Repository navigation
🚥 feat: Gate Synchronous Tool Results Before Release - #597
lia-by-librechat[bot] wants to merge 43 commits into
Conversation
|
Head: 68df78e C1 mandatory synchronous tool-result gate. Direct/native callbacks, host success/error, eager completion, post-hook replacement, references, nested local/programmatic execution and child inheritance use canonical releases. Required failures are terminal; unsupported artifacts/files/media/background paths stay gated. Focused baseline: 355 tests plus 3 added child/approval cases passed. Workspace types, CJS/ESM/declarations, touched lint/import order and dependency cycles passed. Tracing/approval/resume regressions and independent review are running against this head. No docs, activation or package publication. C2 requires an approved SDK release/pin and adapter/sink certification. |
|
Head: c0e10d2 Fixed independent R1-R5 in 3f3c3a8: raw-free eager rejections/cardinality, nested pre-call errors and local denial text, terminal remote protection failures. Also covered remote bash dispatch, SDK safety interruptions, native callback/error-handler ownership and opaque/accessor message aliases. Integrated current main at 265d97f without rewriting history. Current-head checks: 375 focused tests, 353 approval/tracing tests and 232 child/host-argument tests passed. Workspace types, CJS/ESM/declarations, touched lint/imports, dependency cycles and built C1 exports passed. Fresh independent review follows for this exact head. No docs, activation or package publication; C2 still requires an approved SDK release containing C1 plus exact pin/capability and adapter/sink certification. |
|
@codex review the latest head, final review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0e10d264c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 3d39e2f Fixed R6-R8 in 3d39e2f after a producer/reuse/projection invariant sweep. Checkpoint-owner-validated replay re-inspects canonical content without repeating settled side effects. Full approved references remain separate from model previews. Text-only tuple-format exceptions retain native error status and callbacks. 378 focused SDK tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. No docs, activation or publication. Fresh independent review is running for this exact head; C2 still needs an approved SDK release/pin, capability checks and adapter/app sink certification. |
|
Head: 0333d5f Fixed Codex CX1/CX2 and independent R9/R10 in 0333d5f. Host envelopes are validated before accessor reads, timestamping and host-result tracing. Cloudflare native outputs remain unsupported and gate before sandbox work. Direct approval responses are inspected in full before truncation. Local runners drain accepted bridge requests before checking required failures. Error-handler replacements are re-inspected before reuse. 432 focused/backend tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. Fresh independent review follows for this exact head. No docs, activation or package publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and adapter/app sink certification. |
|
Head: 61dad14 Fixed independent R11-R13. Uncertified executable/request aliases reject before execution; standalone native boundaries validate supplied policy versions; accepted local bridge handlers drain even after client disconnect. 75 C1 dispatch regressions and separate types passed. Broader focused/backend, approval/tracing, child/authority and static/build checks are running against this head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, an exact pin, version-1 capability/policy checks and trusted adapter/app sink certification. |
|
Head: d1ec9ff Fixed independent R14/R15. Checkpoint references now retain SDK source/version/protection provenance. Selected earlier-turn values are re-inspected before restoration or substitution; legacy or newly selected uncertified reference snapshots fail closed. Unselected host outcome/outcome_patch controls survive routing validation; selected aliases stay gated. 145 result/reference regressions passed, including direct/host source replay, allowed controls, reblocking, legacy/mixed-version gating and real eager outcome controls. Types, builds, touched lint/imports, cycles and built CJS/ESM dispatch passed. Broader exact-head checks, CI and fresh independent review follow. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy version checks and trusted adapters plus app sinks. |
|
Head: 99da8a3 Fixed independent R16/R17. Required host releases use frozen dispatched identities and reject changes before inspection, during inspection and after host cleanup. Required failures take precedence over approval interrupts. SDK-owned required host handler absence/throws fail raw-free before native callback logging. Native producer identity/format mutation is gated before callbacks. 100 C1 dispatch regressions and separate types passed. Focused/reference/backend, approval/tracing, child/authority and static/build checks follow for this exact head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
Head: ae4213e Fixed independent R18/R19. Required child-host exceptions are rejected raw-free before native callback logging. Restored registry values are inspected under the current policy before reference resolution; serialized protection flags cannot recreate live policy bindings. Unchanged live values keep their policy-bound admission, avoiding redundant inspection. Batch turns remain reserved before awaits. 163 result/reference regressions, separate types and touched lint/import checks passed. Exact-head broader checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 386dd9b Fixed independent R20. Validated producer messages are snapshotted before awaited inspection. Changes to identity, status, content, artifacts or metadata reject before native callbacks. Canonical provenance includes the immutable envelope, and metadata is copied rather than shared with the producer. 179 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks, module builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 0781d19 Fixed independent R21. Configured local bridge cancellation becomes a raw-free terminal error before text or JSON responses. The failure latch survives ignored HTTP failures and bridge drain; SDK safety reasons retain identity. 189 result/reference regressions, types and touched lint/import checks passed. Real localhost HTTP tests cover ordinary/string canaries, typed policy errors and SDK safety controls in both response modes. Broader exact-head checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0781d1938c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 8112d9a Fixed Codex CX3/CX4 in 8112d9a. Reference collections are copied from validated indexed data before selection or inspection; proxy/subclass/iterable collections, overridden methods, accessors and symbol aliases reject before use. Detached reference fields stay stable across awaits. Envelope validation examines every own key, including non-enumerable symbols, before native callbacks or metadata copying. 208 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks and fresh independent review are running alongside CI. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
@codex review the latest head, final review |
|
Head: fa2abf1 Fixed independent IR15 in fa2abf1. Saver reads admit detached message channel values and all pending message writes before native Pregel reduction, including writes appended under an unchanged checkpoint ID. The same gate covers initial preflight, execution reloads and foreground children. Certified results, own writes, removals and unrelated channels remain supported. 467 focused result/reference/saver controls, separate types and scoped static checks passed. Real warm/rebuilt interrupted graphs reproduce root and descendant pending-write leaks and now reject before native callbacks, approvals or model reuse. Broader exact-head tests, built entrypoint controls and independent review are running. No docs, activation or publication. C2 release/exact pin/capability and adapter/app-sink certification remain prerequisites. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa2abf1e12
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: b25b502 Fixed independent IR16 and IR17 in b25b502. Checkpoint admission now returns detached run-step carriers, nested entries and receipts, including pending Overwrite values. Startup inputs are admitted again after awaited hooks, with separate message arrays and routing identities before native graph invocation. Arguments and opaque unselected payloads are not rewritten. 481 result/reference/saver controls, separate types and scoped static checks passed. Real saver tests mutate carriers during inspection; hook tests cover replacement, append, delayed message/array/routing mutation, allowed contexts and absent-policy behavior. Broader exact-head tests, built SDK controls, CI and independent review are running. No docs, activation or publication; C2 release/exact pin/capability and adapter/app-sink certification remain prerequisites. |
|
Head: 21a689f Fixed IR16/IR17 in b25b502: return detached run-step carriers/receipts, including Overwrite; readmit and detach startup-hook inputs before native callbacks. Fixed CX19/CX20/CX21 across b25b502/21a689fe0: admit listed tuples and detach native configuration/metadata/version containers; reject fresh input accessors/proxies before reads. All three inline threads have fixing-commit replies and are resolved.
Independent exact-head review is running. Its result is not yet claimed. Full SDK suites were not run locally. Live provider/Cloudflare, app/SSE/replay adapter and D1 serialized-exporter certification were not performed. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin and capability/policy plus adapter/app-sink certification. |
|
Head: 1604e06 Fixed independent P1 findings IR18/IR19/IR20 in 1604e06:
Independent exact-head review is running; its result is not yet claimed. Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, app/SSE/replay adapter and D1 serialized-exporter certification were not performed. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin and capability/policy plus adapter/app-sink certification. |
|
Head: aa3fd44 Fixed independent P1 IR21 in aa3fd44. Send admission binds results to enclosing proposals and receipts across stored/pending tasks, Command goto/update and fresh input. Nameless/renamed results and conflicting packet-local proposals cannot downgrade selected sources. Unattributed results reject before native callbacks. Certified selected and established unselected sources remain supported; both message channels share the same gate. No argument or identity rewriting.
Independent exact-head review is running; its result is not yet claimed. Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, app/SSE/replay adapter and D1 serialized-exporter certification were not performed. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin and capability/policy plus adapter/app-sink certification. |
|
Head: 97aa082 Fixed IR22 (P1) and IR23 (P2) in 97aa082. Ordinary resume writes bind to admitted descendant source identities before native Commands, without promoting update proposals into trusted sources. Bindings distinguish batch/message identity, namespace and completed result identity, preserving chronological provider call ID reuse. Ambiguous or conflicting claims reject. Known completed replay, selected/unselected reused history and unrelated unselected update controls pass.
Independent exact-head review is running; its result is not yet claimed. Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, app/SSE/replay adapter and D1 serialized-exporter certification were not performed. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin and capability/policy plus adapter/app-sink certification. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97aa0824c2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
# Conflicts: # src/run.ts # src/tools/subagent/SubagentExecutor.ts # src/tools/toolBatchReplay.ts
|
Head: 4497bb6 Fixed IR24/IR25 in bef01a3 and refreshed against current main in 4497bb6. Fresh messages and pending writes are admitted against immutable checkpoint proposals before extending source authority. One admission context binds root and descendant reads, including writes appended after preflight. Run-step writes share the same snapshot gate. Integrated main's graph-subagent approvals and compaction windows without dropping canonical update/config or per-member replay scoping. New tests cover protected parallel root/graph children, warm/rebuilt direct/host approve/respond, compaction window carriers and checkpoint traversal getters. 926 refreshed integration controls plus separate types and scoped lint/import checks passed. Broader exact-head tests, builds, CI and independent review are running. No docs, activation or publication. C2 release/exact pin/capability and adapter/app-sink certification remain prerequisites. |
|
Head: e138c01 Fixed CX22/CX23/CX24/CX25 (P1) in e138c01: reject proxy prototype chains without traps; admit and identity-check saver write-return configs; reject selected producer interrupt payloads and detach empty control diagnostics; gate protected delta reconstruction while routing ordinary delta reads to admitted cursors. All four inline threads have fixing-commit replies and are resolved. IR24/IR25 authority fixes and the current-main refresh are included. Protected parallel root/graph-child approvals, partial addressing and compaction windows retain admission and member authorization.
The initial independent review execution ended without a verdict. The same frozen-head review thread has resumed; no clean review is claimed. Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, app/SSE/replay adapter and D1 serialized-exporter certification were not performed. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin and capability/policy plus adapter/app-sink certification. |
|
Head: f5864cb Fixed independent IR26 in f5864cb. Execution-time checkpoint histories are validated against retained preflight sources, including admitted descendant identities, before namespace authority is extended. Previously admitted batch/result identities are merged, not replaced by reloaded proposals. Both message channels share the gate. 801 focused result/reference/saver controls, separate types and scoped static checks passed. Real SDK reload tests reproduce coordinated source/result renames, missing names and replaced batch IDs, with root/descendant and allowed reload controls. Completed replay and protected parallel approvals still pass. Broader exact-head tests, builds, CI and independent review are running. No docs, activation or publication. C2 release/exact pin/capability and adapter/app-sink certification remain prerequisites. |
|
Head: 3b17a35 Fixed IR26 (P1) in f5864cb/3b17a35fe: execution-time checkpoint reloads validate committed history against retained preflight sources before extending namespace authority. Coordinated name/batch changes and nameless results cannot replace admitted descendant identities. Receipt-bound completed results remain distinct from pending siblings with reused call IDs. Contradictory proposal/receipt identities reject. The locally detected partial-approval regression is fixed in 3b17a35.
Independent review is running on this exact head. Review f5864cb was cancelled after the local partial-approval failure; it does not cover this head. Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, app/SSE/replay adapters and D1 serialized exporters were not certified. No docs, activation, merge or publication. C2 requires an approved C1 release, exact pin/capability/policy and adapter/app-sink certification. |
|
Reviewed head: 4112cc1 Source review only. The isolated reviewer did not run SDK tests, typechecks or builds. No live provider/tracing/external saver/app-sink certification. Main advanced to 9db504f during review. The existing branch is being refreshed for the Zod 4/dependency update. This completed review covers only 4112cc1, not the next head. |
# Conflicts: # src/types/run.ts
|
Head and independently reviewed SHA: 0410722 Independent review: complete, no findings. Reviewed the full 23-file diff and merge resolution, including callbacks, hooks, completion, references, replay, checkpoint, child and both multi-agent channels. Source-only review: no reviewer-local SDK tests, typecheck or build. All inline review threads are resolved.
Recent finding dispositions:
Main's Zod 4 dependency files are unchanged. Full audit has six low-severity Jest development-chain findings. Full-source strict lint has 56 warnings and zero errors, all in 16 files verified unchanged from main; touched files have no diagnostics. No unrelated dependency or lint edits. Not run/certified: full SDK suite locally; live provider/Langfuse/Cloudflare/external saver backends; app/SSE/replay adapters; D1 serialized exporters. C2 requires an approved C1 release, exact pin/capability/policy and trusted adapter/app-sink certification. No committed documentation, activation or publication. PR remains open, not merged. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0410722ade
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| descriptors.tool_calls = { ...descriptors.tool_calls, value: detached }; | ||
| if (Object.hasOwn(descriptors, 'lc_kwargs') && descriptors.lc_kwargs.value != null && Object.hasOwn(descriptors.lc_kwargs.value as object, 'tool_calls')) Object.defineProperty(descriptors.lc_kwargs.value, 'tool_calls', { value: detached, enumerable: true, writable: true, configurable: true }); | ||
| } | ||
| const copy = Object.create(Object.getPrototypeOf(message), descriptors) as BaseMessage; |
There was a problem hiding this comment.
When a protected run receives a restored or caller-supplied message subclass with ordinary own data fields, a non-proxy prototype can override getType() (or another message method) and this copy preserves that untrusted implementation. Subsequent code such as findLastMessageOfType in run.ts:3701 invokes the method after admission, so it can throw an error containing raw selected-tool output and bypass normalization. Rebuild admitted messages with a trusted SDK message prototype, or reject prototypes that are not recognized message prototypes.
AGENTS.md reference: AGENTS.md:L147-L147
Useful? React with 👍 / 👎.
| const values = snapshotToolCheckpointRecord(snapshot.values, ['messages', 'agentMessages', 'runStepState', 'summarizationRequest', 'handoffState']); | ||
| snapshot.values = values; |
There was a problem hiding this comment.
When a protected multi-agent run restores a custom checkpoint whose handoffState is a proxy or contains accessor-backed fields, this only copies the reference and never admits its nested state. HandoffRouting.restore subsequently reads fields such as version, entryAgentId, and transitions, so an accessor can throw an error containing raw selected-tool output after checkpoint validation; on the resume path this occurs at run.ts:2457 before the guarded stream. Deep-snapshot and validate handoffState before returning the admitted checkpoint.
AGENTS.md reference: AGENTS.md:L147-L147
Useful? React with 👍 / 👎.
Summary
Adds default-off
RunConfig.toolResultProtectionfor trusted synchronous text tools. Mandatory awaited inspection precedes native callbacks, completions, references and ToolMessage/model reuse; optional hooks cannot replace it.IDs/status, approvals, authority and batch accounting are preserved. No argument or arbitrary structured-payload rewriting. Selected artifacts, files/media, background outputs, uncertified aliases/tool shells, Cloudflare-native outputs and client delegation remain unsupported/gated. Absent/unselected behavior stays unchanged. No activation, publication or documentation changes.
Latest review fixes and main refresh
Head:
0410722adef273cabc87968b71b9f8720a54dcbeBase/merge-base:
9db504f2777cad90fc1fef2791eb9945e958a556(main). Existing PR, no history rewrite.IR24/IR25 are fixed: fresh and pending messages bind immutable checkpoint-owned proposals before source authority is extended. Admission collects original root/descendant sources, rechecks preflight tuples and preserves this execution's writes. Run-step updates are detached before native use.
The refresh preserves main's graph-subagent and parallel approval scoping, canonical updates/configuration and execute-once behavior. Newly introduced compaction windows, interrupt payloads and traversal fields pass the same message/descriptor gates. Arguments and routing identities are not rewritten.
CX22/CX23/CX24/CX25 are fixed: message prototype proxies reject without traps; saver put-return configs are detached and identity-checked; selected producer interrupt payloads reject before native publication; uncertified protected delta reconstruction remains unsupported. Ordinary deltas retain admitted cursor routing. Payload-free control interrupts discard producer diagnostics.
IR26 is fixed: reloaded committed histories are checked against retained preflight source identities before extending namespace authority. Previously admitted source occurrences remain bound across saver reads. Receipt-bound completed results preserve partial graph approvals when siblings reuse call IDs; contradictory source and receipt evidence still rejects. Real root/descendant reload canaries cover both message channels and retain allowed writes, completed replay and parallel approval controls.
IR27 is fixed: saver lookup/history routing is checked against captured selected identities before content admission. Config/body checkpoint IDs must agree; parent routing cannot change thread or namespace. Backend lookup configurations are detached from callers. Explicit, latest, legacy and history selections retain their supported behavior.
Refreshed against main's Zod 4/dependency migration (#649) without changing main's dependency files. Policy placement remains top-level. Prior head
4112cc133completed independent source review with no findings; it does not cover this refreshed head.Exact-head verification
tsc --noEmitIndependent review completed on
0410722adef273cabc87968b71b9f8720a54dcbe: no findings. Full-diff source review only; the reviewer did not run local SDK tests, typechecks or builds. All inline review threads are resolved.Production audit: zero vulnerabilities. Full audit: six low-severity Jest development-chain findings inherited from main. Full-source strict lint reports 56 warnings and zero errors in 16 files verified unchanged from main; no touched file has warnings. Dependency files match main exactly. No unrelated dependency or lint changes.
Full SDK suites were not run locally. Live provider/Langfuse/Cloudflare, external savers, app/SSE/replay adapters and D1 serialized-exporter certification were not performed. No activation, merge or publication.
C2 prerequisite
Wait for an approved SDK release containing C1, pin that exact version, require capability/policy version 1, and certify trusted adapters plus app/SSE/replay sinks. Merge alone does not authorize release or activation. Unsupported paths remain gated across rollback/mixed versions.
AI-2213