llm-switcher 1.6.6 → 1.6.8

package/tests/goalcheck.e2e.test.mjs

@@ -0,0 +1,316 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const root = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const listen = server => new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+
+async function until(check, timeoutMs = 6000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (await check()) return;
+    await new Promise(r => setTimeout(r, 25));
+  }
+  throw new Error('timeout waiting for condition');
+}
+
+async function fixture(t) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-goalcheck-'));
+  const adminToken = 'admin-secret-token-123';
+  fs.writeFileSync(path.join(dir, 'admin.token'), adminToken, { mode: 0o600 });
+
+  let nativeVerdict = { ok: true, reason: 'looks complete' };
+  let jevScores = { complete: 0.14, evidence: 0.84, unfinished: 0.63 };
+  let jevStatus = 200;
+
+  // Mock native upstream (Anthropic format)
+  const nativeUp = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', b => raw += b);
+    req.on('end', () => {
+      if (req.method !== 'POST' || !raw.trim()) {
+        res.setHeader('content-type', 'application/json');
+        return res.end('{"data":[]}');
+      }
+      const body = JSON.parse(raw);
+      const isStream = Boolean(body.stream);
+      const respText = JSON.stringify(nativeVerdict);
+
+      if (isStream) {
+        res.setHeader('content-type', 'text/event-stream');
+        res.write(`event: message_start\ndata: {"type":"message_start","message":{"id":"msg_1","type":"message","role":"assistant","model":"claude-3-haiku","content":[],"usage":{"input_tokens":10,"output_tokens":5}}}\n\n`);
+        res.write(`event: content_block_start\ndata: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}\n\n`);
+        res.write(`event: content_block_delta\ndata: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":${JSON.stringify(respText)}}}\n\n`);
+        res.write(`event: content_block_stop\ndata: {"type":"content_block_stop","index":0}\n\n`);
+        res.write(`event: message_delta\ndata: {"type":"message_delta","delta":{"stop_reason":"end_turn"}}\n\n`);
+        res.write(`event: message_stop\ndata: {"type":"message_stop"}\n\n`);
+        res.end();
+      } else {
+        res.setHeader('content-type', 'application/json');
+        res.end(JSON.stringify({
+          id: 'msg_1',
+          type: 'message',
+          role: 'assistant',
+          model: 'claude-3-haiku',
+          content: [{ type: 'text', text: respText }],
+          stop_reason: 'end_turn'
+        }));
+      }
+    });
+  });
+  await listen(nativeUp);
+
+  // Mock Jev decision upstream
+  let jevRequests = [];
+  const jevUp = http.createServer((req, res) => {
+    let raw = '';
+    req.on('data', b => raw += b);
+    req.on('end', () => {
+      if (req.method === 'POST') {
+        jevRequests.push({ url: req.url, headers: req.headers, body: JSON.parse(raw) });
+      }
+      if (jevStatus !== 200) {
+        res.statusCode = jevStatus;
+        return res.end('error');
+      }
+      res.setHeader('content-type', 'application/json');
+      res.end(JSON.stringify({
+        model: 'typesafe/jev-latest',
+        answers: {
+          complete: { type: 'noul', noul: jevScores.complete },
+          evidence: { type: 'noul', noul: jevScores.evidence },
+          unfinished: { type: 'noul', noul: jevScores.unfinished }
+        }
+      }));
+    });
+  });
+  await listen(jevUp);
+
+  const reserve = http.createServer();
+  await listen(reserve);
+  const port = reserve.address().port;
+  await new Promise(r => reserve.close(r));
+
+  const configPath = path.join(dir, 'config.json');
+  fs.writeFileSync(configPath, JSON.stringify({
+    port,
+    activeProfile: 'p1',
+    activeProfiles: { claude: 'p1' },
+    profiles: {
+      p1: {
+        name: 'NativeMock',
+        mode: 'direct',
+        tool: 'claude',
+        inFormat: 'auto',
+        outFormat: 'anthropic',
+        baseURL: `http://127.0.0.1:${nativeUp.address().port}`,
+        apiKey: 'sk-native-key'
+      }
+    },
+    goalCheck: {
+      enabled: false,
+      backend: 'jev',
+      baseURL: `http://127.0.0.1:${jevUp.address().port}`,
+      apiKey: 'jev-test-key',
+      model: 'typesafe/jev-latest',
+      completeMin: 0.90,
+      evidenceMin: 0.85,
+      unfinishedMax: 0.10
+    }
+  }));
+
+  const child = spawn(process.execPath, [path.join(root, 'proxy.mjs')], {
+    env: {
+      ...process.env,
+      LLM_SWITCHER_CONFIG: configPath,
+      LLM_SWITCHER_STATE_DIR: dir,
+      LLM_SWITCHER_PORT: String(port)
+    },
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+
+  let logs = '';
+  child.stdout.on('data', b => logs += b);
+  child.stderr.on('data', b => logs += b);
+
+  t.after(async () => {
+    if (child.exitCode === null) {
+      const done = new Promise(r => child.once('exit', r));
+      child.kill();
+      await done;
+    }
+    nativeUp.closeAllConnections?.();
+    jevUp.closeAllConnections?.();
+    await Promise.all([
+      new Promise(r => nativeUp.close(r)),
+      new Promise(r => jevUp.close(r))
+    ]);
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  await until(async () => (await fetch(`http://127.0.0.1:${port}/health`).catch(() => null))?.ok);
+
+  const adminHeaders = {
+    'x-llm-switcher-token': adminToken,
+    'content-type': 'application/json'
+  };
+
+  const sendAdmin = (path, method = 'GET', body = null) => fetch(`http://127.0.0.1:${port}${path}`, {
+    method,
+    headers: adminHeaders,
+    body: body ? JSON.stringify(body) : undefined
+  });
+
+  const sendClaude = (body, stream = false) => fetch(`http://127.0.0.1:${port}/v1/messages`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      'user-agent': 'claude-cli/2.1.295'
+    },
+    body: JSON.stringify({ ...body, stream })
+  });
+
+  return {
+    port,
+    sendAdmin,
+    sendClaude,
+    setNativeVerdict: v => { nativeVerdict = v; },
+    setJevScores: s => { jevScores = s; },
+    setJevStatus: st => { jevStatus = st; },
+    jevRequests,
+    logs: () => logs
+  };
+}
+
+const evaluatorRequest = {
+  model: 'claude-3-haiku-20240307',
+  system: 'You are evaluating a stop-condition hook in Claude Code. Read the conversation transcript carefully, then judge whether the user-provided condition is satisfied.',
+  messages: [
+    { role: 'user', content: 'Please fix the failing tests in repo.' },
+    { role: 'assistant', content: 'I have edited the code and reports.' },
+    {
+      role: 'user',
+      content: 'Based on the conversation transcript above, has the following stopping condition been satisfied? Answer based on transcript evidence only.\n\nCondition: Fix all failing tests.'
+    }
+  ],
+  tools: []
+};
+
+test('goalcheck e2e: admin API endpoints and probe', async t => {
+  const f = await fixture(t);
+
+  // 1. GET /api/goal-check
+  const r1 = await f.sendAdmin('/api/goal-check');
+  assert.equal(r1.status, 200);
+  const data1 = await r1.json();
+  assert.equal(data1.goalCheck.enabled, false);
+  assert.equal(data1.goalCheck.apiKey, '__LLM_SWITCHER_KEEP_KEY__');
+  assert.equal(data1.goalCheck.hasApiKey, true);
+  assert.equal(data1.status.configured, true);
+
+  // 2. POST /api/goal-check/test (Probe)
+  const probeRes = await f.sendAdmin('/api/goal-check/test', 'POST', {
+    model: 'typesafe/jev-latest'
+  });
+  assert.equal(probeRes.status, 200);
+  const probeData = await probeRes.json();
+  assert.equal(probeData.ok, true);
+  assert.ok(probeData.message.includes('Connected successfully'));
+
+  // 3. POST /api/goal-check (enable feature)
+  const updateRes = await f.sendAdmin('/api/goal-check', 'POST', {
+    enabled: true,
+    completeMin: 0.90
+  });
+  assert.equal(updateRes.status, 200);
+  const updateData = await updateRes.json();
+  assert.equal(updateData.goalCheck.enabled, true);
+  assert.equal(updateData.status.enabled, true);
+
+  // 4. GET /api/goal-check/logs
+  const logsRes = await f.sendAdmin('/api/goal-check/logs');
+  assert.equal(logsRes.status, 200);
+  const logsData = await logsRes.json();
+  assert.ok(Array.isArray(logsData.logs));
+});
+
+test('goalcheck e2e: live interception, veto, and allow behaviors', async t => {
+  const f = await fixture(t);
+
+  // Case A: Feature is OFF -> passes through untouched
+  f.setNativeVerdict({ ok: true, reason: 'native pass' });
+  const offRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(offRes.status, 200);
+  const offJson = await offRes.json();
+  const offVerdict = JSON.parse(offJson.content[0].text);
+  assert.equal(offVerdict.ok, true);
+  assert.equal(offVerdict.reason, 'native pass');
+  assert.equal(f.jevRequests.length, 0); // Jev was not called!
+
+  // Enable Goal Check
+  await f.sendAdmin('/api/goal-check', 'POST', { enabled: true });
+
+  // Case B: Feature is ON -> Native passes, but Jev has low complete score (0.14) -> VETOED!
+  f.setJevScores({ complete: 0.14, evidence: 0.84, unfinished: 0.63 });
+  f.setNativeVerdict({ ok: true, reason: 'audit report PASS' });
+
+  // Test Non-streaming JSON
+  const vetoRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(vetoRes.status, 200);
+  const vetoJson = await vetoRes.json();
+  const vetoVerdict = JSON.parse(vetoJson.content[0].text);
+  assert.equal(vetoVerdict.ok, false);
+  assert.match(vetoVerdict.reason, /Jev has not confirmed full completion/);
+  assert.match(vetoVerdict.reason, /complete=0.14/);
+  assert.equal(f.jevRequests.length, 1); // Jev was called!
+
+  // Test SSE streaming: verify valid event stream and vetoed result
+  const sseRes = await f.sendClaude(evaluatorRequest, true);
+  assert.equal(sseRes.status, 200);
+  assert.ok(sseRes.headers.get('content-type').includes('text/event-stream'));
+  const sseText = await sseRes.text();
+  assert.ok(sseText.includes('event: message_start'));
+  assert.ok(sseText.includes('event: content_block_delta'));
+  assert.ok(sseText.includes('event: message_stop'));
+  assert.ok(!sseText.includes('\\"ok\\":true')); // NEVER sends ok:true!
+  assert.ok(sseText.includes('\\"ok\\":false'));
+
+  // Case C: Feature is ON -> Native passes AND Jev scores pass all thresholds -> ALLOWED!
+  f.setJevScores({ complete: 0.95, evidence: 0.90, unfinished: 0.05 });
+  const allowRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(allowRes.status, 200);
+  const allowJson = await allowRes.json();
+  const allowVerdict = JSON.parse(allowJson.content[0].text);
+  assert.equal(allowVerdict.ok, true);
+  assert.equal(allowVerdict.reason, 'audit report PASS');
+
+  // Case D: Native rejects (ok: false) -> preserves native rejection
+  f.setNativeVerdict({ ok: false, reason: 'test command exited 1' });
+  const rejectRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(rejectRes.status, 200);
+  const rejectJson = await rejectRes.json();
+  const rejectVerdict = JSON.parse(rejectJson.content[0].text);
+  assert.equal(rejectVerdict.ok, false);
+  assert.equal(rejectVerdict.reason, 'test command exited 1');
+
+  // Case E: Jev unavailable (HTTP 502) -> fails closed
+  f.setNativeVerdict({ ok: true, reason: 'claimed done' });
+  f.setJevStatus(502);
+  const failRes = await f.sendClaude(evaluatorRequest, false);
+  assert.equal(failRes.status, 200);
+  const failJson = await failRes.json();
+  const failVerdict = JSON.parse(failJson.content[0].text);
+  assert.equal(failVerdict.ok, false);
+  assert.match(failVerdict.reason, /Goal Check verification unavailable/);
+
+  // Check logs endpoint recorded the checks
+  const logsRes = await f.sendAdmin('/api/goal-check/logs');
+  const logsData = await logsRes.json();
+  assert.ok(logsData.logs.length >= 4);
+  assert.equal(logsData.logs[0].verdictType, 'Unavailable');
+});

package/tests/goalcheck.test.mjs

@@ -0,0 +1,312 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  GOAL_CHECK_DEFAULTS,
+  goalCheckPolicy,
+  validateGoalCheckPatch,
+  redactGoalCheck,
+  isGoalEvaluatorRequest,
+  extractStoppingCondition,
+  buildBoundedEvidence,
+  buildJevQuestions,
+  combineVerdicts,
+  parseEvaluatorVerdict,
+  redactSecrets
+} from '../goalcheck.mjs';
+
+import {
+  resolveJevTarget,
+  extractScoreFromAnswer
+} from '../goalcheck-call.mjs';
+
+test('goalcheck: policy defaults and bounded values', () => {
+  const p = goalCheckPolicy({});
+  assert.equal(p.enabled, false);
+  assert.equal(p.backend, 'jev');
+  assert.equal(p.model, 'typesafe/jev-latest');
+  assert.equal(p.completeMin, 0.90);
+  assert.equal(p.evidenceMin, 0.85);
+  assert.equal(p.unfinishedMax, 0.10);
+  assert.equal(p.timeoutMs, 8000);
+  assert.equal(p.totalTimeoutMs, 25000);
+  assert.equal(p.maxStateChars, 60000);
+
+  // Clamping
+  const clamped = goalCheckPolicy({
+    goalCheck: {
+      completeMin: 1.5,
+      evidenceMin: -0.2,
+      unfinishedMax: 2.0,
+      timeoutMs: 100, // min 500
+      totalTimeoutMs: 200000, // max 120000
+      maxStateChars: 100 // min 500
+    }
+  });
+  assert.equal(clamped.completeMin, 1.0);
+  assert.equal(clamped.evidenceMin, 0.0);
+  assert.equal(clamped.unfinishedMax, 1.0);
+  assert.equal(clamped.timeoutMs, 500);
+  assert.equal(clamped.totalTimeoutMs, 120000);
+  assert.equal(clamped.maxStateChars, 500);
+});
+
+test('goalcheck: patch validation', () => {
+  assert.match(validateGoalCheckPatch(null), /must be an object/);
+  assert.match(validateGoalCheckPatch({ unknownField: true }), /unknown goal check field/);
+  assert.match(validateGoalCheckPatch({ enabled: 'yes' }), /enabled must be a boolean/);
+  assert.match(validateGoalCheckPatch({ completeMin: 1.2 }), /completeMin must be a number from 0 to 1/);
+  assert.match(validateGoalCheckPatch({ completeMin: -0.1 }), /completeMin must be a number from 0 to 1/);
+  assert.match(validateGoalCheckPatch({ timeoutMs: 100 }), /timeoutMs must be an integer from 500 to 60000/);
+  assert.match(validateGoalCheckPatch({ baseURL: 'ftp://bad' }), /baseURL must start with http/);
+
+  // While disabled, empty model or url is allowed
+  assert.equal(validateGoalCheckPatch({ enabled: false, model: '' }), '');
+
+  // Enabling without model is rejected
+  assert.match(validateGoalCheckPatch({ enabled: true, model: '' }), /model cannot be empty/);
+
+  // Valid patch
+  assert.equal(validateGoalCheckPatch({
+    enabled: true,
+    model: 'typesafe/jev-latest',
+    baseURL: 'https://api.example.com/v1',
+    completeMin: 0.88
+  }), '');
+});
+
+test('goalcheck: redaction', () => {
+  const policy = { enabled: true, apiKey: 'secret-key-123', model: 'typesafe/jev-latest' };
+  const redacted = redactGoalCheck(policy);
+  assert.equal(redacted.apiKey, '__LLM_SWITCHER_KEEP_KEY__');
+  assert.equal(redacted.hasApiKey, true);
+
+  const noKey = redactGoalCheck({ enabled: false, apiKey: '' });
+  assert.equal(noKey.apiKey, '');
+  assert.equal(noKey.hasApiKey, false);
+});
+
+test('goalcheck: evaluator request detection', () => {
+  const validEvaluatorPayload = {
+    system: 'You are evaluating a stop-condition hook in Claude Code. Read the conversation transcript carefully...',
+    messages: [
+      { role: 'user', content: 'Fix the bug in auth.js' },
+      { role: 'assistant', content: 'Fixed in commit 123' },
+      {
+        role: 'user',
+        content: 'Based on the conversation transcript above, has the following stopping condition been satisfied? Answer based on transcript evidence only.\n\nCondition: Fix the bug in auth.js'
+      }
+    ],
+    tools: []
+  };
+
+  const res = isGoalEvaluatorRequest('anthropic', validEvaluatorPayload, { 'user-agent': 'claude-cli/2.1.295' });
+  assert.equal(res.isEvaluator, true);
+  assert.equal(res.isSupported, true);
+  assert.equal(res.condition, 'Fix the bug in auth.js');
+
+  // Normal request without stop-hook system prompt
+  const normalPayload = {
+    system: 'You are Claude, a helpful AI assistant.',
+    messages: [{ role: 'user', content: 'What is the goal of AI?' }]
+  };
+  assert.deepEqual(isGoalEvaluatorRequest('anthropic', normalPayload), { isEvaluator: false, isSupported: false });
+
+  // Non-anthropic client
+  assert.deepEqual(isGoalEvaluatorRequest('responses', validEvaluatorPayload), { isEvaluator: false, isSupported: false });
+
+  // Evaluator template but with execution tools -> recognized but unsupported shape
+  const toolPayload = { ...validEvaluatorPayload, tools: [{ name: 'bash', description: 'run' }] };
+  const toolRes = isGoalEvaluatorRequest('anthropic', toolPayload);
+  assert.equal(toolRes.isEvaluator, true);
+  assert.equal(toolRes.isSupported, false);
+});
+
+test('goalcheck: extract stopping condition', () => {
+  const payload = {
+    messages: [
+      { role: 'user', content: 'Earlier chat' },
+      { role: 'user', content: 'Based on transcript...\n\nCondition: Ensure all unit tests pass with 0 failures.' }
+    ]
+  };
+  assert.equal(extractStoppingCondition(payload), 'Ensure all unit tests pass with 0 failures.');
+});
+
+test('goalcheck: bounded evidence building and secret redaction', () => {
+  const payload = {
+    messages: [
+      { role: 'user', content: 'Please deploy using key sk-1234567890abcdef1234' },
+      {
+        role: 'assistant',
+        content: [
+          { type: 'text', text: 'Running test suite' },
+          { type: 'tool_use', id: 'call_1', name: 'bash', input: { command: 'npm test' } }
+        ]
+      },
+      {
+        role: 'user',
+        content: [
+          { type: 'tool_result', tool_use_id: 'call_1', content: 'Pass: 167 tests', is_error: false }
+        ]
+      },
+      {
+        role: 'user',
+        content: 'Based on transcript...\n\nCondition: Tests must pass'
+      }
+    ]
+  };
+
+  const ev = buildBoundedEvidence(payload, 5000);
+  assert.equal(ev.stateTooLarge, false);
+  assert.ok(ev.state.includes('STOPPING CONDITION:\n\nTests must pass'));
+  assert.ok(ev.state.includes('[Tool Call call_1]: bash({"command":"npm test"})'));
+  assert.ok(ev.state.includes('[Tool Result call_1]: is_error=false\nPass: 167 tests'));
+  // Secret should be redacted
+  assert.ok(!ev.state.includes('sk-1234567890abcdef1234'));
+  assert.ok(ev.state.includes('[REDACTED_SECRET]'));
+
+  // Test size overflow
+  const evSmall = buildBoundedEvidence(payload, 100);
+  assert.equal(evSmall.stateTooLarge, true);
+  assert.ok(evSmall.chars > 100);
+});
+
+test('goalcheck: parseEvaluatorVerdict', () => {
+  assert.deepEqual(parseEvaluatorVerdict('{"ok": true, "reason": "all fixed"}'), {
+    ok: true,
+    reason: 'all fixed',
+    impossible: false
+  });
+
+  assert.deepEqual(parseEvaluatorVerdict('```json\n{"ok": false, "reason": "test failed", "impossible": true}\n```'), {
+    ok: false,
+    reason: 'test failed',
+    impossible: true
+  });
+
+  assert.deepEqual(parseEvaluatorVerdict('malformed non-json text'), {
+    malformed: true,
+    raw: 'malformed non-json text'
+  });
+});
+
+test('goalcheck: combineVerdicts decision matrix', () => {
+  const thresholds = { completeMin: 0.90, evidenceMin: 0.85, unfinishedMax: 0.10 };
+
+  // 1. Native rejected
+  const nativeFalse = combineVerdicts({
+    nativeVerdict: { ok: false, reason: 'missing file' },
+    jevResult: { ok: true, scores: { complete: 0.99, evidence: 0.99, unfinished: 0.01 } },
+    thresholds
+  });
+  assert.equal(nativeFalse.ok, false);
+  assert.equal(nativeFalse.reason, 'missing file');
+  assert.equal(nativeFalse.verdictType, 'Blocked');
+
+  // 2. Native impossible
+  const nativeImp = combineVerdicts({
+    nativeVerdict: { ok: false, impossible: true, reason: 'unsolvable' },
+    jevResult: null,
+    thresholds
+  });
+  assert.equal(nativeImp.ok, false);
+  assert.equal(nativeImp.impossible, true);
+  assert.equal(nativeImp.verdictType, 'Blocked');
+
+  // 3. Native unavailable / malformed
+  const nativeBad = combineVerdicts({
+    nativeVerdict: { malformed: true },
+    jevResult: { ok: true },
+    thresholds
+  });
+  assert.equal(nativeBad.ok, false);
+  assert.equal(nativeBad.verdictType, 'Unavailable');
+
+  // 4. Native ok: true AND Jev passes all 3 thresholds
+  const bothPass = combineVerdicts({
+    nativeVerdict: { ok: true, reason: 'tests passed' },
+    jevResult: { ok: true, scores: { complete: 0.95, evidence: 0.92, unfinished: 0.04 } },
+    thresholds
+  });
+  assert.equal(bothPass.ok, true);
+  assert.equal(bothPass.verdictType, 'Allowed');
+  assert.equal(bothPass.reason, 'tests passed');
+
+  // 5. Native ok: true BUT Jev complete fails
+  const completeFail = combineVerdicts({
+    nativeVerdict: { ok: true, reason: 'audit pass claimed' },
+    jevResult: { ok: true, scores: { complete: 0.14, evidence: 0.88, unfinished: 0.63 } },
+    thresholds
+  });
+  assert.equal(completeFail.ok, false);
+  assert.equal(completeFail.verdictType, 'Blocked');
+  assert.match(completeFail.reason, /complete=0.14 < min 0.90/);
+  assert.match(completeFail.reason, /unfinished=0.63 > max 0.10/);
+
+  // 6. Native ok: true BUT Jev state too large
+  const stateLarge = combineVerdicts({
+    nativeVerdict: { ok: true, reason: 'done' },
+    jevResult: { stateTooLarge: true, chars: 70000, maxChars: 60000 },
+    thresholds
+  });
+  assert.equal(stateLarge.ok, false);
+  assert.equal(stateLarge.verdictType, 'Insufficient evidence');
+
+  // 7. Native ok: true BUT Jev HTTP/network error
+  const jevErr = combineVerdicts({
+    nativeVerdict: { ok: true, reason: 'done' },
+    jevResult: { ok: false, reason: 'http-502', message: 'HTTP 502 Bad Gateway' },
+    thresholds
+  });
+  assert.equal(jevErr.ok, false);
+  assert.equal(jevErr.verdictType, 'Unavailable');
+
+  // 8. Native ok: true BUT Jev score NaN or missing
+  const jevNaN = combineVerdicts({
+    nativeVerdict: { ok: true, reason: 'done' },
+    jevResult: { ok: true, scores: { complete: Number.NaN, evidence: 0.9, unfinished: 0.05 } },
+    thresholds
+  });
+  assert.equal(jevNaN.ok, false);
+  assert.equal(jevNaN.verdictType, 'Unavailable');
+});
+
+test('goalcheck-call: target resolution and score extraction', () => {
+  const profiles = {
+    'intact-claude': {
+      baseURL: 'https://intact.example.com/v1',
+      apiKey: 'intact-key-xyz'
+    }
+  };
+
+  // From sourceProfile
+  const t1 = resolveJevTarget({ sourceProfile: 'intact-claude', model: 'typesafe/jev-latest' }, profiles);
+  assert.equal(t1.url, 'https://intact.example.com/v1/systemone');
+  assert.equal(t1.apiKey, 'intact-key-xyz');
+  assert.equal(t1.model, 'typesafe/jev-latest');
+
+  // Override baseURL and key
+  const t2 = resolveJevTarget({
+    baseURL: 'https://custom.provider.com/api',
+    apiKey: 'custom-key',
+    model: 'typesafe/jev-custom'
+  }, profiles);
+  assert.equal(t2.url, 'https://custom.provider.com/api/systemone');
+  assert.equal(t2.apiKey, 'custom-key');
+  assert.equal(t2.model, 'typesafe/jev-custom');
+
+  // Full decisionEndpoint override
+  const t3 = resolveJevTarget({
+    decisionEndpoint: 'https://alpha.decision.org/judge',
+    apiKey: 'k'
+  });
+  assert.equal(t3.url, 'https://alpha.decision.org/judge');
+
+  // Score extraction
+  assert.equal(extractScoreFromAnswer({ noul: 0.85 }), 0.85);
+  assert.equal(extractScoreFromAnswer({ score: 0.72 }), 0.72);
+  assert.equal(extractScoreFromAnswer({ probabilities: { yes: 0.93 } }), 0.93);
+  assert.equal(extractScoreFromAnswer({ choice: 'yes', confidence: 0.89 }), 0.89);
+  assert.equal(extractScoreFromAnswer({ choice: 'no', confidence: 0.80 }), 0.20);
+  assert.ok(Number.isNaN(extractScoreFromAnswer({ invalid: true })));
+});