Address the codemode-swift-review findings: all P0 and P2, partial P1

.github/workflows/codemode-evals.yml

@@ -26,7 +26,9 @@ jobs:
   # unchanged main added no signal for these offline checks.
   deterministic:
     name: Deterministic evals
-    runs-on: macos-latest
+    # Pinned, not macos-latest: the package declares a macOS 15 floor, and a
+    # silently-rolling runner would move that floor without a code change.
+    runs-on: macos-15
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -49,6 +51,18 @@ jobs:
       - name: Test package
         run: swift test
 
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      # The generated TypeScript declarations go into model prompts and host
+      # type-checkers, so they are compiled for real: every platform surface and
+      # every per-capability fragment, under `tsc --strict`, TypeScript pinned.
+      # The Swift tests only catch failure shapes someone already thought of.
+      - name: Type-check generated TypeScript declarations
+        run: scripts/check-typescript-declarations.sh "$RUNNER_TEMP/codemode-dts"
+
       - name: Build eval CLI
         run: swift build --package-path Tools/CodeModeEval
 
@@ -57,7 +71,7 @@ jobs:
 
   platform-build:
     name: Build (${{ matrix.platform }})
-    runs-on: macos-latest
+    runs-on: macos-15
     strategy:
       fail-fast: false
       matrix:
@@ -107,7 +121,7 @@ jobs:
   # live+compare steps with a warning, instead of pretending or failing noisily.
   llm-live:
     name: LLM eval (live regression gate)
-    runs-on: macos-latest
+    runs-on: macos-15
     needs: deterministic
     if: github.event_name == 'workflow_dispatch'
     env:

Package.swift

@@ -67,6 +67,11 @@ let package = Package(
         .testTarget(
             name: "CodeModeAuthoringTests",
             dependencies: [
+                // Declared directly, not only via CodeModeAuthoring: these tests use
+                // CodeModeConfiguration/CodeModeAgentTools, and without the direct
+                // edge SwiftPM did not rebuild them when CodeMode's types changed
+                // layout — leaving stale objects that failed to link or crashed.
+                "CodeMode",
                 "CodeModeAuthoring",
                 "CodeModeMacros",
                 .product(name: "SwiftSyntaxMacrosTestSupport", package: "swift-syntax"),

Sources/CodeMode/API/BridgeModels.swift

@@ -3,7 +3,15 @@ import Foundation
 public struct CodeModeConfiguration: Sendable {
     public var pathPolicy: any PathPolicy
     public var networkAccessPolicy: NetworkAccessPolicy
+    /// Host-owned ceiling on the model-authored `allowedCapabilities` /
+    /// `allowedCapabilityKeys`. Defaults to `.unrestricted`; see `CapabilityGrant`.
+    public var capabilityGrant: CapabilityGrant
     public var fileSystem: any CodeModeFileSystem
+    /// Byte ceilings applied by the filesystem bridge to `fs.read` / `fs.write`.
+    public var fileSystemLimits: FileSystemLimits
+    /// Bounds on retained result/log/event volume per execution, and on how
+    /// many executions run concurrently.
+    public var executionLimits: ExecutionLimits
     public var artifactStore: any ArtifactStore
     public var permissionBroker: any PermissionBroker
     public var auditLogger: any AuditLogger
@@ -25,7 +33,10 @@ public struct CodeModeConfiguration: Sendable {
     public init(
         pathPolicy: any PathPolicy = DefaultPathPolicy(),
         networkAccessPolicy: NetworkAccessPolicy = .standard,
+        capabilityGrant: CapabilityGrant = .unrestricted,
         fileSystem: any CodeModeFileSystem = LocalCodeModeFileSystem(),
+        fileSystemLimits: FileSystemLimits = .standard,
+        executionLimits: ExecutionLimits = .standard,
         artifactStore: any ArtifactStore = InMemoryArtifactStore(),
         permissionBroker: any PermissionBroker = SystemPermissionBroker(),
         auditLogger: any AuditLogger = SyncAuditLogger(),
@@ -46,7 +57,10 @@ public struct CodeModeConfiguration: Sendable {
     ) {
         self.pathPolicy = pathPolicy
         self.networkAccessPolicy = networkAccessPolicy
+        self.capabilityGrant = capabilityGrant
         self.fileSystem = fileSystem
+        self.fileSystemLimits = fileSystemLimits
+        self.executionLimits = executionLimits
         self.artifactStore = artifactStore
         self.permissionBroker = permissionBroker
         self.auditLogger = auditLogger
@@ -89,6 +103,10 @@ public struct JavaScriptAPIReference: Sendable, Codable, Equatable {
     public var argumentHints: [String: String]
     public var argumentConstraints: CapabilityArgumentConstraints
     public var resultSummary: String
+    /// TypeScript declaration for this helper, generated from the fields above.
+    /// Return it from `searchJavaScriptAPI` to give the model real types rather
+    /// than a coarse `argumentTypes` map plus prose.
+    public var dts: String
 
     public init(
         capability: String,
@@ -103,7 +121,8 @@ public struct JavaScriptAPIReference: Sendable, Codable, Equatable {
         argumentTypes: [String: CapabilityArgumentType],
         argumentHints: [String: String],
         argumentConstraints: CapabilityArgumentConstraints = .none,
-        resultSummary: String
+        resultSummary: String,
+        dts: String = ""
     ) {
         self.capability = capability
         self.capabilityKey = capabilityKey ?? CodeModeCapabilityKey(rawValue: capability)
@@ -118,6 +137,38 @@ public struct JavaScriptAPIReference: Sendable, Codable, Equatable {
         self.argumentHints = argumentHints
         self.argumentConstraints = argumentConstraints
         self.resultSummary = resultSummary
+        self.dts = dts
+    }
+
+    private enum CodingKeys: String, CodingKey {
+        case capability, capabilityKey, builtInCapability, jsNames, summary, tags, example
+        case requiredArguments, optionalArguments, argumentTypes, argumentHints
+        case argumentConstraints, resultSummary, dts
+    }
+
+    /// `dts` is optional on the way in. References encoded before it existed —
+    /// cached search results, eval fixtures — would otherwise fail to decode with
+    /// `keyNotFound`; when it is absent, the declaration is regenerated from the
+    /// decoded fields rather than left empty.
+    public init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: CodingKeys.self)
+        self.capability = try container.decode(String.self, forKey: .capability)
+        self.capabilityKey = try container.decode(CodeModeCapabilityKey.self, forKey: .capabilityKey)
+        self.builtInCapability = try container.decodeIfPresent(CapabilityID.self, forKey: .builtInCapability)
+        self.jsNames = try container.decode([String].self, forKey: .jsNames)
+        self.summary = try container.decode(String.self, forKey: .summary)
+        self.tags = try container.decode([String].self, forKey: .tags)
+        self.example = try container.decode(String.self, forKey: .example)
+        self.requiredArguments = try container.decode([String].self, forKey: .requiredArguments)
+        self.optionalArguments = try container.decode([String].self, forKey: .optionalArguments)
+        self.argumentTypes = try container.decode([String: CapabilityArgumentType].self, forKey: .argumentTypes)
+        self.argumentHints = try container.decode([String: String].self, forKey: .argumentHints)
+        self.argumentConstraints = try container.decode(CapabilityArgumentConstraints.self, forKey: .argumentConstraints)
+        self.resultSummary = try container.decode(String.self, forKey: .resultSummary)
+        self.dts = try container.decodeIfPresent(String.self, forKey: .dts) ?? ""
+        if self.dts.isEmpty {
+            self.dts = TypeScriptDeclarations.declaration(for: self)
+        }
     }
 }
 
@@ -132,6 +183,13 @@ public struct JavaScriptAPISearchResponse: Sendable, Codable, Equatable {
 }
 
 public struct JavaScriptExecutionRequest: Sendable, Codable, Equatable {
+    /// Bounds advertised in `executeJavaScriptParameterSchema`. Values outside
+    /// them are clamped rather than rejected: a model that asks for a 10-minute
+    /// budget should get the ceiling and a running script, not a hard failure.
+    public static let minimumTimeoutMs = 1
+    public static let maximumTimeoutMs = 60_000
+    public static let defaultTimeoutMs = 10_000
+
     public var code: String
     public var allowedCapabilities: [CapabilityID]
     public var allowedCapabilityKeys: [CodeModeCapabilityKey]
@@ -142,16 +200,20 @@ public struct JavaScriptExecutionRequest: Sendable, Codable, Equatable {
         code: String,
         allowedCapabilities: [CapabilityID],
         allowedCapabilityKeys: [CodeModeCapabilityKey] = [],
-        timeoutMs: Int = 10_000,
+        timeoutMs: Int = JavaScriptExecutionRequest.defaultTimeoutMs,
         context: ExecutionContext = .init()
     ) {
         self.code = code
         self.allowedCapabilities = allowedCapabilities
         self.allowedCapabilityKeys = allowedCapabilityKeys
-        self.timeoutMs = timeoutMs
+        self.timeoutMs = Self.clampTimeoutMs(timeoutMs)
         self.context = context
     }
 
+    static func clampTimeoutMs(_ value: Int) -> Int {
+        min(max(value, minimumTimeoutMs), maximumTimeoutMs)
+    }
+
     private enum CodingKeys: String, CodingKey {
         case code
         case allowedCapabilities
@@ -194,10 +256,13 @@ public struct JavaScriptExecutionRequest: Sendable, Codable, Equatable {
         self.allowedCapabilities = capabilities
 
         self.allowedCapabilityKeys = try container.decodeIfPresent([CodeModeCapabilityKey].self, forKey: .allowedCapabilityKeys) ?? []
-        self.timeoutMs = try Self.decodeTimeoutMs(from: container) ?? 10_000
+        self.timeoutMs = Self.clampTimeoutMs(try Self.decodeTimeoutMs(from: container) ?? Self.defaultTimeoutMs)
         self.context = try container.decodeIfPresent(ExecutionContext.self, forKey: .context) ?? .init()
     }
 
+    // Every conversion here is total. `Int.init(_: Double)` traps on non-finite
+    // and out-of-range input, and this runs on model-authored JSON before any
+    // script does — `{"timeoutMs": 1e300}` would kill the host process in-process.
     private static func decodeTimeoutMs(from container: KeyedDecodingContainer<CodingKeys>) throws -> Int? {
         guard container.contains(.timeoutMs), try !container.decodeNil(forKey: .timeoutMs) else {
             return nil
@@ -206,18 +271,32 @@ public struct JavaScriptExecutionRequest: Sendable, Codable, Equatable {
             return value
         }
         if let value = try? container.decode(Double.self, forKey: .timeoutMs) {
-            return Int(value)
+            return try requireRepresentable(value, in: container)
         }
         if let string = try? container.decode(String.self, forKey: .timeoutMs),
            let value = Double(string.trimmingCharacters(in: .whitespaces)) {
-            return Int(value)
+            return try requireRepresentable(value, in: container)
         }
         throw DecodingError.dataCorruptedError(
             forKey: .timeoutMs,
             in: container,
             debugDescription: "timeoutMs must be an integer or a numeric string."
         )
     }
+
+    private static func requireRepresentable(
+        _ value: Double,
+        in container: KeyedDecodingContainer<CodingKeys>
+    ) throws -> Int {
+        guard let converted = JSONValue.exactInt(from: value) else {
+            throw DecodingError.dataCorruptedError(
+                forKey: .timeoutMs,
+                in: container,
+                debugDescription: "timeoutMs must be a finite number representable as an integer; received \(value)."
+            )
+        }
+        return converted
+    }
 }
 
 public enum JavaScriptExecutionEvent: Sendable, Equatable {
@@ -299,22 +378,32 @@ public final class JavaScriptExecutionCall: @unchecked Sendable {
     public let events: AsyncStream<JavaScriptExecutionEvent>
 
     private let resultTask: Task<JavaScriptExecutionResult, Error>
+    /// Keeps the execution alive while this handle is; the events stream holds
+    /// the same token. When both are gone the execution is cancelled, so a call
+    /// nobody can observe does not keep touching the filesystem, the network,
+    /// and system UI on the user's behalf.
+    private let observation: ExecutionObservationToken
     private let cancelImpl: @Sendable () -> Void
 
     init(
         events: AsyncStream<JavaScriptExecutionEvent>,
         resultTask: Task<JavaScriptExecutionResult, Error>,
+        observation: ExecutionObservationToken,
         cancelImpl: @escaping @Sendable () -> Void
     ) {
         self.events = events
         self.resultTask = resultTask
+        self.observation = observation
         self.cancelImpl = cancelImpl
     }
 
     public var result: JavaScriptExecutionResult {
         get async throws {
             let outcome = await withTaskCancellationHandler {
-                await waitForResultOutcome()
+                // `resultTask.result` already detaches the await from the calling
+                // task's cancellation, so the previous `Task.detached` per access
+                // bought nothing but an extra task.
+                await resultTask.result
             } onCancel: {
                 self.cancel()
             }
@@ -324,8 +413,7 @@ public final class JavaScriptExecutionCall: @unchecked Sendable {
                 return result
             case let .failure(error as CodeModeToolError):
                 throw error
-            case let .failure(error as CancellationError):
-                _ = error
+            case .failure(is CancellationError):
                 throw CodeModeToolError(code: "CANCELLED", message: "Execution cancelled")
             case let .failure(error):
                 throw error
@@ -337,18 +425,6 @@ public final class JavaScriptExecutionCall: @unchecked Sendable {
         cancelImpl()
         resultTask.cancel()
     }
-
-    private func waitForResultOutcome() async -> Result<JavaScriptExecutionResult, Error> {
-        await withCheckedContinuation { continuation in
-            Task.detached {
-                do {
-                    continuation.resume(returning: .success(try await self.resultTask.value))
-                } catch {
-                    continuation.resume(returning: .failure(error))
-                }
-            }
-        }
-    }
 }
 
 public struct ExecutionContext: Sendable, Codable, Equatable {

Sources/CodeMode/API/SystemAppleServiceClients.swift

@@ -819,8 +819,14 @@ enum SystemMapsMapping {
 private func openSystemURL(_ url: URL) -> Bool {
     #if canImport(UIKit)
     if Thread.isMainThread {
-        UIApplication.shared.open(url, options: [:], completionHandler: nil)
-        return true
+        // `UIApplication.shared` and `open` are main-actor-isolated. We have
+        // already established we are on the main thread, so state that to the
+        // compiler rather than hopping — a hop here would return before the open
+        // has been requested.
+        return MainActor.assumeIsolated {
+            UIApplication.shared.open(url, options: [:], completionHandler: nil)
+            return true
+        }
     }
     let semaphore = DispatchSemaphore(value: 0)
     let opened = LockedBox(false)

Sources/CodeMode/Bridges/AlarmBridge.swift

@@ -139,13 +139,7 @@ public final class AlarmBridge: @unchecked Sendable {
     }
 
     private func isoDate(_ text: String?) -> Date? {
-        guard let text else { return nil }
-        let formatter = ISO8601DateFormatter()
-        if let date = formatter.date(from: text) {
-            return date
-        }
-        formatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds]
-        return formatter.date(from: text)
+        CodeModeDate.parse(text)
     }
 
     #if canImport(AlarmKit) && canImport(SwiftUI) && os(iOS)

Sources/CodeMode/Bridges/BigTicketAppleBridges.swift

@@ -111,7 +111,12 @@ public final class SpeechBridge: @unchecked Sendable {
         try ensurePermission(.speechRecognition, context: context)
         let path = try requireNonEmptyString("path", in: arguments, capability: "speech.file.transcribe")
         let resolved = try context.pathPolicy.resolve(path: path)
+        // The raw, script-supplied `path` is replaced rather than accompanied:
+        // leaving both in the dictionary made every host adapter one
+        // `arguments.string("path")` away from a path-policy bypass, with nothing
+        // in the code saying which key was the safe one.
         var clientArguments = arguments
+        clientArguments["path"] = .string(resolved.path)
         clientArguments["resolvedPath"] = .string(resolved.path)
         try validateOptionalPositiveNumber("timeoutMs", in: arguments, capability: "speech.file.transcribe")
         return try client.transcribeFile(arguments: clientArguments)
@@ -348,7 +353,9 @@ public final class PassKitBridge: @unchecked Sendable {
     public func addPass(arguments: [String: JSONValue], context: BridgeInvocationContext) throws -> JSONValue {
         let path = try requireNonEmptyString("path", in: arguments, capability: "passkit.pass.add")
         let resolved = try context.pathPolicy.resolve(path: path)
+        // As above: the raw path does not survive into the client dictionary.
         var clientArguments = arguments
+        clientArguments["path"] = .string(resolved.path)
         clientArguments["resolvedPath"] = .string(resolved.path)
         return try client.addPass(arguments: clientArguments)
     }

Sources/CodeMode/Bridges/CapabilityRegistrations+Core.swift

@@ -14,7 +14,7 @@ extension DefaultCapabilityRegistrationBuilder {
                 descriptor: .init(
                     id: .networkFetch,
                     title: "Fetch HTTP resource",
-                    summary: "Perform HTTP(S) requests through URLSession via a fetch-compatible API.",
+                    summary: "Perform HTTP(S) requests through an isolated URLSession via a fetch-compatible API. Requests carry no app cookies or stored credentials, and credential headers (Cookie, Authorization, Proxy-*) are refused unless the host app permits them.",
                     tags: ["network", "http", "fetch"],
                     example: "await fetch('https://api.example.com/data').then(r => r.json())",
                     requiredArguments: ["url"],
@@ -29,7 +29,7 @@ extension DefaultCapabilityRegistrationBuilder {
                     argumentHints: [
                         "url": "Absolute HTTP(S) URL string.",
                         "options.method": "HTTP method; defaults to GET.",
-                        "options.headers": "Object of header key/value string pairs.",
+                        "options.headers": "Object of header key/value string pairs. Cookie, Authorization, and Proxy-* are refused unless the host app permits credential headers.",
                         "options.body": "UTF-8 request body string.",
                         "options.bodyBase64": "Base64-encoded request body. Mutually exclusive with options.body.",
                         "options.timeoutMs": "Request and bridge wait timeout in milliseconds; defaults to 30000.",