llm-switcher 1.6.5 → 1.6.7

package/tests/compaction.e2e.test.mjs

@@ -0,0 +1,79 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { openResponsesWs } from './ws-client.mjs';
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+async function until(check) { const deadline = Date.now() + 6000; while (Date.now() < deadline) { if (await check()) return; await new Promise(r => setTimeout(r, 20)); } throw new Error('timeout'); }
+async function fixture(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-compaction-'));
+  const received = []; let finish = 'stop', truncate = false;
+  const up = http.createServer((req, res) => {
+    let raw = ''; req.on('data', b => raw += b); req.on('end', () => {
+      if (req.method === 'GET') return res.end('{"data":[]}');
+      const body = JSON.parse(raw); received.push(body);
+      const summary = 'KEEP_DECISION_7391';
+      if (body.stream) {
+        res.setHeader('content-type', 'text/event-stream');
+        res.write(`data: {"choices":\ndata: [{"index":0,"delta":{"content":"${summary}"}}]}\n\n`);
+        if (!truncate) res.write(`data: {"choices":[{"index":0,"delta":{},"finish_reason":"${finish}"}]}\n\ndata: [DONE]\n\n`);
+        res.end();
+      } else { res.setHeader('content-type', 'application/json'); res.end(JSON.stringify({ choices: [{ message: { content: summary }, finish_reason: finish }] })); }
+    });
+  }); await listen(up);
+  const reserve = http.createServer(); await listen(reserve); const port = reserve.address().port; await new Promise(r => reserve.close(r));
+  const config = path.join(dir, 'config.json'); fs.writeFileSync(config, JSON.stringify({ port, profiles: {
+    p1: { name: 'Offline', mode: 'convert', outFormat: 'openai-chat', baseURL: `http://127.0.0.1:${up.address().port}/v1`, apiKey: 'fixture-only' }
+  } }));
+  const child = spawn(process.execPath, [path.join(root, 'proxy.mjs')], { env: { ...process.env,
+    LLM_SWITCHER_CONFIG: config, LLM_SWITCHER_STATE_DIR: dir, LLM_SWITCHER_PORT: '', LLM_SWITCHER_REGISTRY_URL: 'http://127.0.0.1:9/' }, stdio: ['ignore', 'pipe', 'pipe'] });
+  let logs = ''; child.stdout.on('data', b => logs += b); child.stderr.on('data', b => logs += b);
+  t.after(async () => {
+    if (child.exitCode === null) { const done = new Promise(r => child.once('exit', r)); child.kill(); await done; }
+    up.closeAllConnections?.(); await new Promise(r => up.close(r));
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+  await until(async () => (await fetch(`http://127.0.0.1:${port}/health`).catch(() => null))?.ok);
+  const send = body => fetch(`http://127.0.0.1:${port}/v1/responses`, { method: 'POST', headers: { 'content-type': 'application/json', 'x-profile': 'p1' }, body: JSON.stringify(body) });
+  return { port, received, send, failure: (reason, cut = false) => { finish = reason; truncate = cut; }, logs: () => logs };
+}
+const trigger = stream => ({ model: 'm', stream, input: [{ role: 'user', content: 'ORIGINAL_HISTORY' }, { type: 'compaction_trigger' }] });
+const events = text => text.split('\n').filter(l => l.startsWith('data: {')).map(l => JSON.parse(l.slice(6)));
+
+test('HTTP compaction produces one item, replays it, and can compact the replay again', { timeout: 20000 }, async t => {
+  const f = await fixture(t);
+  for (const stream of [false, true]) {
+    const first = await f.send(trigger(stream)); assert.equal(first.status, 200, f.logs());
+    const response = stream ? events(await first.text()).find(e => e.type === 'response.completed').response : await first.json();
+    assert.equal(response.output.length, 1); assert.equal(response.output[0].type, 'compaction');
+    const replay = await f.send({ model: 'm', input: [response.output[0], { role: 'user', content: 'continue' }] });
+    assert.equal(replay.status, 200, await replay.text());
+    assert.match(JSON.stringify(f.received.at(-1).messages), /KEEP_DECISION_7391.*continue/);
+    const again = await f.send({ ...trigger(false), input: [response.output[0], { type: 'compaction_trigger' }] });
+    assert.equal(again.status, 200, await again.text());
+    assert.match(JSON.stringify(f.received.at(-1).messages), /KEEP_DECISION_7391/);
+    assert.doesNotMatch(JSON.stringify(f.received.at(-1)), /encrypted_content|compaction_trigger/);
+  }
+});
+test('HTTP compaction rejects token-limit and prematurely ended summaries', { timeout: 20000 }, async t => {
+  const f = await fixture(t);
+  f.failure('length'); assert.equal((await f.send(trigger(false))).status, 502);
+  f.failure('stop', true); const r = await f.send(trigger(true)); assert.equal(r.status, 502);
+  assert.doesNotMatch(await r.text(), /encrypted_content/);
+});
+test('WS compaction replays the compacted state through previous_response_id', { timeout: 20000 }, async t => {
+  const f = await fixture(t); const ws = await openResponsesWs(f.port, { 'x-profile': 'p1' }); t.after(ws.close);
+  ws.send({ type: 'response.create', ...trigger(true) });
+  await until(() => ws.messages.some(m => ['response.completed', 'response.failed'].includes(m.type)));
+  const completed = ws.messages.find(m => m.type === 'response.completed'); assert.ok(completed, JSON.stringify(ws.messages));
+  assert.equal(ws.messages.filter(m => m.type === 'response.output_item.done' && m.item.type === 'compaction').length, 1);
+  ws.send({ type: 'response.create', model: 'm', previous_response_id: completed.response.id, input: [{ role: 'user', content: 'NEXT_TURN' }] });
+  await until(() => f.received.length === 2);
+  assert.match(JSON.stringify(f.received.at(-1).messages), /KEEP_DECISION_7391.*NEXT_TURN/);
+  assert.doesNotMatch(JSON.stringify(f.received.at(-1).messages), /ORIGINAL_HISTORY/);
+});

package/tests/gateway-contract.test.mjs

@@ -0,0 +1,59 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { anthropicToIR, responsesToIR, irToChatBody, irToVertexBody, irToAnthropicBody } from '../formats.mjs';
+import { createToolVocab } from '../toolvocab.mjs';
+
+const prefix = 'llm-gateway-compact-v1:';
+const compact = summary => ({ type: 'compaction', encrypted_content: prefix + Buffer.from(JSON.stringify({ summary })).toString('base64url') });
+
+test('converted Responses replays gateway compaction and refuses unknown ciphertext', () => {
+  const body = irToChatBody(responsesToIR({ input: [compact('KEEP_DECISION'), { role: 'user', content: 'continue' }] }), 'm');
+  assert.match(JSON.stringify(body.messages), /KEEP_DECISION/);
+  assert.doesNotMatch(JSON.stringify(body.messages), /llm-gateway-compact/);
+  assert.throws(() => responsesToIR({ input: [{ type: 'compaction', encrypted_content: 'opaque-native-ciphertext' }] }), /compaction/i);
+});
+
+test('explicit true and false strict survive Responses to Chat', () => {
+  for (const strict of [true, false]) {
+    const ir = responsesToIR({ input: 'go', tools: [{ type: 'function', name: 'f', strict,
+      parameters: { type: 'object', properties: { x: { type: 'string' } }, required: ['x'], additionalProperties: false } }] });
+    assert.equal(irToChatBody(ir, 'm').tools[0].function.strict, strict);
+  }
+});
+
+test('Vertex tool names remain unique and reverse to the correct declaration, history and choice', () => {
+  const names = ['mcp__server-a__read', 'mcp__server_a__read'];
+  for (const order of [names, [...names].reverse()]) {
+    const ir = anthropicToIR({ tools: order.map(name => ({ name, input_schema: { type: 'object' } })), tool_choice: { type: 'tool', name: names[0] },
+      messages: [{ role: 'assistant', content: names.map((name, i) => ({ type: 'tool_use', id: `c${i}`, name, input: {} })) },
+        { role: 'user', content: names.map((_, i) => ({ type: 'tool_result', tool_use_id: `c${i}`, content: 'ok' })) }] });
+    const body = irToVertexBody(ir, 'gemini-2.5-pro');
+    const emitted = body.tools[0].functionDeclarations.map(t => t.name);
+    assert.equal(new Set(emitted).size, 2);
+    const vocab = createToolVocab(ir.tools, { allowHyphens: false });
+    assert.deepEqual(emitted.map(n => vocab.name(n)), order);
+    const calls = body.contents.find(c => c.role === 'model').parts.map(p => p.functionCall.name);
+    assert.deepEqual(calls.map(n => vocab.name(n)), names);
+    assert.equal(vocab.name(body.toolConfig.functionCallingConfig.allowedFunctionNames[0]), names[0]);
+    assert.equal(emitted[order.indexOf(names[1])], names[1], 'valid original stays reserved');
+  }
+});
+
+test('tool-result image reaches Chat, Anthropic and Vertex without becoming text', () => {
+  const ir = anthropicToIR({ messages: [
+    { role: 'assistant', content: [{ type: 'tool_use', id: 'image-call', name: 'screen', input: {} }] },
+    { role: 'user', content: [{ type: 'tool_result', tool_use_id: 'image-call', content: [
+      { type: 'text', text: 'screenshot' }, { type: 'image', source: { type: 'base64', media_type: 'image/png', data: 'iVBORw0KGgo=' } }
+    ] }] }
+  ] });
+  const chat = irToChatBody(ir, 'm');
+  const tool = chat.messages.find(m => m.role === 'tool');
+  assert.equal(tool.content, 'screenshot');
+  const image = chat.messages.find(m => m.role === 'user' && Array.isArray(m.content));
+  assert.equal(image.content.find(p => p.type === 'image_url').image_url.url, 'data:image/png;base64,iVBORw0KGgo=');
+  const anthropic = irToAnthropicBody(ir, 'm');
+  assert.equal(anthropic.messages.at(-1).content[0].content[1].source.data, 'iVBORw0KGgo=');
+  const vertex = irToVertexBody(ir, 'gemini-2.5-pro');
+  assert.match(JSON.stringify(vertex.contents), /"inlineData":\{"mimeType":"image\/png","data":"iVBORw0KGgo="\}/);
+  assert.doesNotMatch(tool.content, /omitted|base64/);
+});

package/tests/gateway.e2e.test.mjs

@@ -95,6 +95,19 @@ function startUpstream() {
         return res.end(JSON.stringify({ id: 'c1', object: 'chat.completion', model: json.model, choices: [{ index: 0, message: { role: 'assistant', content: 'converted ok' }, finish_reason: 'stop' }], usage: { prompt_tokens: 1, completion_tokens: 1 } }));
       }
       if (req.url.startsWith('/chat/v1/chat/completions')) {
+        if (lastUser.includes('TOOL_ALIAS_REPLAY')) {
+          const reference = json.messages.find(m => m.role === 'tool');
+          const name = JSON.parse(reference.content).tool_name;
+          if (!json.tools.some(t => t.function.name === name)) {
+            return sse(res, [{ error: { message: `upstream called undeclared tool '${name}'`, type: 'server_error' } }]);
+          }
+          return sse(res, [
+            { choices: [{ index: 0, delta: { tool_calls: [{ index: 0, id: 'console1', type: 'function', function: { name, arguments: '{"pageSize":0}' } }] } }] },
+            { choices: [{ index: 0, delta: { tool_calls: [{ index: 1, id: 'search2', type: 'function', function: { name: 'ToolSearch', arguments: '{"query":"select:' } }] } }] },
+            { choices: [{ index: 0, delta: { tool_calls: [{ index: 1, function: { arguments: `${name}","max_results":5}` } }] } }] },
+            { choices: [{ index: 0, delta: {}, finish_reason: 'tool_calls' }], usage: { prompt_tokens: 10, completion_tokens: 15 } }
+          ], { raw: ['data: [DONE]\n\n'] });
+        }
         if (lastUser.includes('RATE_LIMIT')) {
           res.writeHead(429, { 'Content-Type': 'application/json', 'retry-after': '7' });
           return res.end(JSON.stringify({ error: { message: 'slow down' } }));
@@ -650,6 +663,40 @@ test('Bifrost stays off for a model that is not a Claude Code account', async ()
   assert.equal(received.at(-1).url, '/intact/v1/chat/completions');
 });
 
+test('ToolSearch replay calls declared upstream aliases and restores original tool names and queries to Claude', async () => {
+  const name = 'mcp__plugin_chrome-devtools-mcp_chrome-devtools__list_console_messages';
+  const res = await post('/v1/messages', {
+    model: 'claude-opus-4-6', max_tokens: 256, stream: true, system: `Use ${name} to inspect errors.`,
+    tools: [
+      { name: 'ToolSearch', input_schema: { type: 'object', properties: { query: { type: 'string' }, max_results: { type: 'integer' } } } },
+      { name, input_schema: { type: 'object', properties: { pageSize: { type: 'integer' } } } }
+    ],
+    messages: [
+      { role: 'user', content: 'Inspect errors.' },
+      { role: 'assistant', content: [{ type: 'tool_use', id: 'search1', name: 'ToolSearch', input: { query: `select:${name}` } }] },
+      { role: 'user', content: [
+        { type: 'tool_result', tool_use_id: 'search1', content: [{ type: 'tool_reference', tool_name: name }] },
+        { type: 'text', text: 'TOOL_ALIAS_REPLAY' }
+      ] }
+    ]
+  });
+  assert.equal(res.status, 200);
+  const events = parseSSE(await res.text());
+  assertValidAnthropicEvents(events);
+  assert.ok(events.some(e => e.event === 'message_stop'));
+  assert.ok(!events.some(e => e.event === 'error'));
+  const starts = events.filter(e => e.data?.content_block?.type === 'tool_use');
+  assert.deepEqual(starts.map(e => e.data.content_block.name), [name, 'ToolSearch']);
+  const args = start => JSON.parse(events.filter(e => e.data?.index === start.data.index && e.data?.delta?.type === 'input_json_delta').map(e => e.data.delta.partial_json).join(''));
+  assert.deepEqual(args(starts[0]), { pageSize: 0 });
+  assert.deepEqual(args(starts[1]), { query: `select:${name}`, max_results: 5 });
+  const up = received.at(-1).body;
+  const alias = up.tools.find(t => t.function.name !== 'ToolSearch').function.name;
+  assert.equal(alias.length, 64);
+  assert.ok(!JSON.stringify(up.messages).includes(name));
+  assert.equal(JSON.parse(up.messages.find(m => m.tool_calls).tool_calls[0].function.arguments).query, `select:${alias}`);
+});
+
 test('Bifrost stays off for a client that is not Claude Code', async () => {
   await post('/v1/messages', { model: 'claude-opus-4-6', max_tokens: 10, messages: [{ role: 'user', content: 'hi' }] },
     { 'x-llm-profile': 'intactcc', 'user-agent': 'some-sdk/1.0' });

package/tests/goalcheck.e2e.test.mjs

@@ -0,0 +1,316 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+
+async function until(check, timeoutMs = 6000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await check()) return;
+    await new Promise(r => setTimeout(r, 25));
+  }
+  throw new Error('timeout waiting for condition');
+}
+
+async function fixture(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-goalcheck-'));
+  const adminToken = 'admin-secret-token-123';
+  fs.writeFileSync(path.join(dir, 'admin.token'), adminToken, { mode: 0o600 });
+
+  let nativeVerdict = { ok: true, reason: 'looks complete' };
+  let jevScores = { complete: 0.14, evidence: 0.84, unfinished: 0.63 };
+  let jevStatus = 200;
+
+  // Mock native upstream (Anthropic format)
+  const nativeUp = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', b => raw += b);
+    req.on('end', () => {
+      if (req.method !== 'POST' || !raw.trim()) {
+        res.setHeader('content-type', 'application/json');
+        return res.end('{"data":[]}');
+      }
+      const body = JSON.parse(raw);
+      const isStream = Boolean(body.stream);
+      const respText = JSON.stringify(nativeVerdict);
+
+      if (isStream) {
+        res.setHeader('content-type', 'text/event-stream');
+        res.write(`event: message_start\ndata: {"type":"message_start","message":{"id":"msg_1","type":"message","role":"assistant","model":"claude-3-haiku","content":[],"usage":{"input_tokens":10,"output_tokens":5}}}\n\n`);
+        res.write(`event: content_block_start\ndata: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}\n\n`);
+        res.write(`event: content_block_delta\ndata: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":${JSON.stringify(respText)}}}\n\n`);
+        res.write(`event: content_block_stop\ndata: {"type":"content_block_stop","index":0}\n\n`);
+        res.write(`event: message_delta\ndata: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}\n\n`);
+        res.write(`event: message_stop\ndata: {"type":"message_stop"}\n\n`);
+        res.end();
+      } else {
+        res.setHeader('content-type', 'application/json');
+        res.end(JSON.stringify({
+          id: 'msg_1',
+          type: 'message',
+          role: 'assistant',
+          model: 'claude-3-haiku',
+          content: [{ type: 'text', text: respText }],
+          stop_reason: 'end_turn'
+        }));
+      }
+    });
+  });
+  await listen(nativeUp);
+
+  // Mock Jev decision upstream
+  let jevRequests = [];
+  const jevUp = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', b => raw += b);
+    req.on('end', () => {
+      if (req.method === 'POST') {
+        jevRequests.push({ url: req.url, headers: req.headers, body: JSON.parse(raw) });
+      }
+      if (jevStatus !== 200) {
+        res.statusCode = jevStatus;
+        return res.end('error');
+      }
+      res.setHeader('content-type', 'application/json');
+      res.end(JSON.stringify({
+        model: 'typesafe/jev-latest',
+        answers: {
+          complete: { type: 'noul', noul: jevScores.complete },
+          evidence: { type: 'noul', noul: jevScores.evidence },
+          unfinished: { type: 'noul', noul: jevScores.unfinished }
+        }
+      }));
+    });
+  });
+  await listen(jevUp);
+
+  const reserve = http.createServer();
+  await listen(reserve);
+  const port = reserve.address().port;
+  await new Promise(r => reserve.close(r));
+
+  const configPath = path.join(dir, 'config.json');
+  fs.writeFileSync(configPath, JSON.stringify({
+    port,
+    activeProfile: 'p1',
+    activeProfiles: { claude: 'p1' },
+    profiles: {
+      p1: {
+        name: 'NativeMock',
+        mode: 'direct',
+        tool: 'claude',
+        inFormat: 'auto',
+        outFormat: 'anthropic',
+        baseURL: `http://127.0.0.1:${nativeUp.address().port}`,
+        apiKey: 'sk-native-key'
+      }
+    },
+    goalCheck: {
+      enabled: false,
+      backend: 'jev',
+      baseURL: `http://127.0.0.1:${jevUp.address().port}`,
+      apiKey: 'jev-test-key',
+      model: 'typesafe/jev-latest',
+      completeMin: 0.90,
+      evidenceMin: 0.85,
+      unfinishedMax: 0.10
+    }
+  }));
+
+  const child = spawn(process.execPath, [path.join(root, 'proxy.mjs')], {
+    env: {
+      ...process.env,
+      LLM_SWITCHER_CONFIG: configPath,
+      LLM_SWITCHER_STATE_DIR: dir,
+      LLM_SWITCHER_PORT: String(port)
+    },
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+
+  let logs = '';
+  child.stdout.on('data', b => logs += b);
+  child.stderr.on('data', b => logs += b);
+
+  t.after(async () => {
+    if (child.exitCode === null) {
+      const done = new Promise(r => child.once('exit', r));
+      child.kill();
+      await done;
+    }
+    nativeUp.closeAllConnections?.();
+    jevUp.closeAllConnections?.();
+    await Promise.all([
+      new Promise(r => nativeUp.close(r)),
+      new Promise(r => jevUp.close(r))
+    ]);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  await until(async () => (await fetch(`http://127.0.0.1:${port}/health`).catch(() => null))?.ok);
+
+  const adminHeaders = {
+    'x-llm-switcher-token': adminToken,
+    'content-type': 'application/json'
+  };
+
+  const sendAdmin = (path, method = 'GET', body = null) => fetch(`http://127.0.0.1:${port}${path}`, {
+    method,
+    headers: adminHeaders,
+    body: body ? JSON.stringify(body) : undefined
+  });
+
+  const sendClaude = (body, stream = false) => fetch(`http://127.0.0.1:${port}/v1/messages`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'user-agent': 'claude-cli/2.1.295'
+    },
+    body: JSON.stringify({ ...body, stream })
+  });
+
+  return {
+    port,
+    sendAdmin,
+    sendClaude,
+    setNativeVerdict: v => { nativeVerdict = v; },
+    setJevScores: s => { jevScores = s; },
+    setJevStatus: st => { jevStatus = st; },
+    jevRequests,
+    logs: () => logs
+  };
+}
+
+const evaluatorRequest = {
+  model: 'claude-3-haiku-20240307',
+  system: 'You are evaluating a stop-condition hook in Claude Code. Read the conversation transcript carefully, then judge whether the user-provided condition is satisfied.',
+  messages: [
+    { role: 'user', content: 'Please fix the failing tests in repo.' },
+    { role: 'assistant', content: 'I have edited the code and reports.' },
+    {
+      role: 'user',
+      content: 'Based on the conversation transcript above, has the following stopping condition been satisfied? Answer based on transcript evidence only.\n\nCondition: Fix all failing tests.'
+    }
+  ],
+  tools: []
+};
+
+test('goalcheck e2e: admin API endpoints and probe', async t => {
+  const f = await fixture(t);
+
+  // 1. GET /api/goal-check
+  const r1 = await f.sendAdmin('/api/goal-check');
+  assert.equal(r1.status, 200);
+  const data1 = await r1.json();
+  assert.equal(data1.goalCheck.enabled, false);
+  assert.equal(data1.goalCheck.apiKey, '__LLM_SWITCHER_KEEP_KEY__');
+  assert.equal(data1.goalCheck.hasApiKey, true);
+  assert.equal(data1.status.configured, true);
+
+  // 2. POST /api/goal-check/test (Probe)
+  const probeRes = await f.sendAdmin('/api/goal-check/test', 'POST', {
+    model: 'typesafe/jev-latest'
+  });
+  assert.equal(probeRes.status, 200);
+  const probeData = await probeRes.json();
+  assert.equal(probeData.ok, true);
+  assert.ok(probeData.message.includes('Connected successfully'));
+
+  // 3. POST /api/goal-check (enable feature)
+  const updateRes = await f.sendAdmin('/api/goal-check', 'POST', {
+    enabled: true,
+    completeMin: 0.90
+  });
+  assert.equal(updateRes.status, 200);
+  const updateData = await updateRes.json();
+  assert.equal(updateData.goalCheck.enabled, true);
+  assert.equal(updateData.status.enabled, true);
+
+  // 4. GET /api/goal-check/logs
+  const logsRes = await f.sendAdmin('/api/goal-check/logs');
+  assert.equal(logsRes.status, 200);
+  const logsData = await logsRes.json();
+  assert.ok(Array.isArray(logsData.logs));
+});
+
+test('goalcheck e2e: live interception, veto, and allow behaviors', async t => {
+  const f = await fixture(t);
+
+  // Case A: Feature is OFF -> passes through untouched
+  f.setNativeVerdict({ ok: true, reason: 'native pass' });
+  const offRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(offRes.status, 200);
+  const offJson = await offRes.json();
+  const offVerdict = JSON.parse(offJson.content[0].text);
+  assert.equal(offVerdict.ok, true);
+  assert.equal(offVerdict.reason, 'native pass');
+  assert.equal(f.jevRequests.length, 0); // Jev was not called!
+
+  // Enable Goal Check
+  await f.sendAdmin('/api/goal-check', 'POST', { enabled: true });
+
+  // Case B: Feature is ON -> Native passes, but Jev has low complete score (0.14) -> VETOED!
+  f.setJevScores({ complete: 0.14, evidence: 0.84, unfinished: 0.63 });
+  f.setNativeVerdict({ ok: true, reason: 'audit report PASS' });
+
+  // Test Non-streaming JSON
+  const vetoRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(vetoRes.status, 200);
+  const vetoJson = await vetoRes.json();
+  const vetoVerdict = JSON.parse(vetoJson.content[0].text);
+  assert.equal(vetoVerdict.ok, false);
+  assert.match(vetoVerdict.reason, /Jev has not confirmed full completion/);
+  assert.match(vetoVerdict.reason, /complete=0.14/);
+  assert.equal(f.jevRequests.length, 1); // Jev was called!
+
+  // Test SSE streaming: verify valid event stream and vetoed result
+  const sseRes = await f.sendClaude(evaluatorRequest, true);
+  assert.equal(sseRes.status, 200);
+  assert.ok(sseRes.headers.get('content-type').includes('text/event-stream'));
+  const sseText = await sseRes.text();
+  assert.ok(sseText.includes('event: message_start'));
+  assert.ok(sseText.includes('event: content_block_delta'));
+  assert.ok(sseText.includes('event: message_stop'));
+  assert.ok(!sseText.includes('\\"ok\\":true')); // NEVER sends ok:true!
+  assert.ok(sseText.includes('\\"ok\\":false'));
+
+  // Case C: Feature is ON -> Native passes AND Jev scores pass all thresholds -> ALLOWED!
+  f.setJevScores({ complete: 0.95, evidence: 0.90, unfinished: 0.05 });
+  const allowRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(allowRes.status, 200);
+  const allowJson = await allowRes.json();
+  const allowVerdict = JSON.parse(allowJson.content[0].text);
+  assert.equal(allowVerdict.ok, true);
+  assert.equal(allowVerdict.reason, 'audit report PASS');
+
+  // Case D: Native rejects (ok: false) -> preserves native rejection
+  f.setNativeVerdict({ ok: false, reason: 'test command exited 1' });
+  const rejectRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(rejectRes.status, 200);
+  const rejectJson = await rejectRes.json();
+  const rejectVerdict = JSON.parse(rejectJson.content[0].text);
+  assert.equal(rejectVerdict.ok, false);
+  assert.equal(rejectVerdict.reason, 'test command exited 1');
+
+  // Case E: Jev unavailable (HTTP 502) -> fails closed
+  f.setNativeVerdict({ ok: true, reason: 'claimed done' });
+  f.setJevStatus(502);
+  const failRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(failRes.status, 200);
+  const failJson = await failRes.json();
+  const failVerdict = JSON.parse(failJson.content[0].text);
+  assert.equal(failVerdict.ok, false);
+  assert.match(failVerdict.reason, /Goal Check verification unavailable/);
+
+  // Check logs endpoint recorded the checks
+  const logsRes = await f.sendAdmin('/api/goal-check/logs');
+  const logsData = await logsRes.json();
+  assert.ok(logsData.logs.length >= 4);
+  assert.equal(logsData.logs[0].verdictType, 'Unavailable');
+});