Repository navigation
🚥 feat: Gate Synchronous Tool Results Before Release - #597
lia-by-librechat[bot] wants to merge 72 commits into
Conversation
|
Head: 68df78e C1 mandatory synchronous tool-result gate. Direct/native callbacks, host success/error, eager completion, post-hook replacement, references, nested local/programmatic execution and child inheritance use canonical releases. Required failures are terminal; unsupported artifacts/files/media/background paths stay gated. Focused baseline: 355 tests plus 3 added child/approval cases passed. Workspace types, CJS/ESM/declarations, touched lint/import order and dependency cycles passed. Tracing/approval/resume regressions and independent review are running against this head. No docs, activation or package publication. C2 requires an approved SDK release/pin and adapter/sink certification. |
|
Head: c0e10d2 Fixed independent R1-R5 in 3f3c3a8: raw-free eager rejections/cardinality, nested pre-call errors and local denial text, terminal remote protection failures. Also covered remote bash dispatch, SDK safety interruptions, native callback/error-handler ownership and opaque/accessor message aliases. Integrated current main at 265d97f without rewriting history. Current-head checks: 375 focused tests, 353 approval/tracing tests and 232 child/host-argument tests passed. Workspace types, CJS/ESM/declarations, touched lint/imports, dependency cycles and built C1 exports passed. Fresh independent review follows for this exact head. No docs, activation or package publication; C2 still requires an approved SDK release containing C1 plus exact pin/capability and adapter/sink certification. |
|
@codex review the latest head, final review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0e10d264c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 3d39e2f Fixed R6-R8 in 3d39e2f after a producer/reuse/projection invariant sweep. Checkpoint-owner-validated replay re-inspects canonical content without repeating settled side effects. Full approved references remain separate from model previews. Text-only tuple-format exceptions retain native error status and callbacks. 378 focused SDK tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. No docs, activation or publication. Fresh independent review is running for this exact head; C2 still needs an approved SDK release/pin, capability checks and adapter/app sink certification. |
|
Head: 0333d5f Fixed Codex CX1/CX2 and independent R9/R10 in 0333d5f. Host envelopes are validated before accessor reads, timestamping and host-result tracing. Cloudflare native outputs remain unsupported and gate before sandbox work. Direct approval responses are inspected in full before truncation. Local runners drain accepted bridge requests before checking required failures. Error-handler replacements are re-inspected before reuse. 432 focused/backend tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. Fresh independent review follows for this exact head. No docs, activation or package publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and adapter/app sink certification. |
|
Head: 61dad14 Fixed independent R11-R13. Uncertified executable/request aliases reject before execution; standalone native boundaries validate supplied policy versions; accepted local bridge handlers drain even after client disconnect. 75 C1 dispatch regressions and separate types passed. Broader focused/backend, approval/tracing, child/authority and static/build checks are running against this head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, an exact pin, version-1 capability/policy checks and trusted adapter/app sink certification. |
|
Head: d1ec9ff Fixed independent R14/R15. Checkpoint references now retain SDK source/version/protection provenance. Selected earlier-turn values are re-inspected before restoration or substitution; legacy or newly selected uncertified reference snapshots fail closed. Unselected host outcome/outcome_patch controls survive routing validation; selected aliases stay gated. 145 result/reference regressions passed, including direct/host source replay, allowed controls, reblocking, legacy/mixed-version gating and real eager outcome controls. Types, builds, touched lint/imports, cycles and built CJS/ESM dispatch passed. Broader exact-head checks, CI and fresh independent review follow. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy version checks and trusted adapters plus app sinks. |
|
Head: 99da8a3 Fixed independent R16/R17. Required host releases use frozen dispatched identities and reject changes before inspection, during inspection and after host cleanup. Required failures take precedence over approval interrupts. SDK-owned required host handler absence/throws fail raw-free before native callback logging. Native producer identity/format mutation is gated before callbacks. 100 C1 dispatch regressions and separate types passed. Focused/reference/backend, approval/tracing, child/authority and static/build checks follow for this exact head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
Head: ae4213e Fixed independent R18/R19. Required child-host exceptions are rejected raw-free before native callback logging. Restored registry values are inspected under the current policy before reference resolution; serialized protection flags cannot recreate live policy bindings. Unchanged live values keep their policy-bound admission, avoiding redundant inspection. Batch turns remain reserved before awaits. 163 result/reference regressions, separate types and touched lint/import checks passed. Exact-head broader checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 386dd9b Fixed independent R20. Validated producer messages are snapshotted before awaited inspection. Changes to identity, status, content, artifacts or metadata reject before native callbacks. Canonical provenance includes the immutable envelope, and metadata is copied rather than shared with the producer. 179 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks, module builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 0781d19 Fixed independent R21. Configured local bridge cancellation becomes a raw-free terminal error before text or JSON responses. The failure latch survives ignored HTTP failures and bridge drain; SDK safety reasons retain identity. 189 result/reference regressions, types and touched lint/import checks passed. Real localhost HTTP tests cover ordinary/string canaries, typed policy errors and SDK safety controls in both response modes. Broader exact-head checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0781d1938c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 8112d9a Fixed Codex CX3/CX4 in 8112d9a. Reference collections are copied from validated indexed data before selection or inspection; proxy/subclass/iterable collections, overridden methods, accessors and symbol aliases reject before use. Detached reference fields stay stable across awaits. Envelope validation examines every own key, including non-enumerable symbols, before native callbacks or metadata copying. 208 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks and fresh independent review are running alongside CI. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 572c36da21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: Fixed in
Large indexed Buffer/typed-array artifacts under protection now fail closed as Pre-push focused tests: 1,332 passed; separate TypeScript and touched lint passed. Exact-head focused/build/static/compiled canaries and CI are running. Fresh independent review is running on this head. The previous head's completed review found IR44/IR45 and does not cover this head. No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: Fixed in CX38/CX39 repeat binary-cost/URL-parameter findings already fixed in Pre-push focused checks: 1,324 passed; separate TypeScript and touched lint passed. Exact-head checks/CI are running. Fresh independent review is running on this head. The superseded No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eddd2e1c89
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: Fixed in
Exact-head verification: 3,938 tests passed, one existing benchmark skipped. Separate TypeScript, 17-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and new/prior compiled canaries passed. CI: 13 passed, 0 pending. Fresh independent review is running on this head; the previous review failed with the expired worker and is not clean. No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: Fixed in
Installed-SDK before/after probe: 13 unique objects required 131,107 descriptor reads before the repair, versus 324 after. Finite wide-carrier overflow, selected descendants, callback mutation and default-off controls pass. Exact-head verification: 3,981 tests passed, one existing benchmark skipped. Separate TypeScript, 18-file touched lint/imports, CJS/ESM/declarations, dependency cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed, 0 pending. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: Fixed in
Exact-head verification: 4,136 tests passed, one existing benchmark skipped. Separate TypeScript, 20-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed, 0 pending. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: Fixed in
Installed-SDK tests cover valid SDK approvals/replay, ordinary unselected Error identity/cause, payload-free interrupt extension, callback mutations, aliases and real Run persistence. Pre-push focused tests/types/scoped lint and compiled CJS/ESM controls passed. Exact-head verification: 4,172 tests passed, one existing benchmark skipped. Separate TypeScript, 21-file touched lint/imports, CJS/ESM/declarations, dependency cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed, 0 pending. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: IR53 (P1) is fixed in Installed-SDK tests cover serialized/native/control descendants, normal/eager Run sinks, mixed batches, post-hooks, getters/proxies/overflow, retained host aliases, execute-once, valid data and default-off behavior. Pre-push tests, separate TypeScript, scoped lint and compiled CJS/ESM controls passed. Exact-head verification: 4,203 tests passed, one existing benchmark skipped. Separate TypeScript, 22-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed, 0 pending. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: IR54 (P1) is fixed in Installed-SDK regressions cover text/tuple/record/block output, native/serialized formatter metadata, callback-added content/metadata/serialization fields, retained aliases, getter/proxy shapes, native scalars, valid artifacts and real Run model isolation. Pre-fix: 34 failures, 21 controls passed. All 65 new tests, separate TypeScript, touched lint and compiled CJS/ESM envelope controls pass before publication. Exact-head verification: 4,268 tests passed, one existing benchmark skipped. Separate TypeScript, 23-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: IR55 (P1) is fixed in The 52 new installed-SDK cases cover host/native/control/history paths, field-name permutations, valid native roots, identity substitutions, nested fields, aliased records, real host/eager sinks, default-off and unchanged assistant arguments. Pre-fix: 27 failed, 21 controls passed. Pre-push tests, separate TypeScript, scoped lint and compiled CJS/ESM controls passed. Exact-head verification: 4,320 tests passed, one existing benchmark skipped. Separate TypeScript, 24-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: Fixed in
Installed-SDK reproductions: 30 failures and 3 controls before repair. All 42 new tests cover custom carriers, ordinary authority data, late native/serialized insertions, real fresh/resume/saver observers, native/host/Command/history artifacts, shared references, malformed data and default-off controls. Pre-push focused tests (1,321), separate TypeScript, touched lint and compiled CJS/ESM controls passed. Exact-head checks and CI are running. Fresh independent review is running on this head. The completed review of No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: IR56/IR57 (P1) are fixed in
All 42 new installed-SDK regressions and focused observer-alias controls pass. Exact-head verification: 4,362 tests passed, one existing benchmark skipped. Separate TypeScript, 25-file touched lint/imports, CJS/ESM/declarations, cycles, 18 light-entrypoint checks and all new/prior compiled canaries passed. CI: 13 passed. Fresh independent review is running on this exact head. No findings rejected. No merge, activation or publication. C2 app/SSE/replay and D1 exporter certification remain separate. |
|
Head: IR58/IR59 (P1) fixed in this head. Reserved run-step/handoff state receives bounded carrier admission before native observers, including nested extras and checkpoint writes. All supported native artifact leaves detach from producer/native observer aliases with isolated backing storage. Bytes, native types, view offsets and shared backing topology are preserved. Copy capacity is bounded to 16 MiB per synchronous pass. Default-off behavior is unchanged. Verified: 121 new SDK regressions; 2,509 affected tests; separate Independent review is running on this exact head. The preceding head review found IR58/IR59 and was not clean. No findings rejected. No merge, activation or publication. Full local suite, live provider/external saver certification, C2 app/SSE/replay adapters and D1 exporters remain outside this evidence. |
|
Head: IR60/IR61 (P1) fixed. Native checkpoint controls and task interrupts receive bounded carrier admission before native loading/public exposure. Ordinary native errors admit own fields and nested causes before callbacks, then readmit/detach native and chain-observer aliases. Diagnostic strings, native error types, explicit approval/run-step argument slots and default-off behavior are retained. Surrounding result-bearing fields remain gated. Verified before push: 81 new SDK regressions; 1,306 affected compatibility tests; separate Independent review of this exact head failed: “The child run could not be completed.” No verdict was returned. Review is incomplete, not clean, and no review task is running. The preceding head review found IR60/IR61 and was not clean. No findings rejected. No merge, activation or publication. Full local SDK suite, live provider/external saver certification, C2 app/SSE/replay adapters and D1 exporters remain outside this evidence. |
Summary
Adds default-off
RunConfig.toolResultProtectionfor trusted synchronous text tools. Required awaited inspection precedes native callbacks, completion publication, references, artifacts and ToolMessage/model reuse. Optional hooks cannot bypass it.Arguments and opaque payload text are not rewritten. Unsupported selected file/media/artifact/background outputs, uncertified shells, executable carriers and protected delta reconstruction remain gated. Binary work is limited to 32,768 unique indexed elements per synchronous pass; oversized indexed artifacts fail closed as
overflow. Large index-free ArrayBuffer/DataView artifacts remain supported within a 16 MiB aggregate native copy-capacity limit per synchronous pass.Current head
4496a7d5fda6196146a1f0ca8d1161faebb67fbdBase/merge-base:
708c9118f478a84f28e8e253148a373b49fec191(main, 4.2.1).Latest repairs in
4496a7d5fgate persisted native controls/task interrupts and ordinary error descendants. Native/chain-observer aliases detach. Diagnostic strings, native error types, approvals, explicit argument slots, authority and default-off behavior retain their semantics. The 81 new SDK regressions include real saver tampering, callback mutations, late aliases and approval/resume with result-shaped arguments.Exact-head verification
tsc --noEmitTotal: 4,564 focused tests passed; one existing benchmark skipped. The combined results/type command reached its 70s limit after tests completed; the separate typecheck passed.
Independent review of this exact head failed: “The child run could not be completed.” No verdict was returned. Review is incomplete, not clean, and no review task is running. IR60/IR61 (P1) are fixed in
4496a7d5f. The preceding head review found those defects and was not clean. No findings rejected.Full SDK suite locally, live provider/Langfuse/Cloudflare/external saver certification, C2 app/SSE/replay adapters and D1 exporters were not certified.
Release gate
No merge, activation or publication. C2 requires an approved C1 SDK release, exact pin, version-1 capability/policy checks and trusted adapter plus app/SSE/replay certification. Merge alone does not authorize release or activation.
AI-2213