onto-mcp 0.4.11 → 0.4.13

package/dist/core-runtime/llm/llm-caller.js

@@ -17,8 +17,10 @@ import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
 import { DEFAULT_GROK_BASE_URL, DEFAULT_LMSTUDIO_BASE_URL, isExternalOauthWorkerSelection, normalizeLlmModelSwitcher, } from "./model-switcher.js";
+import { resolveClaudeBin } from "./claude-bin.js";
 import { appendRuntimeModelCallLogFromCurrentContext, appendRuntimeStreamChunkFromCurrentContextSync, } from "../observability/runtime-stream-observation.js";
 import { callReviewMockLlm, isReviewMockLlmRealizationEnabled, } from "./mock-llm-realization.js";
+import { OPENAI_RESPONSES_MAX_OUTPUT_TOKENS_FAILURE_CODE, OpenAIResponsesIncompleteError, resolveOpenAIResponsesOutputBudget, } from "./openai-responses-incomplete-error.js";
 /**
  * Bridge: OntoConfig + CLI overrides → Partial<LlmCallConfig> that callLlm consumes.
  *
@@ -66,20 +68,75 @@ export function resolveLlmProviderConfig(args) {
         out.service_tier = service_tier;
     if (api_key_env)
         out.api_key_env = api_key_env;
+    // Transport timeout carried on the llm block (not a model-switch axis).
+    if (config.llm?.timeout_ms)
+        out.timeout_ms = config.llm.timeout_ms;
     if (Object.keys(models_per_provider).length > 0) {
         out.models_per_provider = models_per_provider;
     }
     return out;
 }
+export function applyOpenAIResponsesOutputHeadroom(args) {
+    if (args.headroomTokens === undefined)
+        return args.config;
+    if (args.selection.model_provider !== "openai" ||
+        args.selection.auth !== "api_key" ||
+        args.selection.execution_route !== "direct_model_call" ||
+        args.selection.execution_adapter !== "openai_sdk" ||
+        args.selection.wire_format !== "native_sdk" ||
+        args.selection.base_url !== undefined) {
+        throw new Error("openai Responses output headroom requires the official openai + api_key + openai_sdk + native_sdk route without a custom base_url.");
+    }
+    if (args.modelMaxOutputTokens === undefined) {
+        throw new Error("openai Responses output headroom requires registered max_output_tokens.");
+    }
+    resolveOpenAIResponsesOutputBudget({
+        baseOutputTokens: args.maxBaseOutputTokens,
+        headroomTokens: args.headroomTokens,
+        modelMaxOutputTokens: args.modelMaxOutputTokens,
+    });
+    return {
+        ...args.config,
+        openai_responses_output_headroom_tokens: args.headroomTokens,
+        openai_responses_model_max_output_tokens: args.modelMaxOutputTokens,
+    };
+}
 // Phase 3 production found 30s too tight for large audit batches (37 items
 // could time out then SDK-retry for 90s total). 120s is generous
 // enough for ~50-item single-batch audits while still failing fast on real
 // network problems.
 const DEFAULT_TIMEOUT_MS = Number(process.env.ONTO_LLM_TIMEOUT_MS) || 120_000;
+// External OAuth CLI workers (`codex exec`, `claude -p`) spawn a full agentic
+// turn, not a single SDK request — a heavy single-turn authoring call (e.g.
+// reconstruct seed authoring on a frontier model) routinely runs minutes. The
+// 120s SDK default is too tight for that path and caused deterministic timeouts
+// on the claude-opus-4-8 reconstruct route; give the CLI workers a longer
+// default so supported models complete without an unencoded env override. The
+// `ONTO_LLM_TIMEOUT_MS` override still applies to both paths when set.
+const DEFAULT_WORKER_TIMEOUT_MS = Number(process.env.ONTO_LLM_TIMEOUT_MS) || 600_000;
+// Grace period after a timeout SIGTERM before escalating to SIGKILL. A worker
+// that traps/ignores SIGTERM would otherwise leave the run hanging indefinitely
+// (the close-event promise never resolves); SIGKILL cannot be trapped, so this
+// bounds the worst-case hang to timeout + grace.
+const WORKER_SIGKILL_GRACE_MS = 5_000;
 // SDK auto-retry hides failures behind a long stall. We surface failures
 // faster (1 retry instead of the default 2) so operators see provider errors
 // within ~2× timeout instead of ~3×.
 const DEFAULT_MAX_RETRIES = 1;
+const OPENAI_RESPONSES_BASE_URL = "https://api.openai.com/v1";
+function sanitizeEffectiveBaseUrl(baseUrl) {
+    try {
+        const sanitized = new URL(baseUrl);
+        sanitized.username = "";
+        sanitized.password = "";
+        sanitized.search = "";
+        sanitized.hash = "";
+        return sanitized.toString();
+    }
+    catch {
+        return "invalid-endpoint:redacted";
+    }
+}
 /**
  * Model-call observability — emits STDERR logs for each LLM API call, covering
  * (a) pre-call model_id + provider + max_tokens, (b) post-call usage on success,
@@ -213,7 +270,7 @@ function missingModelError(provider) {
     ].join("\n"));
 }
 function unsupportedReasoningEffortError(provider) {
-    return new Error(`provider=${provider} cannot honor reasoning_effort; remove effort from this actor or switch to provider=openai/codex.`);
+    return new Error(`provider=${provider} cannot honor reasoning_effort; remove effort from this actor or switch to provider=openai/codex/anthropic.`);
 }
 function assertNoUnsupportedReasoningEffort(provider, reasoningEffort) {
     if (reasoningEffort) {
@@ -223,19 +280,47 @@ function assertNoUnsupportedReasoningEffort(provider, reasoningEffort) {
 // ---------------------------------------------------------------------------
 // Anthropic call
 // ---------------------------------------------------------------------------
-async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens) {
+async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, reasoningEffort, thinkingMode) {
     const { default: Anthropic } = await import("@anthropic-ai/sdk");
     const client = new Anthropic({
         apiKey,
         timeout: DEFAULT_TIMEOUT_MS,
         maxRetries: DEFAULT_MAX_RETRIES,
     });
-    emitModelCallLog(`anthropic call: model="${modelId}" max_tokens=${maxTokens}`);
+    emitModelCallLog(`anthropic call: model="${modelId}" max_tokens=${maxTokens} effort=${reasoningEffort ?? "(unset)"} thinking=${thinkingMode ?? "(default)"}`);
     let response;
     try {
         response = await client.messages.create({
             model: modelId,
             max_tokens: maxTokens,
+            // Thinking configuration is a three-way choice, and every non-default
+            // branch is additive over the legacy no-op tail so an absent opt-in emits
+            // byte-identical request bytes:
+            //   thinking_mode="disabled" → thinking:{type:"disabled"} (explicit no
+            //     extended thinking; accepted on opus-4.7/4.8 and sonnet-5, rejected
+            //     by Fable 5). Takes precedence over effort: effort's only job on this
+            //     route is to modulate *thinking* depth, which is moot once thinking
+            //     is off, so output_config is not paired here.
+            //   reasoningEffort set → adaptive thinking paired with output_config.
+            //     effort (GA, no beta header). On opus-4.x effort only modulates
+            //     thinking depth when adaptive is enabled — without adaptive the model
+            //     runs without thinking, so configured effort would not be realized on
+            //     this route. Pairing the two makes effort actually engage reasoning
+            //     (matching the openai Responses and claude-CLI routes); effort also
+            //     bounds overall token spend. The free-form seat string maps onto the
+            //     API effort enum.
+            //   neither → no thinking block (API default: high, no thinking — legacy
+            //     behavior preserved).
+            ...(thinkingMode === "disabled"
+                ? { thinking: { type: "disabled" } }
+                : reasoningEffort
+                    ? {
+                        thinking: { type: "adaptive" },
+                        output_config: {
+                            effort: reasoningEffort,
+                        },
+                    }
+                    : {}),
             system: systemPrompt,
             messages: [{ role: "user", content: userPrompt }],
         });
@@ -243,9 +328,31 @@ async function callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxToken
     catch (err) {
         const e = err;
         emitModelCallLog(`anthropic call FAILED: model="${modelId}" status=${e.status ?? "?"} type=${e.error?.type ?? e.name ?? "?"} message="${e.error?.message ?? e.message ?? String(err)}" request_id=${e.request_id ?? "?"}`);
+        // Normalize SDK request timeouts (thrown after maxRetries is exhausted) to a
+        // message the timeout-recovery classifier recognizes — the SDK error's own
+        // message ("Request timed out.") does not match, so api_key-provider timeout
+        // recovery was previously dead. instanceof is the robust check (the class
+        // does not override Error.prototype.name).
+        if (err instanceof Anthropic.APIConnectionTimeoutError) {
+            throw new Error(`anthropic call timed out after ${DEFAULT_TIMEOUT_MS}ms`, { cause: err });
+        }
         throw err;
     }
     emitModelCallLog(`anthropic success: model_id=${response.model ?? modelId} input_tokens=${response.usage.input_tokens} output_tokens=${response.usage.output_tokens}`);
+    // A max_tokens stop means the response was truncated and may carry
+    // partial/empty text — fail loud rather than record a truncated artifact.
+    // Both thinking-bearing branches are guarded: with adaptive thinking on
+    // (effort set) thinking shares the max_tokens budget; with thinking disabled
+    // the whole budget is the answer, so a cap still truncates it. The legacy
+    // no-opt path (neither set) stays unguarded, unchanged.
+    if ((reasoningEffort || thinkingMode === "disabled") &&
+        response.stop_reason === "max_tokens") {
+        throw new Error(`anthropic response truncated at max_tokens=${maxTokens}` +
+            (reasoningEffort
+                ? ` (effort=${reasoningEffort} reasoning exhausted the budget)`
+                : " (thinking disabled; answer exceeded the budget)") +
+            "; raise max_tokens");
+    }
     const text = response.content
         .filter((block) => block.type === "text")
         .map((block) => ("text" in block ? block.text : ""))
@@ -286,6 +393,12 @@ async function callOpenAI(systemPrompt, userPrompt, apiKey, modelId, maxTokens,
     catch (err) {
         const e = err;
         emitModelCallLog(`${providerLabel} call FAILED: model="${modelId}" status=${e.status ?? "?"} type=${e.error?.type ?? e.name ?? "?"} message="${e.error?.message ?? e.message ?? String(err)}" request_id=${e.request_id ?? "?"}`);
+        // Normalize SDK request timeouts to a classifier-recognized message (see the
+        // anthropic path above) so OpenAI/grok/lmstudio api_key timeouts also trigger
+        // timeout recovery instead of failing hard.
+        if (err instanceof OpenAI.APIConnectionTimeoutError) {
+            throw new Error(`${providerLabel} call timed out after ${DEFAULT_TIMEOUT_MS}ms`, { cause: err });
+        }
         throw err;
     }
     emitModelCallLog(`${providerLabel} success: model_id=${response.model ?? modelId} input_tokens=${response.usage?.prompt_tokens ?? 0} output_tokens=${response.usage?.completion_tokens ?? 0}`);
@@ -305,6 +418,142 @@ async function callOpenAI(systemPrompt, userPrompt, apiKey, modelId, maxTokens,
     };
 }
 // ---------------------------------------------------------------------------
+// OpenAI Responses API call (canonical OpenAI reasoning models, e.g. gpt-5.x)
+// ---------------------------------------------------------------------------
+/**
+ * Canonical OpenAI path. Reasoning models (gpt-5.x) are driven through the
+ * Responses API: reasoning depth is `reasoning.effort` and the output cap is
+ * `max_output_tokens` (Chat Completions' `max_tokens` is rejected by reasoning
+ * models). grok/lmstudio stay on Chat Completions via `callOpenAI` — they are
+ * OpenAI-compatible Chat Completions endpoints with no Responses API.
+ */
+async function callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, baseMaxOutputTokens, reasoningEffort, outputHeadroomTokens, modelMaxOutputTokens) {
+    const budget = resolveOpenAIResponsesOutputBudget({
+        baseOutputTokens: baseMaxOutputTokens,
+        ...(outputHeadroomTokens !== undefined
+            ? { headroomTokens: outputHeadroomTokens }
+            : {}),
+        ...(modelMaxOutputTokens !== undefined
+            ? { modelMaxOutputTokens }
+            : {}),
+    });
+    const { default: OpenAI } = await import("openai");
+    const effectiveBaseUrl = sanitizeEffectiveBaseUrl(outputHeadroomTokens === undefined
+        ? process.env.OPENAI_BASE_URL ?? OPENAI_RESPONSES_BASE_URL
+        : OPENAI_RESPONSES_BASE_URL);
+    const noOpLogger = {
+        error: () => { },
+        warn: () => { },
+        info: () => { },
+        debug: () => { },
+    };
+    const client = new OpenAI({
+        apiKey,
+        ...(outputHeadroomTokens !== undefined
+            ? { baseURL: OPENAI_RESPONSES_BASE_URL }
+            : {}),
+        timeout: DEFAULT_TIMEOUT_MS,
+        maxRetries: DEFAULT_MAX_RETRIES,
+        logLevel: "off",
+        logger: noOpLogger,
+    });
+    emitModelCallLog(`openai call: model="${modelId}" max_output_tokens=${budget.effectiveMaxOutputTokens} effort=${reasoningEffort ?? "(unset)"}`);
+    let response;
+    try {
+        response = await client.responses.create({
+            model: modelId,
+            instructions: systemPrompt,
+            input: userPrompt,
+            max_output_tokens: budget.effectiveMaxOutputTokens,
+            // Transient single-turn authoring/review calls; the Responses API stores
+            // response objects provider-side by default (retrievable for ~30d). Opt
+            // out so these prompts/outputs are not persisted — matches the
+            // chat.completions path, which never stored.
+            store: false,
+            ...(reasoningEffort ? { reasoning: { effort: reasoningEffort } } : {}),
+        });
+    }
+    catch (err) {
+        const e = err;
+        emitModelCallLog(`openai call FAILED: model="${modelId}" status=${e.status ?? "?"} type=${e.error?.type ?? e.name ?? "?"} message="${e.error?.message ?? e.message ?? String(err)}" request_id=${e.request_id ?? "?"}`);
+        // Mirror the api_key timeout normalization on the chat.completions path so
+        // Responses-API timeouts also trigger timeout recovery.
+        if (err instanceof OpenAI.APIConnectionTimeoutError) {
+            throw new Error(`openai call timed out after ${DEFAULT_TIMEOUT_MS}ms`, {
+                cause: err,
+            });
+        }
+        throw err;
+    }
+    // Only status="completed" carries a usable result. Anything else —
+    // "incomplete" (e.g. max_output_tokens exhausted, partial/empty output_text),
+    // "failed", "cancelled", "queued", "in_progress" — would otherwise be recorded
+    // as a normal result via `output_text ?? ""`, silently corrupting downstream
+    // artifacts. Fail loud so the caller retries or surfaces it.
+    if (response.status !== "completed") {
+        const detail = response.incomplete_details?.reason ?? response.error?.message ?? "no detail";
+        emitModelCallLog(`openai call NOT COMPLETED: model="${modelId}" status=${response.status} detail=${detail} max_output_tokens=${budget.effectiveMaxOutputTokens}`);
+        if (response.status === "incomplete" &&
+            response.incomplete_details?.reason === "max_output_tokens") {
+            const usage = response.usage;
+            const inputTokens = typeof usage?.input_tokens === "number"
+                ? usage.input_tokens
+                : null;
+            const cachedInputTokens = typeof usage?.input_tokens_details?.cached_tokens === "number"
+                ? usage.input_tokens_details.cached_tokens
+                : null;
+            const outputTokens = typeof usage?.output_tokens === "number"
+                ? usage.output_tokens
+                : null;
+            const reasoningTokens = typeof usage?.output_tokens_details?.reasoning_tokens === "number"
+                ? usage.output_tokens_details.reasoning_tokens
+                : null;
+            const nonReasoningOutputTokens = outputTokens !== null && reasoningTokens !== null
+                ? Math.max(0, outputTokens - reasoningTokens)
+                : null;
+            const partialOutput = response.output_text ?? "";
+            throw new OpenAIResponsesIncompleteError({
+                failure_code: OPENAI_RESPONSES_MAX_OUTPUT_TOKENS_FAILURE_CODE,
+                provider_status: response.status,
+                incomplete_reason: "max_output_tokens",
+                base_output_ceiling_tokens: budget.baseOutputTokens,
+                configured_output_headroom_tokens: budget.headroomTokens,
+                effective_max_output_tokens: budget.effectiveMaxOutputTokens,
+                input_tokens: inputTokens,
+                cached_input_tokens: cachedInputTokens,
+                output_tokens: outputTokens,
+                reasoning_tokens: reasoningTokens,
+                non_reasoning_output_tokens: nonReasoningOutputTokens,
+                partial_output_chars: partialOutput.length,
+                partial_output_sha256: crypto
+                    .createHash("sha256")
+                    .update(partialOutput, "utf8")
+                    .digest("hex"),
+                provider_model: response.model ?? modelId,
+                provider_response_id: typeof response.id === "string" ? response.id : null,
+                provider_request_id: typeof response._request_id === "string"
+                    ? response._request_id
+                    : null,
+                effective_base_url: effectiveBaseUrl,
+                sdk_max_retries: DEFAULT_MAX_RETRIES,
+                actual_adapter_request_count: null,
+                request_count_observability: "unavailable",
+            });
+        }
+        throw new Error(`openai response not completed (status=${response.status}: ${detail}) at max_output_tokens=${budget.effectiveMaxOutputTokens}`);
+    }
+    const usage = response.usage;
+    emitModelCallLog(`openai success: model_id=${response.model ?? modelId} input_tokens=${usage?.input_tokens ?? 0} output_tokens=${usage?.output_tokens ?? 0}`);
+    return {
+        text: response.output_text ?? "",
+        input_tokens: usage?.input_tokens ?? 0,
+        output_tokens: usage?.output_tokens ?? 0,
+        model_id: modelId,
+        effective_base_url: effectiveBaseUrl,
+        declared_billing_mode: "per_token",
+    };
+}
+// ---------------------------------------------------------------------------
 // codex CLI call (OAuth subscription path)
 // ---------------------------------------------------------------------------
 /**
@@ -317,8 +566,9 @@ async function callOpenAI(systemPrompt, userPrompt, apiKey, modelId, maxTokens,
  *   --skip-git-repo-check lets the worker run from non-repo cwd. No -C/-s/-o:
  *   this is single-turn, no agentic scaffold.
  */
-async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort, serviceTier) {
+async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort, serviceTier, timeoutMs) {
     const { spawn } = await import("node:child_process");
+    const workerTimeoutMs = timeoutMs ?? DEFAULT_WORKER_TIMEOUT_MS;
     const args = ["exec", "--skip-git-repo-check", "--ephemeral"];
     if (modelId)
         args.push("-m", modelId);
@@ -328,7 +578,7 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
         args.push("-c", `service_tier="${serviceTier}"`);
     args.push("-");
     const combinedPrompt = `${systemPrompt}\n\n---\n\n${userPrompt}`;
-    emitModelCallLog(`codex call: model="${modelId ?? "(codex default)"}" effort="${reasoningEffort ?? "(unset)"}" service_tier="${serviceTier ?? "(unset)"}" timeout_ms=${DEFAULT_TIMEOUT_MS}`);
+    emitModelCallLog(`codex call: model="${modelId ?? "(codex default)"}" effort="${reasoningEffort ?? "(unset)"}" service_tier="${serviceTier ?? "(unset)"}" timeout_ms=${workerTimeoutMs}`);
     const child = spawn("codex", args, {
         stdio: ["pipe", "pipe", "pipe"],
     });
@@ -350,15 +600,32 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
         stderr += String(chunk);
         appendRuntimeStreamChunkFromCurrentContextSync("stderr", chunk, codexStreamSource);
     });
+    // Swallow stdin write errors (EPIPE): if the worker exits before reading the
+    // prompt (e.g. fast model-allowlist rejection), an unhandled 'error' on the
+    // stdin stream would crash the host process. The real failure surfaces via the
+    // exit code / stderr below.
+    child.stdin.on("error", () => { });
     child.stdin.write(combinedPrompt);
     child.stdin.end();
+    let sigkillHandle;
     const timeoutHandle = setTimeout(() => {
         timedOut = true;
         child.kill("SIGTERM");
-    }, DEFAULT_TIMEOUT_MS);
+        sigkillHandle = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch { /* already exited */ }
+        }, WORKER_SIGKILL_GRACE_MS);
+    }, workerTimeoutMs);
+    const clearTimers = () => {
+        clearTimeout(timeoutHandle);
+        if (sigkillHandle)
+            clearTimeout(sigkillHandle);
+    };
     const exitCode = await new Promise((resolve, reject) => {
         child.on("error", (err) => {
-            clearTimeout(timeoutHandle);
+            clearTimers();
             if (err.code === "ENOENT") {
                 reject(new Error("codex CLI not found on PATH. Install codex to use the OAuth subscription path: https://github.com/openai/codex"));
             }
@@ -367,13 +634,13 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
             }
         });
         child.on("close", (code) => {
-            clearTimeout(timeoutHandle);
+            clearTimers();
             resolve(code ?? 1);
         });
     });
     if (timedOut) {
-        emitModelCallLog(`codex call FAILED: model="${modelId ?? "(codex default)"}" reason=timeout timeout_ms=${DEFAULT_TIMEOUT_MS}`);
-        throw new Error(`codex CLI call timed out after ${DEFAULT_TIMEOUT_MS}ms`);
+        emitModelCallLog(`codex call FAILED: model="${modelId ?? "(codex default)"}" reason=timeout timeout_ms=${workerTimeoutMs}`);
+        throw new Error(`codex CLI call timed out after ${workerTimeoutMs}ms`);
     }
     if (exitCode !== 0) {
         const combined = [stderr.trim(), stdout.trim()]
@@ -418,7 +685,6 @@ async function callCodexCli(systemPrompt, userPrompt, modelId, reasoningEffort,
 // ---------------------------------------------------------------------------
 // claude CLI call (Claude Code OAuth subscription path)
 // ---------------------------------------------------------------------------
-const CLAUDE_BIN = process.env.ONTO_CLAUDE_BIN?.trim() || "claude";
 /**
  * Parse the `result` event from `claude -p --output-format json`. The CLI emits
  * a JSON array of stream events (the final one is `type:"result"`), tolerating
@@ -478,8 +744,9 @@ function parseClaudeResultEvent(stdout) {
  * is the positional arg (piped stdin is not treated as the prompt), and no
  * project/user MCP servers are loaded so the worker has no side effects.
  */
-async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort) {
+async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort, timeoutMs) {
     const { spawn } = await import("node:child_process");
+    const workerTimeoutMs = timeoutMs ?? DEFAULT_WORKER_TIMEOUT_MS;
     const combinedPrompt = `${systemPrompt}\n\n---\n\n${userPrompt}`;
     const args = ["-p", combinedPrompt, "--output-format", "json"];
     if (modelId)
@@ -487,8 +754,9 @@ async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort)
     if (reasoningEffort)
         args.push("--effort", reasoningEffort);
     args.push("--strict-mcp-config", "--mcp-config", '{"mcpServers":{}}');
-    emitModelCallLog(`claude call: model="${modelId ?? "(claude default)"}" effort="${reasoningEffort ?? "(unset)"}" timeout_ms=${DEFAULT_TIMEOUT_MS}`);
-    const child = spawn(CLAUDE_BIN, args, { stdio: ["ignore", "pipe", "pipe"] });
+    emitModelCallLog(`claude call: model="${modelId ?? "(claude default)"}" effort="${reasoningEffort ?? "(unset)"}" timeout_ms=${workerTimeoutMs}`);
+    const claudeBin = resolveClaudeBin();
+    const child = spawn(claudeBin, args, { stdio: ["ignore", "pipe", "pipe"] });
     const claudeStreamSourceBase = {
         kind: "process",
         label: "claude-cli",
@@ -507,28 +775,40 @@ async function callClaudeCli(systemPrompt, userPrompt, modelId, reasoningEffort)
         stderr += String(chunk);
         appendRuntimeStreamChunkFromCurrentContextSync("stderr", chunk, claudeStreamSource);
     });
+    let sigkillHandle;
     const timeoutHandle = setTimeout(() => {
         timedOut = true;
         child.kill("SIGTERM");
-    }, DEFAULT_TIMEOUT_MS);
+        sigkillHandle = setTimeout(() => {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch { /* already exited */ }
+        }, WORKER_SIGKILL_GRACE_MS);
+    }, workerTimeoutMs);
+    const clearTimers = () => {
+        clearTimeout(timeoutHandle);
+        if (sigkillHandle)
+            clearTimeout(sigkillHandle);
+    };
     const exitCode = await new Promise((resolve, reject) => {
         child.on("error", (err) => {
-            clearTimeout(timeoutHandle);
+            clearTimers();
             if (err.code === "ENOENT") {
-                reject(new Error(`Claude Code CLI not found (${CLAUDE_BIN}). Install and log in to claude, or set ONTO_CLAUDE_BIN, to use the Anthropic OAuth subscription path: https://docs.anthropic.com/en/docs/claude-code`));
+                reject(new Error(`Claude Code CLI not found (${claudeBin}). Install and log in to claude, or set ONTO_CLAUDE_BIN, to use the Anthropic OAuth subscription path: https://docs.anthropic.com/en/docs/claude-code`));
             }
             else {
                 reject(err);
             }
         });
         child.on("close", (code) => {
-            clearTimeout(timeoutHandle);
+            clearTimers();
             resolve(code ?? 1);
         });
     });
     if (timedOut) {
-        emitModelCallLog(`claude call FAILED: model="${modelId ?? "(claude default)"}" reason=timeout timeout_ms=${DEFAULT_TIMEOUT_MS}`);
-        throw new Error(`claude CLI call timed out after ${DEFAULT_TIMEOUT_MS}ms`);
+        emitModelCallLog(`claude call FAILED: model="${modelId ?? "(claude default)"}" reason=timeout timeout_ms=${workerTimeoutMs}`);
+        throw new Error(`claude CLI call timed out after ${workerTimeoutMs}ms`);
     }
     if (exitCode !== 0) {
         const combined = [stderr.trim(), stdout.trim()]
@@ -585,10 +865,9 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
     const maxTokens = config.max_tokens ?? 1024;
     if (plan.provider_identity === "codex") {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.codex;
-        return callCodexCli(systemPrompt, userPrompt, modelId, config.reasoning_effort, config.service_tier);
+        return callCodexCli(systemPrompt, userPrompt, modelId, config.reasoning_effort, config.service_tier, config.timeout_ms);
     }
     if (plan.provider_identity === "anthropic") {
-        assertNoUnsupportedReasoningEffort("anthropic", config.reasoning_effort);
         const apiKey = readEnvApiKey(config.api_key_env ? [config.api_key_env] : ["ANTHROPIC_API_KEY"]);
         if (!apiKey) {
             throw new Error(explicitProviderMissingCredentialError("anthropic", config.api_key_env));
@@ -596,7 +875,7 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.anthropic;
         if (!modelId)
             throw missingModelError("anthropic");
-        return callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens);
+        return callAnthropic(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort, config.thinking_mode);
     }
     if (plan.provider_identity === "openai") {
         const apiKey = readOpenAiApiKey(config.api_key_env);
@@ -606,7 +885,7 @@ async function dispatchByPlan(systemPrompt, userPrompt, config) {
         const modelId = config.model_id ?? plan.model_id ?? config.models_per_provider?.openai;
         if (!modelId)
             throw missingModelError("openai");
-        return callOpenAI(systemPrompt, userPrompt, apiKey, modelId, maxTokens, undefined, "openai", config.reasoning_effort);
+        return callOpenAIResponses(systemPrompt, userPrompt, apiKey, modelId, maxTokens, config.reasoning_effort, config.openai_responses_output_headroom_tokens, config.openai_responses_model_max_output_tokens);
     }
     if (plan.provider_identity === "grok") {
         assertNoUnsupportedReasoningEffort("grok", config.reasoning_effort);
@@ -646,23 +925,26 @@ export async function callLlm(systemPrompt, userPrompt, config) {
         config?.artifact_generation_realization === "semantic_mock") {
         return callReviewMockLlm(systemPrompt, userPrompt, config);
     }
+    if (config?.openai_responses_output_headroom_tokens !== undefined &&
+        (config.provider !== "openai" ||
+            config.execution_adapter !== "openai_sdk" ||
+            config.base_url !== undefined)) {
+        throw new Error("openai Responses output headroom reached an unsupported dispatch route.");
+    }
     if (config?.plan) {
         return dispatchByPlan(systemPrompt, userPrompt, config);
     }
     if (isLegacyCodexCliProvider(config)) {
-        return callCodexCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.codex, config.reasoning_effort, config.service_tier);
+        return callCodexCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.codex, config.reasoning_effort, config.service_tier, config.timeout_ms);
     }
     // Anthropic OAuth → Claude Code CLI worker. The model-switcher keeps
     // provider="anthropic" for OAuth (the brand lives in execution_adapter), so
     // dispatch on the adapter here, before the SDK/api-key path. This is the
-    // direct-call analog of openai OAuth → codex. claude DOES honor effort, so it
-    // is passed through rather than rejected by the SDK-path effort guard.
+    // direct-call analog of openai OAuth → codex. Both this CLI route (--effort)
+    // and the api_key SDK route below (output_config.effort) honor effort.
     if (config?.provider === "anthropic" &&
         config?.execution_adapter === "claude_code") {
-        return callClaudeCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.anthropic, config.reasoning_effort);
-    }
-    if (config?.provider === "anthropic") {
-        assertNoUnsupportedReasoningEffort("anthropic", config.reasoning_effort);
+        return callClaudeCli(systemPrompt, userPrompt, config.model_id ?? config.models_per_provider?.anthropic, config.reasoning_effort, config.timeout_ms);
     }
     if (config?.provider === "grok") {
         assertNoUnsupportedReasoningEffort("grok", config.reasoning_effort);
@@ -690,20 +972,19 @@ export async function callLlm(systemPrompt, userPrompt, config) {
     switch (resolved.provider) {
         case "codex": {
             const modelId = config?.model_id ?? perProviderModel;
-            return callCodexCli(systemPrompt, userPrompt, modelId, config?.reasoning_effort, config?.service_tier);
+            return callCodexCli(systemPrompt, userPrompt, modelId, config?.reasoning_effort, config?.service_tier, config?.timeout_ms);
         }
         case "anthropic": {
-            assertNoUnsupportedReasoningEffort("anthropic", config?.reasoning_effort);
             const modelId = config?.model_id ?? perProviderModel;
             if (!modelId)
                 throw missingModelError("anthropic");
-            return callAnthropic(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens);
+            return callAnthropic(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort, config?.thinking_mode);
         }
         case "openai": {
             const modelId = config?.model_id ?? perProviderModel;
             if (!modelId)
                 throw missingModelError("openai");
-            return callOpenAI(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, undefined, "openai", config?.reasoning_effort);
+            return callOpenAIResponses(systemPrompt, userPrompt, resolved.apiKey, modelId, maxTokens, config?.reasoning_effort, config?.openai_responses_output_headroom_tokens, config?.openai_responses_model_max_output_tokens);
         }
         case "grok": {
             assertNoUnsupportedReasoningEffort("grok", config?.reasoning_effort);

package/dist/core-runtime/llm/mock-llm-realization.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import YAML from "yaml";
 import { parseRuntimeIssueDeliberationSchemaContext, parseRuntimeIssueStanceSchemaContext, parseRuntimeIssueSynthesisSchemaContext, parseRuntimeProblemFramingContext, } from "../cli/runtime-submit-context.js";
+import { packetHasResubmitErrorSpec } from "../cli/unit-resubmit.js";
 import { parseParticipatingLensPaths } from "../review/participating-lens-paths.js";
 export const REVIEW_MOCK_REALIZATION_ENV = "ONTO_LLM_MOCK";
 export function isReviewMockLlmRealizationEnabled(env = process.env) {
@@ -432,16 +433,46 @@ function issueArtifactArgs(unitId, packetText, toolCtx) {
             throw new Error(`Unsupported mock issue artifact unit: ${unitId}`);
     }
 }
-function issueStanceArgs(packetText) {
+/**
+ * 설계 A 픽스처 스위치 (F-A1/F-A2): 지정 렌즈의 stance 유닛이 허용 집합 밖
+ * evidence_ref를 제출해 실제 `issue_evidence_refs` 화이트리스트 검증을
+ * 거부당하게 한다.
+ * - `ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_LENSES`: csv 렌즈 id 또는 `*`.
+ * - `ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_MODE`: `persist`(기본, cap 소진
+ *   경로) | `correct_on_resubmit`(packet에 resubmit 오류 명세가 주입되면
+ *   유효 ref로 치유 — 오류 명세 전달의 E2E 증거).
+ */
+function stanceUnsupportedRefTargets(env = process.env) {
+    const raw = env.ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_LENSES;
+    if (!raw)
+        return null;
+    if (raw.trim() === "*")
+        return "*";
+    const lenses = raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    return lenses.length > 0 ? new Set(lenses) : null;
+}
+function issueStanceArgs(unitId, packetText) {
     const context = parseRuntimeIssueStanceSchemaContext(packetText);
+    const lensId = unitId.startsWith("issue-stance:")
+        ? unitId.slice("issue-stance:".length)
+        : unitId;
+    const targets = stanceUnsupportedRefTargets();
+    const healed = process.env.ONTO_LLM_MOCK_STANCE_UNSUPPORTED_REF_MODE ===
+        "correct_on_resubmit" && packetHasResubmitErrorSpec(packetText);
+    const emitUnsupportedRef = targets !== null && (targets === "*" || targets.has(lensId)) && !healed;
     return {
-        stances: Object.entries(context.issue_evidence_refs).map(([issueId, refs]) => ({
+        stances: Object.entries(context.issue_evidence_refs).map(([issueId, refs], index) => ({
             issue_id: issueId,
             stance: "support",
             rationale: "Mock realization supports the low-severity issue framing.",
             root_hypothesis_position: "accepts",
             severity_position: "keeps",
-            evidence_refs: refs.slice(0, 1),
+            evidence_refs: emitUnsupportedRef && index === 0
+                ? [`mock-unsupported-ref:${lensId}`]
+                : refs.slice(0, 1),
         })),
     };
 }
@@ -502,7 +533,7 @@ async function executeSubmitTool(args) {
             await args.tool.execute(issueArtifactArgs(unitId, args.userPrompt, args.toolCtx), args.toolCtx);
             return;
         case "submit_issue_stance_response":
-            await args.tool.execute(issueStanceArgs(args.userPrompt), args.toolCtx);
+            await args.tool.execute(issueStanceArgs(unitId, args.userPrompt), args.toolCtx);
             return;
         case "submit_issue_deliberation_response":
             await args.tool.execute(issueDeliberationArgs(args.userPrompt), args.toolCtx);

package/dist/core-runtime/llm/model-switcher.js

@@ -31,7 +31,7 @@ export function normalizeLlmModelSwitcher(config) {
         throw new Error("auth=local currently requires provider=lmstudio.");
     }
     if (config.service_tier && !(provider === "openai" && auth === "oauth")) {
-        throw new Error("service_tier requires the external OAuth worker route with auth=oauth and provider=openai.");
+        throw new Error(`service_tier is only valid on the openai + auth=oauth (Codex) route; remove service_tier for provider=${provider} + auth=${auth}.`);
     }
     const model_id = config.model;
     const common = {