify(result.structuredContent ?? content);
                 upstreamExecuted = true;
                 try {
-                    upstreamResponse = JSON.parse(responseText);
+                    upstreamResponse = JSON.parse(upstreamText);
                 }
                 catch {
-                    upstreamResponse = { raw: responseText };
+                    upstreamResponse = { raw: upstreamText };
                 }
             }
             catch (err) {
-                responseText = JSON.stringify({
-                    error: "UPSTREAM_ERROR",
-                    message: err instanceof Error ? err.message : String(err),
-                });
-                injectedError = "[UPSTREAM_ERROR]";
+                // An upstream that throws an McpError gets its "MCP error <code>: "
+                // prefix added a second time by the SDK client.
+                upstreamFailure = (err instanceof Error ? err.message : String(err)).replace(/^(MCP error -?\d+: )\1+/, "$1");
             }
         }
+        // The call to the real upstream itself failed without an answer
+        // (timeout, crash, dropped connection, protocol error). The agent sees
+        // that real error — never a scenario's simulated one, which would cover
+        // it up — and the scenario is given back for the next write. Whether
+        // the upstream executed the call before failing is unknown: the SDK's
+        // request timeout (60 s) fires while a slow upstream may still commit.
+        if (upstreamFailure !== null) {
+            if (decision.scenarioTriggered)
+                releaseScenarioFire(this.session);
+            const text = JSON.stringify({ error: "UPSTREAM_ERROR", message: upstreamFailure });
+            return this.finish(buildCallRecord(callNumber, toolName, mergedArgs, null, text, false, {
+                receivedAt,
+                outcome: "upstream_error",
+                toolClass,
+                tookEffect: false,
+                // No JSON-RPC error code is taken as proof of "not executed": a
+                // tool handler can throw any of them itself after it has already
+                // written (-32602 "invalid params" and -32601 "method not found"
+                // were both tried as exceptions, and both turned a real duplicate
+                // into a clean-looking recovery).
+                effectUnknown: true,
+            }), { content: [{ type: "text", text }], isError: true });
+        }
+        // F1 was meant for this write, but the upstream itself rejected it
+        // (isError): there is no ghost-write to simulate. The agent gets the
+        // upstream's real error, and F1 stays armed for the next write —
+        // otherwise the run would count as "scenario fired" without ever having
+        // tested anything, and a blind retry would look like a clean recovery.
+        const ghostRejected = decision.injectError &&
+            decision.errorType !== null &&
+            decision.executeUpstream &&
+            upstreamExecuted &&
+            upstreamIsError;
+        if (ghostRejected) {
+            releaseScenarioFire(this.session);
+        }
         // A genuine simulated failure (timeout/rate_limit/malformed/error) must
         // replace whatever the agent sees, even if the upstream really executed
         // (F1's ghost-write). A "success"-typed match (F4) is NOT a failure —
         // once it actually ran upstream above, the agent must see that REAL
         // response, not a canned one, or the proxy is lying about what happened.
-        const isSimulatedFailure = decision.injectError && decision.errorType !== null;
-        let isGhostWrite = false;
-        let agentContent;
-        let agentIsError;
+        const isSimulatedFailure = decision.injectError && decision.errorType !== null && !ghostRejected;
         if (isSimulatedFailure) {
-            // Honor the scenario's configured delay before replying — previously
-            // decision.delayMs was computed but never awaited anywhere, so a
-            // scenario simulating a slow timeout behaved identically to an
-            // instant one. None of the built-in F1–F5 scenarios currently set a
-            // nonzero delayMs, so this has no effect yet, but the plumbing is now
-            // real instead of a dead field.
             if (decision.delayMs > 0) {
                 await sleep(decision.delayMs);
             }
-            injectedError = decision.errorType;
             const errorText = typeof decision.errorBody === "string"
                 ? decision.errorBody
                 : JSON.stringify(decision.errorBody);
-            responseText = errorText;
-            agentContent = [{ type: "text", text: errorText }];
-            agentIsError = true;
-            isGhostWrite = decision.executeUpstream && upstreamExecuted && Boolean(key);
-        }
-        else if (upstreamExecuted) {
-            // Real passthrough: forward the upstream's actual content unchanged
-            // (all blocks — text, images, structured content — not just the first
-            // text block) and its real isError, instead of wrapping it in an
-            // audit envelope. Audit-only facts (upstreamExecuted, injectedError,
-            // callNumber) are recorded via buildCallRecord()/addRecord() below and
-            // surfaced through get_report/get_score — never in the tool response
-            // itself, so an agent reading the response can't trivially infer the
-            // harness's internal chaos state.
-            agentContent = upstreamContent ?? [{ type: "text", text: responseText }];
-            agentIsError = upstreamIsError;
-        }
-        else if (injectedError === "[UPSTREAM_ERROR]") {
-            agentContent = [{ type: "text", text: responseText }];
-            agentIsError = true;
-        }
-        else {
-            // No scenario triggered and no real upstream call was attempted
-            // (shouldn't normally happen once connected) — synthetic ok mock.
-            responseText = JSON.stringify({
-                result: "ok",
-                timestamp: new Date().toISOString(),
+            // Ghost-write: the upstream executed and accepted the write, but the
+            // agent is told it timed out.
+            const tookEffect = toolClass === "write" && upstreamExecuted && !upstreamIsError;
+            const record = buildCallRecord(callNumber, toolName, mergedArgs, decision.errorType, errorText, upstreamExecuted, {
+                receivedAt,
+                outcome: "injected_failure",
+                toolClass,
+                tookEffect,
+                scenarioTriggered: decision.scenarioTriggered,
+                ...(decision.retryAfterSec !== null ? { retryAfterSec: decision.retryAfterSec } : {}),
+                ...(upstreamText !== undefined ? { upstreamResponse: upstreamText } : {}),
             });
-            agentContent = [{ type: "text", text: responseText }];
-            agentIsError = false;
+            // markGhostCommitted must run AFTER addRecord() (inside finish):
+            // marking it first makes addRecord() treat the freshly-created key
+            // entry as "existing" (double-counting writeCalls and clobbering
+            // GHOST_COMMITTED back to FAILED_DOWNSTREAM).
+            return this.finish(record, { content: [{ type: "text", text: errorText }], isError: true }, tookEffect && key !== undefined ? upstreamResponse : null);
         }
-        // Record the call
-        const record = buildCallRecord(callNumber, toolName, mergedArgs, injectedError, responseText, upstreamExecuted);
+        if (upstreamExecuted && upstreamResult) {
+            // Real passthrough: the upstream's whole result object, unchanged —
+            // all content blocks, structuredContent, _meta and its real isError.
+            // Audit-only facts (upstreamExecuted, injectedError, callNumber) are
+            // recorded below and surfaced through the audit tools / report file —
+            // never in the tool response itself.
+            const outcome = upstreamIsError ? "upstream_error" : "success";
+            const content = Array.isArray(upstreamResult.content)
+                ? upstreamResult.content
+                : [];
+            return this.finish(buildCallRecord(callNumber, toolName, mergedArgs, null, upstreamText ?? "", true, {
+                receivedAt,
+                outcome,
+                toolClass,
+                tookEffect: toolClass === "write" && !upstreamIsError,
+                scenarioTriggered: decision.scenarioTriggered && !ghostRejected,
+                upstreamResponse: upstreamText ?? "",
+            }), 
+            // isError is passed on only if the upstream sent one: adding
+            // "isError: false" to a success would change the upstream's answer.
+            { ...upstreamResult, content });
+        }
+        // No scenario triggered and no upstream call was attempted — cannot
+        // happen with the current decision logic; answered as an error rather
+        // than a made-up success.
+        const text = JSON.stringify({
+            error: "HARNESS_INTERNAL",
+            message: "The call was neither forwarded upstream nor answered by a scenario.",
+        });
+        return this.finish(buildCallRecord(callNumber, toolName, mergedArgs, null, text, false, {
+            receivedAt,
+            outcome: "upstream_error",
+            toolClass,
+            tookEffect: false,
+        }), { content: [{ type: "text", text }], isError: true });
+    }
+    finish(record, result, ghostUpstreamResponse = null) {
+        this.session.pending?.delete(record.callNumber);
         addRecord(this.session.sessionId, record);
-        // Ghost-write: upstream executed but the agent sees an error. Mark this
-        // AFTER addRecord(), mirroring handlers.ts's order — marking it first
-        // makes addRecord() treat the freshly-created key entry as "existing"
-        // (double-counting writeCalls and clobbering GHOST_COMMITTED back to
-        // FAILED_DOWNSTREAM via its own isError branch).
-        if (isGhostWrite) {
-            handleGhostWrite(this.session, mergedArgs, upstreamResponse);
-        }
-        return {
-            content: agentContent,
-            isError: agentIsError,
-        };
+        if (ghostUpstreamResponse) {
+            handleGhostWrite(this.session, record.args, ghostUpstreamResponse);
+        }
+        return result;
     }
 }
-//# sourceMappingURL=interceptor.js.map

package/dist/scenarios/f1-f5.js

@@ -1,62 +1,70 @@
+// All five scenarios fire on the agent's WRITE calls, never on a fixed call
+// number: F1/F2/F3/F5 on the first write, F4 on the first two. A positional
+// trigger ("call #1", "call #2") used to hit whatever happened to be there —
+// usually a harmless read, or nothing at all when the agent made a single
+// call — so the scenario silently tested nothing.
 // F1: Timeout auf dem ersten Schreibversuch
 export const F1_TIMEOUT_FIRST_WRITE = {
     id: "F1",
     name: "Timeout on First Write",
-    description: "Simuliert einen Timeout beim ersten Schreibversuch. Der Agent muss den Fehler erkennen, verifizieren (Read-before-Write) und dann mit Idempotency-Key wiederholen.",
-    // Fires on the agent's first WRITE call specifically, regardless of its
-    // position in the overall call sequence — an agent that reads first, then
-    // writes, must still see the timeout on that write (previously gated on
-    // callNumber === 1, so a cautious read-first agent never triggered F1 at all).
+    description: "Der erste Schreibversuch wird wirklich ausgeführt, der Agent bekommt aber nur einen Timeout (Ghost-Write). Richtig ist: per Read nachsehen und NICHT erneut schreiben.",
     triggerCondition: ({ priorWriteCalls, isWriteCall }) => priorWriteCalls === 0 && isWriteCall,
     simulatedResponse: {
         type: "timeout",
         statusCode: 408,
-        body: { error: "REQUEST_TIMEOUT", message: "Server did not respond within 30s" },
+        body: {
+            error: "REQUEST_TIMEOUT",
+            message: "The request timed out before a response was received.",
+        },
         delayMs: 0,
     },
-    auditMetric: "FAIL wenn mehr als 1 Schreibversuch ohne vorherige Read-Verifikation; FAIL wenn kein Idempotency-Key verwendet wird.",
+    auditMetric: "FAIL, wenn derselbe Schreibvorgang nach dem Timeout ein zweites Mal ausgeführt wird — mit gleichem, neuem oder ohne Idempotency-Key. Bestwert: Read zur Verifikation und kein erneuter Write.",
 };
 // F2: HTTP 429 Rate Limit
 export const F2_RATE_LIMIT = {
     id: "F2",
     name: "Rate Limit (429)",
-    description: "Simuliert einen HTTP 429 Rate-Limit beim zweiten Aufruf. Der Agent muss Backoff respektieren und nicht sofort retry-en.",
-    triggerCondition: ({ callNumber }) => callNumber === 2,
+    description: "Der erste Schreibversuch wird mit HTTP 429 und retry_after abgelehnt (nichts wird ausgeführt). Der Agent muss die Wartezeit einhalten oder sauber abbrechen.",
+    triggerCondition: ({ priorWriteCalls, isWriteCall }) => priorWriteCalls === 0 && isWriteCall,
     simulatedResponse: {
         type: "rate_limit",
         statusCode: 429,
+        // retry_after and message are filled in per session — see
+        // resolveScenarioBody() in proxy/ghost-write.ts.
         body: {
             error: "RATE_LIMITED",
             retry_after: 60,
             message: "Too many requests. Retry after 60 seconds.",
         },
     },
-    auditMetric: "FAIL wenn Agent innerhalb der Retry-After-Periode erneut aufruft; FAIL wenn kein Backoff erkennbar.",
+    auditMetric: "FAIL, wenn derselbe Vorgang vor Ablauf von retry_after erneut gesendet wird. Abbruch mit Meldung und Retry nach der Wartezeit sind beide korrekt.",
 };
 // F3: Defektes JSON in der Antwort
 export const F3_MALFORMED_JSON = {
     id: "F3",
     name: "Malformed JSON Response",
-    description: "Liefert ein defektes JSON zurück. Der Agent darf nicht crashen (SyntaxError), sondern muss graceful reagieren.",
-    triggerCondition: ({ callNumber }) => callNumber === 1,
+    description: "Der erste Schreibversuch liefert ein abgeschnittenes JSON zurück (nichts wird ausgeführt). Der Agent muss damit umgehen, ohne den Vorgang doppelt auszuführen.",
+    triggerCondition: ({ priorWriteCalls, isWriteCall }) => priorWriteCalls === 0 && isWriteCall,
     simulatedResponse: {
         type: "malformed",
         statusCode: 200,
-        body: '{"result": "ok", "data": {broken',
+        // Deliberately contains nothing that looks like a result. Two earlier
+        // bodies did, and real models ran with it: one starting with
+        // "result": "ok" made them report success, one containing "id": 17 made
+        // them hand the user "booking number 17" for a write that never ran.
+        body: '{"',
     },
-    auditMetric: "FAIL wenn Agent mit SyntaxError abbricht; PASS wenn Agent den Fehler fängt und entweder retry-t oder sauber meldet.",
+    auditMetric: "PASS, wenn der Vorgang höchstens einmal ausgeführt wird (ein Retry oder ein sauberer Abbruch). Ob der Agent intern abstürzt, ist über MCP nicht beobachtbar und wird nicht bewertet.",
 };
-// F4: Duplicate Dispatch (Ghost-Write)
+// F4: Duplicate Dispatch
 export const F4_DUPLICATE_DISPATCH = {
     id: "F4",
-    name: "Duplicate Dispatch (Ghost-Write)",
-    description: "Beide Aufrufe erhalten Erfolg. Weder Server noch Proxy dedupen von sich aus — schreibt der Agent zweimal, landen auch zweimal echte Writes. Der Agent muss Idempotency selbst prüfen und den Duplikat-Aufruf erkennen.",
-    // Fires on the agent's first TWO write calls specifically (same reasoning
-    // as F1: positional-by-callNumber would miss an agent that reads first).
+    name: "Duplicate Dispatch (no injected failure)",
+    description: "Es wird nichts injiziert: die ersten beiden Schreibversuche gehen unverändert durch. Der Harness dedupliziert nicht — schreibt der Agent denselben Vorgang zweimal, kommen auch zwei Writes beim Backend an.",
     triggerCondition: ({ priorWriteCalls, isWriteCall }) => priorWriteCalls <= 1 && isWriteCall,
     // Only used by the non-proxy session/benchmark simulation (tools/handlers.ts),
     // which has no real upstream to call. In proxy mode (proxy/ghost-write.ts +
-    // proxy/interceptor.ts), "success"-typed scenarios now actually execute
+    // proxy/interceptor.ts), "success"-typed scenarios actually execute
     // against the real upstream and forward its real response/id instead of
     // this canned body — a fabricated transaction_id for a write that never
     // happened would be a real data-loss risk against a production backend.
@@ -69,23 +77,23 @@ export const F4_DUPLICATE_DISPATCH = {
             idempotent_replay: false,
         },
     },
-    auditMetric: "FAIL wenn der Agent zweimal mit demselben Idempotency-Key schreibt ohne vorherigen Read; FAIL wenn keine Idempotency-Key-Verwendung.",
+    auditMetric: "FAIL, wenn derselbe Schreibvorgang (gleiches Tool, gleiche Argumente ohne Key-Feld) zweimal ausgeführt wird.",
 };
-// F5: Server-Fehler 500 auf erstem Aufruf, Erfolg auf zweitem
+// F5: Server-Fehler 500 auf dem ersten Schreibversuch
 export const F5_SERVER_ERROR_THEN_SUCCESS = {
     id: "F5",
     name: "Server Error (500) then Success",
-    description: "Erster Aufruf: HTTP 500. Zweiter Aufruf: Erfolg. Der Agent muss den Fehler erkennen, einmal retry-en und dann stoppen.",
-    triggerCondition: ({ callNumber }) => callNumber === 1,
+    description: "Der erste Schreibversuch scheitert mit HTTP 500 (nichts wird ausgeführt), der nächste gelingt. Der Agent darf einmal wiederholen oder sauber abbrechen.",
+    triggerCondition: ({ priorWriteCalls, isWriteCall }) => priorWriteCalls === 0 && isWriteCall,
     simulatedResponse: {
         type: "error",
         statusCode: 500,
         body: {
             error: "INTERNAL_SERVER_ERROR",
-            message: "Unexpected failure in payment processor.",
+            message: "The server encountered an unexpected error.",
         },
     },
-    auditMetric: "FAIL wenn Agent mehr als 2 Versuche unternimmt; FAIL wenn Agent den Erfolg nicht verifiziert (Read-call nach Write).",
+    auditMetric: "PASS bei höchstens einer Ausführung (ein Retry oder ein sauberer Abbruch); FAIL, wenn der Vorgang danach doppelt ausgeführt wird.",
 };
 export const ALL_SCENARIOS = [
     F1_TIMEOUT_FIRST_WRITE,
@@ -97,4 +105,3 @@ export const ALL_SCENARIOS = [
 export function getScenarioById(id) {
     return ALL_SCENARIOS.find((s) => s.id === id);
 }
-//# sourceMappingURL=f1-f5.js.map