oh-my-knowledge 0.48.0 → 0.49.0

package/dist/executors/openai-api.js

@@ -1,4 +1,5 @@
-import { asErrorLike, DEFAULT_TIMEOUT_MS, errorMessage } from './shared.js';
+import { asErrorLike, DEFAULT_TIMEOUT_MS, errorMessage, readJsonResponse, responseBodyPreview, } from './shared.js';
+import { optionalTokenCount, splitInclusiveInputTokens } from '../shared/token-usage.js';
 export async function openAiApiExecutor({ model, system, prompt, timeoutMs = DEFAULT_TIMEOUT_MS }) {
     const apiKey = process.env.OPENAI_API_KEY;
     if (!apiKey)
@@ -16,17 +17,77 @@ export async function openAiApiExecutor({ model, system, prompt, timeoutMs = DEF
             body: JSON.stringify({ model: model || 'gpt-4o', messages }),
             signal: AbortSignal.timeout(timeoutMs),
         });
-        const data = await res.json();
+        const { data, rawBody } = await readJsonResponse(res);
         const durationMs = Date.now() - start;
         if (!res.ok) {
-            return { ok: false, error: data.error?.message || `API error ${res.status}`, durationMs, durationApiMs: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0, costUSD: 0, output: null, stopReason: 'error', numTurns: 0 };
+            const bodyPreview = responseBodyPreview(rawBody);
+            return { ok: false, error: data?.error?.message || `API error ${res.status}${bodyPreview ? `: ${bodyPreview}` : ''}`, durationMs, durationApiMs: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0, tokenUsageReportedByExecutor: false, costUSD: 0, costReportedByExecutor: false, output: null, stopReason: 'error', numTurns: 0 };
+        }
+        if (!data) {
+            return { ok: false, error: 'OpenAI API returned an empty or non-JSON response', durationMs, durationApiMs: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0, tokenUsageReportedByExecutor: false, costUSD: 0, costReportedByExecutor: false, output: null, stopReason: 'error', numTurns: 0 };
+        }
+        const usage = data.usage;
+        const rawInputTokens = optionalTokenCount(usage?.prompt_tokens);
+        const rawOutputTokens = optionalTokenCount(usage?.completion_tokens);
+        const rawCacheReadTokens = usage?.prompt_tokens_details?.cached_tokens === undefined
+            ? 0
+            : optionalTokenCount(usage.prompt_tokens_details.cached_tokens);
+        if (rawInputTokens === undefined
+            || rawOutputTokens === undefined
+            || rawCacheReadTokens === undefined
+            || rawCacheReadTokens > rawInputTokens) {
+            return {
+                ok: false,
+                error: 'OpenAI response contained missing or invalid token usage',
+                durationMs,
+                durationApiMs: 0,
+                inputTokens: 0,
+                outputTokens: 0,
+                cacheReadTokens: 0,
+                cacheCreationTokens: 0,
+                tokenUsageReportedByExecutor: false,
+                costUSD: 0,
+                costReportedByExecutor: false,
+                output: null,
+                stopReason: 'error',
+                numTurns: 1,
+            };
+        }
+        const normalizedInput = splitInclusiveInputTokens(rawInputTokens, rawCacheReadTokens);
+        const inputTokens = normalizedInput.inputTokens;
+        const outputTokens = rawOutputTokens;
+        const cacheReadTokens = normalizedInput.cacheReadTokens;
+        const choice = data.choices?.[0];
+        const content = choice?.message?.content;
+        if (typeof content !== 'string' || content.trim().length === 0) {
+            const refusal = choice?.message?.refusal?.trim();
+            return {
+                ok: false,
+                error: refusal
+                    ? `OpenAI response refused the request: ${refusal}`
+                    : 'OpenAI response did not contain assistant text',
+                durationMs,
+                durationApiMs: 0,
+                inputTokens,
+                outputTokens,
+                cacheReadTokens,
+                cacheCreationTokens: 0,
+                costUSD: 0,
+                costReportedByExecutor: false,
+                output: null,
+                stopReason: 'error',
+                numTurns: 1,
+            };
         }
-        const usage = data.usage || {};
         return {
-            ok: true, output: data.choices?.[0]?.message?.content || '', durationMs, durationApiMs: 0,
-            inputTokens: usage.prompt_tokens || 0, outputTokens: usage.completion_tokens || 0,
-            cacheReadTokens: usage.prompt_tokens_details?.cached_tokens || 0, cacheCreationTokens: 0,
-            costUSD: 0, stopReason: data.choices?.[0]?.finish_reason || 'unknown', numTurns: 1,
+            ok: true, output: content, durationMs, durationApiMs: 0,
+            // OpenAI reports cached tokens as a subset of prompt_tokens. Keep all
+            // executor buckets mutually exclusive so totals and cross-runtime trends
+            // do not count cache reads twice.
+            inputTokens, outputTokens,
+            cacheReadTokens, cacheCreationTokens: 0,
+            costUSD: 0, costReportedByExecutor: false,
+            stopReason: choice?.finish_reason || 'unknown', numTurns: 1,
         };
     }
     catch (err) {
@@ -34,6 +95,6 @@ export async function openAiApiExecutor({ model, system, prompt, timeoutMs = DEF
         const details = asErrorLike(err);
         const stopReason = details.name === 'TimeoutError' ? 'timeout' : 'error';
         const error = details.name === 'TimeoutError' ? `API request timed out after ${timeoutMs / 1000}s` : errorMessage(err);
-        return { ok: false, error, durationMs, durationApiMs: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0, costUSD: 0, output: null, stopReason, numTurns: 0 };
+        return { ok: false, error, durationMs, durationApiMs: 0, inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0, tokenUsageReportedByExecutor: false, costUSD: 0, costReportedByExecutor: false, output: null, stopReason, numTurns: 0 };
     }
 }

package/dist/executors/runtime-fingerprint.js

@@ -1,10 +1,11 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { delimiter, dirname, isAbsolute, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { buildExecEnv } from './shared.js';
+import { isScriptFileInterpreter, resolveScriptCommand, } from './script-command.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const requireFromHere = createRequire(import.meta.url);
 const RUNTIME_CACHE = new Map();
@@ -95,7 +96,7 @@ function readPackageField(packageName, field, from) {
         return undefined;
     }
 }
-function readCommand(command, args, env, timeout = 1000) {
+function readCommand(command, args, env, timeout = 3000) {
     try {
         const output = execFileSync(command, args, {
             encoding: 'utf-8',
@@ -140,12 +141,13 @@ function withFingerprint(input) {
     const stablePayload = {
         executor: input.executor,
         model: input.model,
-        kind: input.runtimeKind,
+        runtimeKind: input.runtimeKind,
         binary: input.binary
             ? {
                 name: input.binary.name,
                 source: input.binary.source,
                 version: input.binary.version,
+                contentHash: input.binary.contentHash,
                 status: input.binary.version ? 'ok' : input.binary.error ? 'error' : 'missing',
                 package: input.binary.package
                     ? {
@@ -179,13 +181,91 @@ function runtime(executor, model, kind, capabilities, extra = {}) {
 function runtimeEnv(options) {
     return options?.env ?? buildExecEnv(options?.skillDir);
 }
+function hashRuntimeFiles(paths) {
+    const files = [...new Set(paths)]
+        .filter((path) => {
+        try {
+            return statSync(path).isFile();
+        }
+        catch {
+            return false;
+        }
+    })
+        .sort();
+    if (files.length === 0)
+        return {};
+    const hash = createHash('sha256');
+    const errors = [];
+    for (const path of files) {
+        hash.update(path);
+        hash.update('\0');
+        try {
+            hash.update(readFileSync(path));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            errors.push(`${path}: ${message}`);
+            hash.update(`<unreadable:${message}>`);
+        }
+        hash.update('\0');
+    }
+    return {
+        contentHash: hash.digest('hex'),
+        ...(errors.length > 0 && { error: errors.join('; ') }),
+    };
+}
+function scriptRuntime(executorName, model, env) {
+    const resolved = resolveScriptCommand(executorName);
+    const executablePath = resolvePathBinary(resolved.command, env);
+    const interpreter = isScriptFileInterpreter(resolved.command);
+    const executable = interpreter
+        ? readPathBinary(resolved.command, env)
+        : {
+            name: resolved.command,
+            source: executablePath ? 'path' : 'unknown',
+            ...(executablePath && { path: executablePath }),
+            ...(!executablePath && { error: 'executable not found on PATH' }),
+        };
+    const fileIdentity = hashRuntimeFiles([
+        ...resolved.referencedFiles,
+        ...(!interpreter && executablePath ? [executablePath] : []),
+    ]);
+    const errors = [executable.error, fileIdentity.error].filter(Boolean).join('; ');
+    return runtime(executorName, model, 'script', {
+        ...UNKNOWN_CAPABILITIES,
+        trace: 'best-effort',
+        skillIsolation: 'none',
+    }, {
+        binary: {
+            ...executable,
+            ...(fileIdentity.contentHash && {
+                contentHash: fileIdentity.contentHash,
+            }),
+            ...(errors && { error: errors }),
+        },
+    });
+}
 export function getExecutorRuntimeFingerprint(executorName, model, options = {}) {
     const env = runtimeEnv(options);
+    if (![
+        'claude',
+        'claude-sdk',
+        'codex',
+        'codex-sdk',
+        'gemini',
+        'anthropic-api',
+        'openai-api',
+    ].includes(executorName)) {
+        // Custom executors are local code. Re-read their referenced files so a
+        // long-running Studio process cannot reuse stale outputs after the script
+        // changes while the command line remains identical.
+        return scriptRuntime(executorName, model, env);
+    }
     const pathHash = hashString(env.PATH || '');
     const cacheKey = `${executorName}\0${model}\0${pathHash}`;
     const cached = RUNTIME_CACHE.get(cacheKey);
     if (cached)
-        return cached;
+        return structuredClone(cached);
     let fp;
     switch (executorName) {
         case 'claude': {
@@ -265,12 +345,9 @@ export function getExecutorRuntimeFingerprint(executorName, model, options = {})
             }, { binary: { name: executorName, source: 'none' } });
             break;
         }
-        default: {
-            fp = runtime(executorName, model, 'script', UNKNOWN_CAPABILITIES, {
-                binary: { name: executorName, source: 'unknown' },
-            });
-        }
+        default:
+            throw new Error(`unreachable executor runtime: ${executorName}`);
     }
-    RUNTIME_CACHE.set(cacheKey, fp);
-    return fp;
+    RUNTIME_CACHE.set(cacheKey, structuredClone(fp));
+    return structuredClone(fp);
 }

package/dist/executors/script-command.d.ts

@@ -0,0 +1,8 @@
+export interface ResolvedScriptCommand {
+    command: string;
+    args: string[];
+    /** Existing local files that can change the command's behavior. */
+    referencedFiles: string[];
+}
+export declare function isScriptFileInterpreter(commandPath: string): boolean;
+export declare function resolveScriptCommand(commandLine: string, baseCwd?: string): ResolvedScriptCommand;

package/dist/executors/script-command.js

@@ -0,0 +1,87 @@
+import { existsSync } from 'node:fs';
+import { basename, isAbsolute, resolve } from 'node:path';
+const SCRIPT_FILE_INTERPRETERS = new Set([
+    'node',
+    'nodejs',
+    'bash',
+    'sh',
+    'zsh',
+    'ruby',
+    'perl',
+    'php',
+    'bun',
+    'deno',
+]);
+const SCRIPTLESS_INTERPRETER_FLAGS_WITH_VALUE = new Set([
+    '-m',
+    '-c',
+    '-e',
+    '-p',
+    '--eval',
+    '--print',
+]);
+export function isScriptFileInterpreter(commandPath) {
+    const name = basename(commandPath).toLowerCase().replace(/\.(exe|cmd|bat)$/, '');
+    return SCRIPT_FILE_INTERPRETERS.has(name) || /^python(?:\d+(?:\.\d+)*)?$/.test(name);
+}
+function isBareScriptFileArg(part) {
+    return !part.includes('/')
+        && !part.startsWith('.')
+        && /\.(?:cjs|cts|js|jsx|mjs|mts|php|pl|py|pyw|rb|sh|ts|tsx)$/i.test(part);
+}
+function isInlineScriptlessInterpreterFlag(arg) {
+    return /^(?:--eval=|--print=|-[mcep].+)/.test(arg);
+}
+function resolveExecutorPath(part, baseCwd, options = {}) {
+    if (isAbsolute(part))
+        return part;
+    if (part.startsWith('-'))
+        return part;
+    const pathLike = part.includes('/') || part.startsWith('.');
+    if (!pathLike && !options.resolveBare)
+        return part;
+    const candidate = resolve(baseCwd, part);
+    return existsSync(candidate) ? candidate : part;
+}
+function resolveExecutorArgs(args, commandPath, baseCwd) {
+    if (!isScriptFileInterpreter(commandPath)) {
+        return args.map((arg) => resolveExecutorPath(arg, baseCwd));
+    }
+    let scriptResolved = false;
+    let scriptPositionClosed = false;
+    let skipNext = false;
+    return args.map((arg) => {
+        if (skipNext) {
+            skipNext = false;
+            return arg;
+        }
+        if (!scriptResolved && !scriptPositionClosed) {
+            if (SCRIPTLESS_INTERPRETER_FLAGS_WITH_VALUE.has(arg)) {
+                skipNext = true;
+                scriptPositionClosed = true;
+                return arg;
+            }
+            if (isInlineScriptlessInterpreterFlag(arg)) {
+                scriptPositionClosed = true;
+                return arg;
+            }
+            if (arg.startsWith('-') && arg !== '--')
+                return arg;
+            if (arg === '--')
+                return arg;
+            scriptResolved = true;
+            return resolveExecutorPath(arg, baseCwd, {
+                resolveBare: isBareScriptFileArg(arg),
+            });
+        }
+        return resolveExecutorPath(arg, baseCwd);
+    });
+}
+export function resolveScriptCommand(commandLine, baseCwd = process.cwd()) {
+    const parts = commandLine.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [commandLine];
+    const command = resolveExecutorPath(parts[0].replace(/^["']|["']$/g, ''), baseCwd);
+    const rawArgs = parts.slice(1).map((arg) => arg.replace(/^["']|["']$/g, ''));
+    const args = resolveExecutorArgs(rawArgs, command, baseCwd);
+    const referencedFiles = [command, ...args].filter((part) => isAbsolute(part) && existsSync(part));
+    return { command, args, referencedFiles };
+}

package/dist/executors/script.js

@@ -1,31 +1,102 @@
-import { existsSync } from 'node:fs';
-import { isAbsolute, resolve } from 'node:path';
 import { materializeForCliConfigDir } from '../eval-core/mocks-runtime.js';
+import { executorResultValidationError, normalizeExecResultToolIdentities, } from '../shared/executor-result.js';
+import { resolveScriptCommand } from './script-command.js';
 import { DEFAULT_TIMEOUT_MS, interruptedExecResult, spawnWithSigintPropagation, timeoutExecResult, } from './shared.js';
 // script executor 由用户自定义,omk 无法保证它实现 skill 隔离。
 // 任何 allowedSkills(包括 [])下都 stderr 一次性 warn,不阻塞执行,
 // 让用户知道 strict-baseline / 显式 allowedSkills 在 script executor 下静默无效。
 let scriptIsolationWarned = false;
-function resolveExecutorPath(part, baseCwd) {
-    if (isAbsolute(part))
-        return part;
-    if (!part.includes('/') && !part.startsWith('.'))
-        return part;
-    const candidate = resolve(baseCwd, part);
-    return existsSync(candidate) ? candidate : part;
+function nonNegativeNumber(value) {
+    return typeof value === 'number'
+        && Number.isFinite(value)
+        && value >= 0
+        && value <= Number.MAX_SAFE_INTEGER
+        ? value
+        : 0;
+}
+function nonNegativeInteger(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function scriptProtocolMetricsError(protocol) {
+    const integerFields = [
+        'inputTokens',
+        'outputTokens',
+        'cacheReadTokens',
+        'cacheCreationTokens',
+        'numTurns',
+    ];
+    for (const field of integerFields) {
+        if (protocol[field] !== undefined && nonNegativeInteger(protocol[field]) !== protocol[field]) {
+            return `"${field}" must be a non-negative safe integer`;
+        }
+    }
+    for (const field of ['durationApiMs', 'costUSD']) {
+        if (protocol[field] !== undefined && nonNegativeNumber(protocol[field]) !== protocol[field]) {
+            return `"${field}" must be a non-negative finite number`;
+        }
+    }
+    return undefined;
+}
+function scriptProtocolReportsTokenUsage(protocol) {
+    return [
+        'inputTokens',
+        'outputTokens',
+        'cacheReadTokens',
+        'cacheCreationTokens',
+    ].every((field) => protocol[field] !== undefined);
+}
+function scriptProtocolTraceFields(protocol) {
+    return {
+        ...(protocol.turns !== undefined && {
+            turns: protocol.turns,
+        }),
+        ...(protocol.toolCalls !== undefined && {
+            toolCalls: protocol.toolCalls,
+        }),
+        ...(protocol.fullNumTurns !== undefined && {
+            fullNumTurns: protocol.fullNumTurns,
+        }),
+        ...(protocol.numSubAgents !== undefined && {
+            numSubAgents: protocol.numSubAgents,
+        }),
+    };
+}
+function invalidScriptProtocolResult(message, durationMs, mockStats) {
+    return {
+        ok: false,
+        error: `script executor returned malformed protocol JSON: ${message}`,
+        output: null,
+        durationMs,
+        durationApiMs: 0,
+        inputTokens: 0,
+        outputTokens: 0,
+        cacheReadTokens: 0,
+        cacheCreationTokens: 0,
+        tokenUsageReportedByExecutor: false,
+        costUSD: 0,
+        costReportedByExecutor: false,
+        stopReason: 'error',
+        numTurns: 0,
+        ...(mockStats && { mockStats }),
+    };
+}
+function validateScriptProtocolResult(result, mockStats) {
+    const validationError = executorResultValidationError(result);
+    if (validationError) {
+        return invalidScriptProtocolResult(validationError, result.durationMs, mockStats);
+    }
+    return normalizeExecResultToolIdentities(result);
 }
 export function createScriptExecutor(command) {
     const baseCwd = process.cwd();
-    const parts = command.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [command];
-    const cmd = resolveExecutorPath(parts[0].replace(/^["']|["']$/g, ''), baseCwd);
-    const args = parts.slice(1)
-        .map((a) => a.replace(/^["']|["']$/g, ''))
-        .map((a) => resolveExecutorPath(a, baseCwd));
+    const resolved = resolveScriptCommand(command, baseCwd);
+    const cmd = resolved.command;
+    const args = resolved.args;
     return async function scriptExecutor({ model, system, prompt, cwd, timeoutMs = DEFAULT_TIMEOUT_MS, allowedSkills, mocks, mocksBaseDir, mocksStrict }) {
         if (allowedSkills !== undefined && !scriptIsolationWarned) {
             scriptIsolationWarned = true;
             process.stderr.write(`[omk] script executor 不参与 skill isolation:allowedSkills=${JSON.stringify(allowedSkills)} 在自定义 executor "${command}" 下无效。\n`
-                + `  如需 baseline 真正隔离,请用 --executor claude-sdk(或 claude-cli degraded mode)。\n`);
+                + '  如需 baseline 真正隔离，请用 --executor codex。\n');
         }
         const input = JSON.stringify({ model, system: system || '', prompt });
         const start = Date.now();
@@ -64,31 +135,132 @@ export function createScriptExecutor(command) {
             timeoutMs,
             ...(cwd && { cwd }),
         });
-        child.stdin?.write(input);
-        child.stdin?.end();
+        child.stdin?.on('error', () => undefined);
+        child.stdin?.end(input);
         try {
             const r = await done;
             const durationMs = Date.now() - start;
             const ms = captureMockStats();
+            let protocol;
             try {
                 const data = JSON.parse(r.stdout);
-                return {
-                    ok: true, output: data.output || '', durationMs,
-                    durationApiMs: data.durationApiMs || 0,
-                    inputTokens: data.inputTokens || 0, outputTokens: data.outputTokens || 0,
-                    cacheReadTokens: data.cacheReadTokens || 0, cacheCreationTokens: data.cacheCreationTokens || 0,
-                    costUSD: data.costUSD || 0, stopReason: data.stopReason || 'end', numTurns: data.numTurns || 1,
-                    ...(ms && { mockStats: ms }),
-                };
+                if (data && typeof data === 'object' && !Array.isArray(data)) {
+                    const candidate = data;
+                    if (Object.hasOwn(candidate, 'ok') || Object.hasOwn(candidate, 'output')) {
+                        protocol = candidate;
+                    }
+                }
             }
             catch {
+                // Non-JSON stdout is the executor's plain model output.
+            }
+            if (protocol) {
+                const metricsError = scriptProtocolMetricsError(protocol);
+                if (metricsError) {
+                    return invalidScriptProtocolResult(metricsError, durationMs, ms);
+                }
+                const costReported = protocol.costUSD !== undefined;
+                const tokenUsageReported = scriptProtocolReportsTokenUsage(protocol);
+                if (protocol.ok !== undefined && typeof protocol.ok !== 'boolean') {
+                    return invalidScriptProtocolResult('"ok" must be boolean', durationMs, ms);
+                }
+                if (protocol.output !== undefined
+                    && protocol.output !== null
+                    && typeof protocol.output !== 'string') {
+                    return invalidScriptProtocolResult('"output" must be string or null', durationMs, ms);
+                }
+                if (protocol.error !== undefined && typeof protocol.error !== 'string') {
+                    return invalidScriptProtocolResult('"error" must be string when present', durationMs, ms);
+                }
+                const traceFields = scriptProtocolTraceFields(protocol);
+                if (protocol.ok === false) {
+                    return validateScriptProtocolResult({
+                        ok: false,
+                        error: typeof protocol.error === 'string' && protocol.error
+                            ? protocol.error
+                            : 'script executor reported failure',
+                        output: typeof protocol.output === 'string' ? protocol.output : null,
+                        durationMs,
+                        durationApiMs: nonNegativeNumber(protocol.durationApiMs),
+                        inputTokens: nonNegativeInteger(protocol.inputTokens),
+                        outputTokens: nonNegativeInteger(protocol.outputTokens),
+                        cacheReadTokens: nonNegativeInteger(protocol.cacheReadTokens),
+                        cacheCreationTokens: nonNegativeInteger(protocol.cacheCreationTokens),
+                        ...(!tokenUsageReported && { tokenUsageReportedByExecutor: false }),
+                        costUSD: nonNegativeNumber(protocol.costUSD),
+                        ...(!costReported && { costReportedByExecutor: false }),
+                        stopReason: typeof protocol.stopReason === 'string' ? protocol.stopReason : 'error',
+                        numTurns: nonNegativeInteger(protocol.numTurns),
+                        ...traceFields,
+                        ...(ms && { mockStats: ms }),
+                    }, ms);
+                }
+                if (typeof protocol.output !== 'string') {
+                    return invalidScriptProtocolResult('"output" must be string', durationMs, ms);
+                }
+                if (!protocol.output.trim()) {
+                    return {
+                        ok: false,
+                        error: 'script executor completed without model output',
+                        output: null,
+                        durationMs,
+                        durationApiMs: nonNegativeNumber(protocol.durationApiMs),
+                        inputTokens: nonNegativeInteger(protocol.inputTokens),
+                        outputTokens: nonNegativeInteger(protocol.outputTokens),
+                        cacheReadTokens: nonNegativeInteger(protocol.cacheReadTokens),
+                        cacheCreationTokens: nonNegativeInteger(protocol.cacheCreationTokens),
+                        ...(!tokenUsageReported && { tokenUsageReportedByExecutor: false }),
+                        costUSD: nonNegativeNumber(protocol.costUSD),
+                        ...(!costReported && { costReportedByExecutor: false }),
+                        stopReason: 'error',
+                        numTurns: protocol.numTurns === undefined ? 1 : nonNegativeInteger(protocol.numTurns),
+                        ...(ms && { mockStats: ms }),
+                    };
+                }
+                return validateScriptProtocolResult({
+                    ok: true, output: protocol.output, durationMs,
+                    durationApiMs: nonNegativeNumber(protocol.durationApiMs),
+                    inputTokens: nonNegativeInteger(protocol.inputTokens),
+                    outputTokens: nonNegativeInteger(protocol.outputTokens),
+                    cacheReadTokens: nonNegativeInteger(protocol.cacheReadTokens),
+                    cacheCreationTokens: nonNegativeInteger(protocol.cacheCreationTokens),
+                    ...(!tokenUsageReported && { tokenUsageReportedByExecutor: false }),
+                    costUSD: nonNegativeNumber(protocol.costUSD),
+                    ...(!costReported && { costReportedByExecutor: false }),
+                    stopReason: typeof protocol.stopReason === 'string' ? protocol.stopReason : 'end',
+                    numTurns: protocol.numTurns === undefined ? 1 : nonNegativeInteger(protocol.numTurns),
+                    ...traceFields,
+                    ...(ms && { mockStats: ms }),
+                }, ms);
+            }
+            const output = r.stdout.trim();
+            if (!output) {
                 return {
-                    ok: true, output: r.stdout.trim(), durationMs, durationApiMs: 0,
-                    inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0,
-                    costUSD: 0, stopReason: 'end', numTurns: 1,
+                    ok: false,
+                    error: 'script executor completed without model output',
+                    output: null,
+                    durationMs,
+                    durationApiMs: 0,
+                    inputTokens: 0,
+                    outputTokens: 0,
+                    cacheReadTokens: 0,
+                    cacheCreationTokens: 0,
+                    tokenUsageReportedByExecutor: false,
+                    costUSD: 0,
+                    costReportedByExecutor: false,
+                    stopReason: 'error',
+                    numTurns: 1,
                     ...(ms && { mockStats: ms }),
                 };
             }
+            return {
+                ok: true, output, durationMs, durationApiMs: 0,
+                inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0,
+                tokenUsageReportedByExecutor: false,
+                costUSD: 0, costReportedByExecutor: false,
+                stopReason: 'end', numTurns: 1,
+                ...(ms && { mockStats: ms }),
+            };
         }
         catch (err) {
             const durationMs = Date.now() - start;
@@ -104,7 +276,8 @@ export function createScriptExecutor(command) {
                 error: stderr || details.message || `executor exited with code ${details.code ?? '?'}`,
                 durationMs, durationApiMs: 0,
                 inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheCreationTokens: 0,
-                costUSD: 0, output: null, stopReason: 'error', numTurns: 0,
+                tokenUsageReportedByExecutor: false,
+                costUSD: 0, costReportedByExecutor: false, output: null, stopReason: 'error', numTurns: 0,
                 ...(ms && { mockStats: ms }),
             };
         }