failproofai 1.0.9-beta.2 → 1.0.10-beta.1

package/.next/standalone/hermes-plugin/client.py

@@ -98,11 +98,13 @@ def evaluate_policy(
     if len(body) > MAX_REQUEST_BYTES:
         raise EvaluationError("policy request exceeds the 1 MiB limit")
 
+    # One deadline covers connect, send and read: evaluation_timeout_ms is the
+    # longest a tool call can wait here. Connect is bounded by both budgets.
+    deadline = time.monotonic() + max(evaluation_timeout_ms, 1) / 1000
     try:
         with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
-            sock.settimeout(max(connect_timeout_ms, 1) / 1000)
+            sock.settimeout(min(max(connect_timeout_ms, 1) / 1000, _remaining_timeout(deadline)))
             sock.connect(str(daemon_socket_path()))
-            deadline = time.monotonic() + max(evaluation_timeout_ms, 1) / 1000
             sock.settimeout(_remaining_timeout(deadline))
             try:
                 sock.sendall(struct.pack(">I", len(body)) + body)

package/.next/standalone/hermes-plugin/ledger.py

@@ -23,7 +23,11 @@ class InstructionAction:
 
 
 class InstructionLedger:
-    def __init__(self, path: Path, *, ttl_seconds: int = 3600, max_rounds: int = 2) -> None:
+    def __init__(
+        self, path: Path | None, *, ttl_seconds: int = 3600, max_rounds: int = 2
+    ) -> None:
+        # None means the host gave no usable state directory; every use then
+        # raises LedgerError, which callers already treat as degraded state.
         self.path = path
         self.ttl_seconds = max(60, int(ttl_seconds))
         self.max_rounds = max(0, int(max_rounds))
@@ -31,7 +35,9 @@ class InstructionLedger:
         self._initialized = False
 
     def _connect(self) -> sqlite3.Connection:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
+        if self.path is None:
+            raise LedgerError("instruction state directory is unavailable")
+        self.path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
         connection = sqlite3.connect(self.path, timeout=0.25, isolation_level=None)
         connection.execute("PRAGMA busy_timeout = 250")
         connection.execute("PRAGMA journal_mode = WAL")
@@ -70,7 +76,7 @@ class InstructionLedger:
                         ON instruction_deliveries(profile, session_id, task_id, turn_id, expires_at_ms)
                         """
                     )
-            except sqlite3.Error as exc:
+            except (sqlite3.Error, OSError) as exc:
                 raise LedgerError(f"could not initialize instruction state: {exc}") from exc
             self._initialized = True
 

package/.next/standalone/hermes-plugin/plugin.yaml

@@ -1,5 +1,5 @@
 name: failproofai
-version: 1.0.6-beta.0
+version: 1.0.10-beta.1
 description: Real-time FailproofAI policy enforcement for Hermes
 manifest_version: 2
 api_version: 1
@@ -26,7 +26,7 @@ config_schema:
   evaluation_timeout_ms:
     type: int
     default: 12000
-    description: Maximum total time allowed for one policy evaluation.
+    description: Maximum total time one policy evaluation may take, connect included (capped at 25000).
   instruction_ttl_seconds:
     type: int
     default: 3600

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.9-beta.2",
+  "version": "1.0.10-beta.1",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -117,20 +117,20 @@
     "eslint-plugin-react-hooks": "7.0.1",
     "vite": "8.0.16",
     "undici": "7.29.1",
-    "brace-expansion": "5.0.9",
+    "brace-expansion": "5.0.12",
     "sharp": "0.35.4",
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.9-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.9-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.10-beta.1",
+    "@failproofai/failproofaid-linux-arm64": "1.0.10-beta.1",
+    "@failproofai/failproofaid-darwin-x64": "1.0.10-beta.1",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.10-beta.1"
   },
   "failproofaidBinaries": {
-    "linux-x64": "cd0a7124ae94ae78753cda6ffad985ba30be80443d8bc93d617ce507ba04e211",
-    "linux-arm64": "925446186bbfa827275356a9dc80b7d5351a6dcce9d926731419bbd91c1f98ba",
-    "darwin-x64": "cd35a6549f402b6c04848772074edb110a54a242fe7488792e59f8e8a00af475",
-    "darwin-arm64": "587b045accada4947a556e1bc1d748780a846c2ef95cf8dafb973a23fdbcb173"
+    "linux-x64": "868a4978a66e4407b86dac8d6c8af4ad0b2b355da56983fa5530f5d8b5024098",
+    "linux-arm64": "8a4603784e43552ed8cf5ed7a1552721c7216be4fb106ed6851daabd18e19ebe",
+    "darwin-x64": "b6a59948ad12c06cedc90ebca95492a357430a2a150b76ceaf98930f8b1279c2",
+    "darwin-arm64": "8c14361f7274973bb2cf99135ddb4a5a9cdc8b453a33e653156ba6b68354c417"
   }
 }

package/.next/standalone/sdk/python/failproofai_sdk/evaluator/__init__.py

@@ -14,7 +14,12 @@ from failproofai_sdk.evaluator.authoring import (
     Metric,
     Score,
 )
-from failproofai_sdk.evaluator.client import EvaluatorAPIError, EvaluatorClient
+from failproofai_sdk.evaluator.client import (
+    EvaluatorAPIError,
+    EvaluatorClient,
+    current_request_id,
+    request_id_scope,
+)
 from failproofai_sdk.evaluator.protocol import (
     Assignment,
     AssignmentDefinition,
@@ -70,6 +75,8 @@ __all__ = [
     "Evaluator",
     "ManagedCompiler",
     "EvaluatorAPIError",
+    "current_request_id",
+    "request_id_scope",
     "EvaluatorClient",
     "EvaluatorKind",
     "HeartbeatRequest",

package/.next/standalone/sdk/python/failproofai_sdk/evaluator/client.py

@@ -2,11 +2,15 @@
 
 from __future__ import annotations
 
+import contextvars
 import ipaddress
 import json
 import random
+import re
 import time
-from collections.abc import Callable, Mapping
+import uuid
+from collections.abc import Callable, Iterator, Mapping
+from contextlib import contextmanager
 from typing import Any
 from urllib.error import HTTPError, URLError
 from urllib.parse import urljoin, urlsplit
@@ -42,6 +46,56 @@ from failproofai_sdk.evaluator.protocol import (
 _DEFAULT_RESPONSE_LIMIT = 2 * 1024 * 1024
 _RETRYABLE_HTTP_STATUSES = frozenset({429, 502, 503, 504})
 
+REQUEST_ID_HEADER = "X-Request-Id"
+# A W3C trace id: the shape the server keeps as-is (it mints its own for
+# anything else, which would break the join between this worker's log line and
+# the server's).
+_TRACE_ID = re.compile(r"^[0-9a-f]{32}$")
+# What we accept back from a server before putting it on an error or a log line.
+_SANE_ECHO = re.compile(r"^[A-Za-z0-9-]{1,64}$")
+
+#: The request id the next API call should carry. Unset, every call mints its
+#: own. A caller that already has one — a job it is working on behalf of, or a
+#: host that correlates its own logs — sets it with :func:`request_id_scope`, and
+#: every call inside the scope sends it. ``asyncio.to_thread`` copies context, so
+#: a scope opened in the runtime reaches the client's worker thread.
+current_request_id: contextvars.ContextVar[str | None] = contextvars.ContextVar(
+    "failproofai_evaluator_request_id", default=None
+)
+
+
+def new_request_id() -> str:
+    return uuid.uuid4().hex
+
+
+@contextmanager
+def request_id_scope(request_id: str | None = None) -> Iterator[str]:
+    """Send ``request_id`` (or a fresh one) on every API call inside the block.
+
+    An id that is not a trace id (32 lowercase hex) is replaced with a fresh one
+    rather than sent, so a caller can never put free text on the wire.
+    """
+    value = request_id if request_id and _TRACE_ID.match(request_id) else new_request_id()
+    token = current_request_id.set(value)
+    try:
+        yield value
+    finally:
+        current_request_id.reset(token)
+
+
+def _request_id_for_call() -> str:
+    current = current_request_id.get()
+    return current if current and _TRACE_ID.match(current) else new_request_id()
+
+
+def _echoed_request_id(headers: Any) -> str | None:
+    """The server's ``x-request-id`` from a response's headers, when sane."""
+    if headers is None:
+        return None
+    value = headers.get(REQUEST_ID_HEADER) or headers.get(REQUEST_ID_HEADER.lower())
+    value = (value or "").strip()
+    return value if _SANE_ECHO.match(value) else None
+
 
 class _RejectRedirects(HTTPRedirectHandler):
     def redirect_request(self, request, file_pointer, code, message, headers, new_url):
@@ -222,6 +276,11 @@ class EvaluatorClient:
                 separators=(",", ":"),
             ).encode("utf-8")
             request_headers["Content-Type"] = "application/json"
+        # One id per call, shared by its retries: a retried call is one logical
+        # request, and the server's log lines for every attempt then group under
+        # one id. The caller's scope id wins (see `current_request_id`).
+        request_id = _request_id_for_call()
+        request_headers[REQUEST_ID_HEADER] = request_id
         if headers:
             request_headers.update(headers)
 
@@ -232,11 +291,18 @@ class EvaluatorClient:
             )
             try:
                 with self._opener(request, timeout=self._timeout_seconds) as response:
-                    return self._decode(
-                        response.read(response_limit + 1), response_limit
-                    )
+                    try:
+                        return self._decode(
+                            response.read(response_limit + 1), response_limit
+                        )
+                    except EvaluatorAPIError as error:
+                        error.request_id = (
+                            _echoed_request_id(getattr(response, "headers", None))
+                            or request_id
+                        )
+                        raise
             except HTTPError as error:
-                api_error = self._http_error(error, response_limit)
+                api_error = self._http_error(error, response_limit, request_id)
                 if attempt + 1 == attempts or not api_error.retryable:
                     raise api_error from error
             except (URLError, TimeoutError, OSError) as error:
@@ -246,6 +312,8 @@ class EvaluatorClient:
                         code="transport_error",
                         message=str(error),
                         retryable=True,
+                        # Never answered: ours is the only id there is.
+                        request_id=request_id,
                     ) from error
             # Jitter is scheduling noise, not a security decision.
             self._sleeper(random.uniform(0, min(0.25 * (2**attempt), 2.0)))  # nosec B311
@@ -279,7 +347,13 @@ class EvaluatorClient:
         return value
 
     @classmethod
-    def _http_error(cls, error: HTTPError, limit: int) -> EvaluatorAPIError:
+    def _http_error(
+        cls, error: HTTPError, limit: int, sent_request_id: str | None = None
+    ) -> EvaluatorAPIError:
+        # The server's id for this request: its logs are keyed on it. The
+        # envelope's own field first, then the response header, then ours — a
+        # proxy that answered in the server's place echoes nothing.
+        echoed = _echoed_request_id(error.headers) or sent_request_id
         raw = error.read(limit + 1)
         try:
             response = ErrorResponse.from_wire(cls._decode(raw, limit))
@@ -289,11 +363,12 @@ class EvaluatorClient:
                 code="http_error",
                 message=f"server returned HTTP {error.code}",
                 retryable=error.code in _RETRYABLE_HTTP_STATUSES,
+                request_id=echoed,
             )
         return EvaluatorAPIError(
             status=error.code,
             code=response.error.code,
             message=response.error.message,
             retryable=response.error.retryable,
-            request_id=response.error.request_id,
+            request_id=response.error.request_id or echoed,
         )

package/.next/standalone/sdk/python/failproofai_sdk/evaluator/runtime.py

@@ -289,9 +289,17 @@ class WorkerRuntime:
                     )
                 except EvaluatorAPIError as error:
                     self._increment("claim_failures")
+                    # The id rides in the message as well as `extra`: a plain
+                    # `logging.basicConfig` formatter drops extras, and this is
+                    # the id that finds the server's side of the failure.
                     logger.warning(
-                        "evaluator claim failed",
-                        extra={"code": error.code, "retryable": error.retryable},
+                        "evaluator claim failed (request_id=%s)",
+                        error.request_id,
+                        extra={
+                            "code": error.code,
+                            "retryable": error.retryable,
+                            "request_id": error.request_id,
+                        },
                     )
                     if not error.retryable:
                         raise
@@ -372,8 +380,11 @@ class WorkerRuntime:
                 # transcript that can never shrink. Log and return; the server
                 # terminalizes the assignment as `too_large`.
                 logger.warning(
-                    "assignment %s transcript is too large to evaluate; skipping",
+                    "assignment %s transcript is too large to evaluate; skipping "
+                    "(request_id=%s)",
                     assignment.assignment_id,
+                    error.request_id,
+                    extra={"request_id": error.request_id},
                 )
                 self._increment("transcripts_too_large")
                 return
@@ -796,10 +807,12 @@ class WorkerRuntime:
                         task.cancel()
                     return
                 logger.warning(
-                    "evaluator heartbeat failed",
+                    "evaluator heartbeat failed (request_id=%s)",
+                    error.request_id,
                     extra={
                         "assignment_id": assignment.assignment_id,
                         "code": error.code,
+                        "request_id": error.request_id,
                     },
                 )
                 self._increment("heartbeat_failures")
@@ -924,6 +937,12 @@ class WorkerRuntime:
             task.result()
         except asyncio.CancelledError:
             pass
+        except EvaluatorAPIError as error:
+            logger.exception(
+                "evaluator assignment failed (request_id=%s)",
+                error.request_id,
+                extra={"code": error.code, "request_id": error.request_id},
+            )
         except Exception:
             logger.exception("evaluator assignment failed")
 

package/.next/standalone/sdk/python/tests/test_evaluator_request_id.py

@@ -0,0 +1,197 @@
+"""Every evaluator API call carries a request id, and every failure names one.
+
+The server logs each worker call under its `x-request-id`. A worker log line
+that says `request_id=4bf92f35…` is then one query away from the server's side
+of the same failure — but only if the worker sent an id the server keeps (a
+32-hex trace id), and only if the error carries the id the server logged.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import io
+import json
+import logging
+import re
+from email.message import Message
+from urllib.error import HTTPError, URLError
+
+import pytest
+
+from failproofai_sdk.evaluator import (
+    ClaimRequest,
+    EvaluatorAPIError,
+    EvaluatorClient,
+    current_request_id,
+    request_id_scope,
+)
+
+TRACE_ID = re.compile(r"^[0-9a-f]{32}$")
+SERVER_ID = "4bf92f3577b34da6a3ce929d0e0e4736"
+
+
+class Response:
+    def __init__(self, body, headers=None):
+        self.body = json.dumps(body).encode() if not isinstance(body, bytes) else body
+        self.headers = headers or {}
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        return None
+
+    def read(self, amount):
+        return self.body[:amount]
+
+
+def _client(opener):
+    return EvaluatorClient(
+        base_url="https://cloud.example/",
+        credential="secret",
+        opener=opener,
+        sleeper=lambda _: None,
+    )
+
+
+def _claim(client):
+    return client.claim(ClaimRequest("worker", "sha256:x", 1, 20))
+
+
+def _headers(**values):
+    message = Message()
+    for key, value in values.items():
+        message[key.replace("_", "-")] = value
+    return message
+
+
+def test_every_call_sends_a_fresh_trace_id():
+    sent = []
+
+    def opener(request, timeout):
+        sent.append(request.get_header("X-request-id"))
+        return Response({"assignments": [], "lease_duration_seconds": 30})
+
+    client = _client(opener)
+    for _ in range(2):
+        try:
+            _claim(client)
+        except Exception:  # noqa: BLE001 - the response shape is not under test here
+            pass
+    assert len(sent) == 2
+    assert all(TRACE_ID.match(i or "") for i in sent), sent
+    assert sent[0] != sent[1]
+
+
+def test_retries_of_one_call_share_its_id():
+    sent = []
+
+    def opener(request, timeout):
+        sent.append(request.get_header("X-request-id"))
+        raise URLError("reset")
+
+    with pytest.raises(EvaluatorAPIError) as caught:
+        # heartbeat retries; claim deliberately does not
+        _client(opener)._json("POST", "/v1/evaluator/runs/heartbeat", None, retry=True)
+    assert len(sent) == 4
+    assert len(set(sent)) == 1
+    # A call that never got an answer names the id it sent.
+    assert caught.value.request_id == sent[0]
+
+
+def test_a_caller_scope_id_is_honoured():
+    sent = []
+
+    def opener(request, timeout):
+        sent.append(request.get_header("X-request-id"))
+        raise URLError("offline")
+
+    with request_id_scope(SERVER_ID) as scoped:
+        assert scoped == SERVER_ID
+        with pytest.raises(EvaluatorAPIError):
+            _claim(_client(opener))
+    assert sent == [SERVER_ID]
+    assert current_request_id.get() is None, "the scope must not leak"
+
+
+def test_a_scope_reaches_the_thread_the_runtime_calls_the_client_on():
+    # The runtime calls the client via asyncio.to_thread, which copies context.
+    sent = []
+
+    def opener(request, timeout):
+        sent.append(request.get_header("X-request-id"))
+        raise URLError("offline")
+
+    async def main():
+        with request_id_scope(SERVER_ID):
+            with pytest.raises(EvaluatorAPIError):
+                await asyncio.to_thread(_claim, _client(opener))
+
+    asyncio.run(main())
+    assert sent == [SERVER_ID]
+
+
+def test_a_scope_with_free_text_is_replaced_not_sent():
+    with request_id_scope("evil\nheader") as scoped:
+        assert TRACE_ID.match(scoped)
+
+
+def test_an_http_error_carries_the_servers_echoed_id():
+    def opener(request, timeout):
+        raise HTTPError(
+            request.full_url, 503, "Unavailable", _headers(x_request_id=SERVER_ID), io.BytesIO(b"")
+        )
+
+    with pytest.raises(EvaluatorAPIError) as caught:
+        _claim(_client(opener))
+    assert caught.value.status == 503
+    assert caught.value.request_id == SERVER_ID
+
+
+def test_without_an_echo_the_error_names_the_id_it_sent():
+    sent = []
+
+    def opener(request, timeout):
+        sent.append(request.get_header("X-request-id"))
+        raise HTTPError(request.full_url, 502, "Bad Gateway", _headers(), io.BytesIO(b"<html>"))
+
+    with pytest.raises(EvaluatorAPIError) as caught:
+        _claim(_client(opener))
+    assert caught.value.request_id == sent[0]
+
+
+def test_a_malformed_success_body_still_names_an_id():
+    def opener(request, timeout):
+        return Response(b"<html>", headers=_headers(x_request_id=SERVER_ID))
+
+    with pytest.raises(EvaluatorAPIError) as caught:
+        _claim(_client(opener))
+    assert caught.value.code == "invalid_response"
+    assert caught.value.request_id == SERVER_ID
+
+
+def test_the_runtimes_claim_failure_line_names_the_request_id(caplog):
+    # Drive the real runtime path: a claim the server refuses must leave a warn
+    # line whose MESSAGE carries the id (a basicConfig formatter drops extras).
+    from tests.test_evaluator_runtime import FakeClient, _runtime
+
+    from failproofai_sdk.evaluator import Evaluator
+
+    class RejectedClaimClient(FakeClient):
+        def claim(self, request):
+            raise EvaluatorAPIError(
+                status=409,
+                code="catalog_mismatch",
+                message="register again",
+                retryable=False,
+                request_id=SERVER_ID,
+            )
+
+    runtime = _runtime(Evaluator(name="test", version="1"), RejectedClaimClient())
+    with caplog.at_level(logging.WARNING, logger="failproofai_sdk.evaluator"):
+        with pytest.raises(EvaluatorAPIError):
+            asyncio.run(runtime.run_forever())
+    lines = [r for r in caplog.records if "claim failed" in r.getMessage()]
+    assert lines, [r.getMessage() for r in caplog.records]
+    assert SERVER_ID in lines[0].getMessage()
+    assert lines[0].request_id == SERVER_ID

package/.next/standalone/sdk/python/uv.lock

@@ -2934,11 +2934,11 @@ wheels = [
 
 [[package]]
 name = "oauthlib"
-version = "3.3.1"
+version = "4.0.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/0b/5f/19930f824ffeb0ad4372da4812c50edbd1434f678c90c2733e1188edfc63/oauthlib-3.3.1.tar.gz", hash = "sha256:0f0f8aa759826a193cf66c12ea1af1637f87b9b4622d46e866952bb022e538c9", size = 185918, upload-time = "2025-06-19T22:48:08.269Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7a/d8/a1bcc8ba112a627f8ffbdc212a78ce18d3ac07e91a5ca65d27918eee25a1/oauthlib-4.0.0.tar.gz", hash = "sha256:efb274799819440f95b4ab3b818869f1ce9ae26c5beacba0201d1a1b76b54f86", size = 187232, upload-time = "2026-09-28T06:01:18.77Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/be/9c/92789c596b8df838baa98fa71844d84283302f7604ed565dafe5a6b5041a/oauthlib-3.3.1-py3-none-any.whl", hash = "sha256:88119c938d2b8fb88561af5f6ee0eec8cc8d552b7bb1f712743136eb7523b7a1", size = 160065, upload-time = "2025-06-19T22:48:06.508Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/f4/78229a1066068ca14fc60fb26cf7381cabe4382261392b90e5f9552722d4/oauthlib-4.0.0-py3-none-any.whl", hash = "sha256:624c28c13a0a59cabf9747dfa52af63be3e512a7f2714df16e91b5b3a145e6cd", size = 159715, upload-time = "2026-09-28T06:01:17.008Z" },
 ]
 
 [[package]]
@@ -4082,14 +4082,14 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.15.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/ea/5194e52748b0da83d71e082d75496eaec6e58f419f5e184786ded517e6a9/pyjwt-2.15.1.tar.gz", hash = "sha256:4f259e80cdfb6b3fc18a7de51fd1ef9ec79652f25019bae68975ca2468a34df8", size = 121252, upload-time = "2026-09-28T18:40:42.598Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/50/ca/44de4e75f8aadc457f0634be3b542815078ded46dca30efb960edeecad6e/pyjwt-2.15.1-py3-none-any.whl", hash = "sha256:42d59d631f7768a1028a64c7ff581a9bf7519804daf91fc5b6c56e30eec5e193", size = 33860, upload-time = "2026-09-28T18:40:41.429Z" },
 ]
 
 [package.optional-dependencies]
@@ -5120,11 +5120,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]
 
 [[package]]

package/.next/standalone/sdk/typescript/CHANGELOG.md

@@ -45,6 +45,45 @@ section is missing or empty is refused before anything is built.
   `ai` stays at `7.0.111` in `nextjs` so the fixture still matches the `ai-7` twin
   whose trace `nextjs.test.ts` compares each route against. (#838)
 
+- **Two more fixture advisories clear, and again no fixture leaves its pinned
+  major.** Both were reachable the whole time; nothing had looked. `ai-5` pinned
+  `undici` at `7.29.0` through the override added in #837, and GHSA-3wwx-pv8p-q78v
+  (medium) is fixed in `7.29.1` — the root `package.json`'s own `undici` override
+  moved there, the fixture's did not. `mastra-0` carried **eleven** copies of
+  `@ai-sdk/provider-utils`, which split in two: nine parents on that fixture's 5.x
+  side (`ai-v5`, `@ai-sdk/gateway`, `@ai-sdk/openai-v5` and six siblings) pinned
+  exact `3.0.10`–`3.0.17`, every one below the `3.0.28` that fixes
+  GHSA-866g-f22w-33x8, while the other two are the `2.2.8` that ships *inside*
+  `ai@4.3.19` under `@mastra/core` and `@mastra/memory`. The accepted row above
+  describes only that second pair, so the 3.x half was never covered by it — a
+  plain `"@ai-sdk/provider-utils": "3.0.28"` would have forced both halves and
+  broken the pin. The entry is **spec-scoped** instead — `"@ai-sdk/provider-utils@3"`,
+  which npm applies only where the requested range already resolves inside 3.x —
+  so the 3.x copies collapse to one patched copy, the two `2.2.8` copies are
+  untouched, and `@mastra/core@0.24.9`, `@mastra/mcp@0.14.5`,
+  `@mastra/memory@0.15.13` and `ai@4.3.19` all resolve exactly as before. That
+  dedupe is most of the ~110 deleted lockfile lines.
+
+  **One of the nine hid behind an npm alias**, and that is the part worth
+  remembering. `@mastra/core@0.24.9` does not ask for `@ai-sdk/provider-utils`
+  by name — it asks for `"@ai-sdk/provider-utils-v5": "npm:@ai-sdk/provider-utils@3.0.12"`,
+  one of ten `-v5` aliases in that lockfile. npm keys `overrides` on the name the
+  **dependent requests**, not on the name that ends up installed, so
+  `"@ai-sdk/provider-utils@3"` never applied to it and an affected `3.0.12` stayed
+  in the tree looking, from every path-keyed check, exactly like a package that had
+  been patched. It needed its own alias-keyed entry,
+  `"@ai-sdk/provider-utils-v5": "npm:@ai-sdk/provider-utils@3.0.28"`. Verifying an
+  override by globbing lockfile paths for the real package name is what missed it;
+  `npm audit` names the alias directly. The other nine aliases are unaffected —
+  `ai-v5` resolves `5.0.60` and `5.0.97`, both above GHSA-rwvc-j5jr-mgvh's `5.0.52`
+  floor. Dependabot had reached the same two alerts by moving
+  `ai-4` to `ai@5.0.52`, `ai-5` to `ai@7.0.122` and `mastra-0` to
+  `@mastra/core@1.71.0` (#867) — the third time in as many days that its fix for a
+  fixture advisory was the one `SECURITY.md` forbids, and it failed the same
+  `ERESOLVE` on the same `@mastra/mcp` peer as #838. `ai-4` needed no change: both
+  advisories still open against it are the accepted kind, and the table above
+  already carries them. (#869)
+
 ## 0.0.1-beta.0 — 2026-09-23
 
 ### Added

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package-lock.json

@@ -128,9 +128,9 @@
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/undici": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
-      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "version": "7.29.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz",
+      "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package.json

@@ -11,6 +11,6 @@
     "@types/node": "22.20.4"
   },
   "overrides": {
-    "undici": "7.29.0"
+    "undici": "7.29.1"
   }
 }