Repository navigation
🚥 feat: Gate Synchronous Tool Results Before Release - #597
lia-by-librechat[bot] wants to merge 26 commits into
Conversation
|
Head: 68df78e C1 mandatory synchronous tool-result gate. Direct/native callbacks, host success/error, eager completion, post-hook replacement, references, nested local/programmatic execution and child inheritance use canonical releases. Required failures are terminal; unsupported artifacts/files/media/background paths stay gated. Focused baseline: 355 tests plus 3 added child/approval cases passed. Workspace types, CJS/ESM/declarations, touched lint/import order and dependency cycles passed. Tracing/approval/resume regressions and independent review are running against this head. No docs, activation or package publication. C2 requires an approved SDK release/pin and adapter/sink certification. |
|
Head: c0e10d2 Fixed independent R1-R5 in 3f3c3a8: raw-free eager rejections/cardinality, nested pre-call errors and local denial text, terminal remote protection failures. Also covered remote bash dispatch, SDK safety interruptions, native callback/error-handler ownership and opaque/accessor message aliases. Integrated current main at 265d97f without rewriting history. Current-head checks: 375 focused tests, 353 approval/tracing tests and 232 child/host-argument tests passed. Workspace types, CJS/ESM/declarations, touched lint/imports, dependency cycles and built C1 exports passed. Fresh independent review follows for this exact head. No docs, activation or package publication; C2 still requires an approved SDK release containing C1 plus exact pin/capability and adapter/sink certification. |
|
@codex review the latest head, final review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c0e10d264c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 3d39e2f Fixed R6-R8 in 3d39e2f after a producer/reuse/projection invariant sweep. Checkpoint-owner-validated replay re-inspects canonical content without repeating settled side effects. Full approved references remain separate from model previews. Text-only tuple-format exceptions retain native error status and callbacks. 378 focused SDK tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. No docs, activation or publication. Fresh independent review is running for this exact head; C2 still needs an approved SDK release/pin, capability checks and adapter/app sink certification. |
|
Head: 0333d5f Fixed Codex CX1/CX2 and independent R9/R10 in 0333d5f. Host envelopes are validated before accessor reads, timestamping and host-result tracing. Cloudflare native outputs remain unsupported and gate before sandbox work. Direct approval responses are inspected in full before truncation. Local runners drain accepted bridge requests before checking required failures. Error-handler replacements are re-inspected before reuse. 432 focused/backend tests and 353 approval/tracing tests passed. Separate types, CJS/ESM/declarations, declared exports, touched lint/import checks and dependency cycles passed. Fresh independent review follows for this exact head. No docs, activation or package publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and adapter/app sink certification. |
|
Head: 61dad14 Fixed independent R11-R13. Uncertified executable/request aliases reject before execution; standalone native boundaries validate supplied policy versions; accepted local bridge handlers drain even after client disconnect. 75 C1 dispatch regressions and separate types passed. Broader focused/backend, approval/tracing, child/authority and static/build checks are running against this head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, an exact pin, version-1 capability/policy checks and trusted adapter/app sink certification. |
|
Head: d1ec9ff Fixed independent R14/R15. Checkpoint references now retain SDK source/version/protection provenance. Selected earlier-turn values are re-inspected before restoration or substitution; legacy or newly selected uncertified reference snapshots fail closed. Unselected host outcome/outcome_patch controls survive routing validation; selected aliases stay gated. 145 result/reference regressions passed, including direct/host source replay, allowed controls, reblocking, legacy/mixed-version gating and real eager outcome controls. Types, builds, touched lint/imports, cycles and built CJS/ESM dispatch passed. Broader exact-head checks, CI and fresh independent review follow. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy version checks and trusted adapters plus app sinks. |
|
Head: 99da8a3 Fixed independent R16/R17. Required host releases use frozen dispatched identities and reject changes before inspection, during inspection and after host cleanup. Required failures take precedence over approval interrupts. SDK-owned required host handler absence/throws fail raw-free before native callback logging. Native producer identity/format mutation is gated before callbacks. 100 C1 dispatch regressions and separate types passed. Focused/reference/backend, approval/tracing, child/authority and static/build checks follow for this exact head alongside CI and fresh independent review. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
Head: ae4213e Fixed independent R18/R19. Required child-host exceptions are rejected raw-free before native callback logging. Restored registry values are inspected under the current policy before reference resolution; serialized protection flags cannot recreate live policy bindings. Unchanged live values keep their policy-bound admission, avoiding redundant inspection. Batch turns remain reserved before awaits. 163 result/reference regressions, separate types and touched lint/import checks passed. Exact-head broader checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 386dd9b Fixed independent R20. Validated producer messages are snapshotted before awaited inspection. Changes to identity, status, content, artifacts or metadata reject before native callbacks. Canonical provenance includes the immutable envelope, and metadata is copied rather than shared with the producer. 179 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks, module builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
Head: 0781d19 Fixed independent R21. Configured local bridge cancellation becomes a raw-free terminal error before text or JSON responses. The failure latch survives ignored HTTP failures and bridge drain; SDK safety reasons retain identity. 189 result/reference regressions, types and touched lint/import checks passed. Real localhost HTTP tests cover ordinary/string canaries, typed policy errors and SDK safety controls in both response modes. Broader exact-head checks, builds, CI and fresh independent review follow. No docs, activation or publication. C2 requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapters plus app sinks. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0781d1938c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 8112d9a Fixed Codex CX3/CX4 in 8112d9a. Reference collections are copied from validated indexed data before selection or inspection; proxy/subclass/iterable collections, overridden methods, accessors and symbol aliases reject before use. Detached reference fields stay stable across awaits. Envelope validation examines every own key, including non-enumerable symbols, before native callbacks or metadata copying. 208 result/reference regressions, types and touched lint/import checks passed. Broader exact-head checks and fresh independent review are running alongside CI. No docs, activation or publication. C2 still requires an approved SDK release containing C1, exact pin, capability/policy checks and trusted adapter/app sink certification. |
|
Head: b2319ce Fixed R22-R24 in b2319ce: post-callback nested revalidation, raw-free external protection errors and authenticated post-hook source envelopes. Both new Codex findings are fixed in 8112d9a; all four Codex threads are resolved.
Ledger: 21 P1 and 14 P2 fixed; none rejected or open. Independent review is incomplete. The continuation could not create Full SDK suites were not run locally. Live provider/Cloudflare and D1 serialized-exporter certification were not performed. No docs, activation, merge or package publication. C2 requires an approved SDK release containing C1, an exact pin, version-1 capability/policy checks, and trusted adapter plus app/SSE/replay certification. Unsupported paths remain gated. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2319ce8ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: 7f98179 Refreshed against main c56fc5e. Fixed all three current P1 findings: protected error-handler logs exclude mutable errors/stacks; client-delegated required tools reject before graph execution; canonical messages detach from native callback aliases before state/reference reuse. Default-off and unselected controls are preserved. 240 result/reference tests and separate types passed. Broader exact-head tests, builds, static checks, CI and independent review are running. No docs, activation or publication. C2 still requires an approved SDK release containing C1, an exact pin, capability/policy checks and trusted adapter/app sinks. |
|
Head: b4023f7 Fixed independent IR1 in b4023f7. Settled replay no longer treats checkpoint ownership as envelope protection: message-ID/reference aliases require an SDK release record bound to the exact admitted envelope. Content is still inspected under the current policy. Uncertified legacy aliases, stripped/tampered markers and incompatible marker versions fail closed without rerunning settled tools. 249 result/reference regressions, separate types and touched lint/import checks passed. Exact-head broader tests, builds, CI and independent review are running. The original three P1 threads remain fixed/resolved. No docs, activation or publication; C2 release/pin/capability and adapter/app sink prerequisites remain. |
|
Head: ad55d52 Fixed independent IR2/IR3 in ad55d52. Historical committed results now require SDK release-envelope provenance and current-policy approval before rebuilt checkpoint execution or model reuse, including nested checkpoint state. Legacy or newly incompatible history fails closed without repeating settled tools. Released native errors detach before propagation; callback-added stack/cause/fields cannot escape. 259 result/reference regressions, separate types and touched static checks passed. Exact-head broader tests, builds, CI and independent review are running. The original three P1 threads remain fixed/resolved. No docs, activation or publication; C2 release/pin/capability and trusted adapter/app sink prerequisites remain. |
|
Head: 671f8a5 Completes IR2’s foreground-child coverage. Parent and child checkpoint restoration use the same historical-result gate before pending tools execute; model entry also revalidates history. Legacy/incompatible history fails closed, while certified same-policy history resumes without repeating settled work. IR3’s released-error detachment remains in ad55d52. 261 result/reference regressions, separate types and touched static checks passed. Broader exact-head tests, builds, CI and independent review are running for this head. Review of the superseded ad55d52 head was cancelled, not reported clean. Original three P1 threads remain fixed/resolved. No docs, activation or publication. |
|
Head: d2ea3c8 Fixed independent IR4 in d2ea3c8. Ordinary checkpointed user turns now load and revalidate certified historical receipts after per-run reset and before the new runStepState overwrite. Reused/rebuilt Run controls continue correctly; legacy/newly incompatible history still rejects before model entry. Receipt lookup remains linear in conversation length. 266 result/reference regressions, types and touched static checks passed. Exact-head broader tests, builds, CI and fresh independent review are running. Original three P1 threads remain fixed/resolved. No docs, activation or publication; C2 release/pin/capability and trusted adapter/app sink prerequisites remain. |
|
Head: bbaddec Fixed independent IR5 in bbaddec. Returned message identities and SDK release receipts are committed before ToolNode constructs its checkpoint update. Terminal toolEnd paths no longer depend on another model step to persist receipt data. Direct/host/eager success/error controls verify the checkpoint contains the matching final message ID and resumes without executing the settled tool again. 277 result/reference tests, separate types and touched static checks passed. Broader exact-head tests, builds, CI and independent review are running. Original three P1 threads remain fixed/resolved. No docs, activation or publication; C2 approved release/pin/capability and trusted adapter/app sink prerequisites remain. |
|
Head: 26906a8 Fixed independent IR6 in 26906a8. Nested tool failure extraction now validates an own message data descriptor or detaches an admitted error before reading text. Callback-installed accessors and changed released messages reject terminally without invoking the accessor; admitted failure controls remain canonical. Real SDK tests exercise local, Python and bash runner sinks. 286 result/reference tests, separate types and touched static checks passed. Broader exact-head tests, builds, CI and fresh independent review are running. The original three P1 threads remain fixed/resolved. No docs, activation or publication; C2 release/pin/capability and trusted adapter/app sink prerequisites remain. |
|
Head and independently reviewed SHA: ae14eb0 Independent review: complete, no findings. Source/path review only; the isolated lane ran no tests or builds. Original three P1 threads and all other PR threads are resolved.
No open or rejected findings in this follow-up.
Full SDK suites were not run locally. Live provider/Cloudflare and D1 exporter certification were not performed. No docs, activation, merge or package publication. C2 requires an approved SDK release containing C1, an exact version pin, capability/policy checks and trusted adapter plus app/SSE/replay certification. Unsupported paths remain gated. |
|
@codex review the latest head, final review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ae14eb0bb5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Head: d0de41c Fixed the six current Codex findings in d0de41c: detached dense checkpoint message collections, own-data historical envelopes, certified identity-first selection, renamed protected reference rejection, supplied-history validation before RunStart and removal-aware receipt retention. Repeated IDs, valid cross-process replay and repeated compaction/rebuild controls pass. Exact-head local checks: 691 result/reference/backend tests, 562 lifecycle/provider tests and 335 authority/codec tests passed; one existing benchmark skipped. Types, CJS/ESM/declaration builds, touched lint/import checks and cycles passed. Independent review is running for this exact head. No docs, activation or publication. C2 still requires an approved C1 release/pin, capability/policy checks and trusted adapter/app sink certification. |
|
Head: bd505fc Fixed independent IR8 in bd505fc. Warm/rebuilt resumes admit each message-channel update and its effective history before sidecar restore or graph dispatch, including object/tuple/multiple writes and Overwrite. Raw results for pending selected tools reject before callbacks/checkpoint publication. Allowed human, unselected and certified-result updates preserve reducer/approval behavior. SDK-created resume commands carry private preparation identity, avoiding a duplicate checkpoint round trip; direct Command inputs always preflight. 358 result/reference tests, separate types and touched static checks passed. Broader exact-head tests, builds, CI and fresh independent review are running. All six Codex threads remain fixed/resolved. No docs, activation or publication; C2 release/pin/capability and adapter/app sink prerequisites remain. |
|
Head: cd4837e Fixed independent IR9/IR10 in cd4837e. The SDK’s alternate agentMessages channel now validates supplied, checkpointed and resume-update histories before startup/chain/model inputs, with defensive member-entry admission. Removal controls are copied as validated identity-only commands, kept separate from retained results and applied before final effective-history validation. Disguised result roles and payload-bearing removal controls remain rejected. 382 result/reference regressions, types and touched static checks passed. Real warm/rebuilt multi-agent resume canaries reject before callbacks; allowed alternate histories and ordinary approval/removal controls pass. Broader exact-head checks, CI and fresh independent review are running. No docs, activation or publication; C2 release/pin/capability and adapter/app sink prerequisites remain. |
Summary
Adds default-off
RunConfig.toolResultProtectionfor trusted synchronous text tools. Mandatory awaited inspection precedes callbacks, completion events, references and ToolMessage/model reuse; optional hooks cannot replace it.Selected artifacts, files/media, background outputs, uncertified aliases/tool shells, Cloudflare-native outputs and client delegation remain unsupported and gated. Absent/unselected behavior remains unchanged. No activation, publication or documentation changes.
Latest follow-up
Head:
cd4837ec69000ab31b9f04b12569dbe1caeca622Base/merge-base:
c56fc5eb7d141a25976c1886520ab4dac745ae07(main). Existing PR refreshed without rewriting history.The six new Codex findings are fixed with commit replies: dense detached checkpoint message collections, own-data envelopes, certified identity-first selection, protected reference source validation, supplied-history preflight before startup hooks and bounded receipt retention. All six threads are resolved. Original three P1 threads remain resolved. Independent IR8 is fixed in bd505fc: effective resume message updates validate before graph entry and sidecar restoration on warm/rebuilt runs, including terminal toolEnd paths. Independent IR9/IR10 are fixed in cd4837e: alternate multi-agent message channels preflight before exposure; identity-only removal controls reduce separately without weakening retained-result provenance.
Exact-head verification
tsc --noEmitAll 13 CI checks passed. Exact-head independent review is running; no clean current-head review is claimed yet. Full SDK suites were not run locally. Live provider/Cloudflare and D1 serialized-exporter certification were not performed.
C2 prerequisite
Wait for an approved SDK release containing C1, pin that exact version, require capability/policy version 1, and certify trusted adapters plus app/SSE/replay sinks. Merge alone does not authorize release or activation. Unsupported paths remain gated across rollback/mixed versions.
AI-2213