"note": "Heuristic false-green LEADS, not findings. A finding requires a demonstrated reproduction (surviving mutation via mutation-runner). Do not treat a candidate as a confirmed false green. Coverage-theater leads may include tests that delegate their assertion to a custom helper the classifier does not recognise; verify before acting.",

  "sourceDigest": "sha256:dd810dd48c5bdbc9becd7fcc01dd41a4ca2abf0b2d6f6a545907247f6e3e8361",

  "summary": {

    "filesScanned": 2437,

    "filesScanned": 2438,

    "candidateCount": 16,

    "byMode": {

      "false_green_coverage_theater": 15,

{

  "schemaVersion": "1",

  "repository": "OpenAgentsInc/openagents",

  "sourceDigest": "sha256:8b8a0cd69a97c37f05aad3a00b188183c4aaf167865ab050878a3ea987f5da5d",

  "sourceDigest": "sha256:154444d74279069de014797ee8c9943bc18f625702640bc4dbdb6bd1d5e82f18",

  "surfaces": [

    {

      "id": "app:@openagentsinc/acceptance-runner",

      "oracles": [

        {

          "type": "test",

          "ref": "packages/openagents-cli (37 tracked test files)"

          "ref": "packages/openagents-cli (38 tracked test files)"

        },

        {

          "type": "behavior-contract",

import { startChildGateway } from "./coder-child-gateway.js";

import { writeChildHarnessConfig } from "./coder-child-config.js";

import type { DelegationOutcome } from "./coder-delegate.js";

import { DelegateFleet, DevinHarness, describePrompt, OpencodeHarness } from "./coder-delegate.js";

import {

  DelegateFleet,

  DevinHarness,

  describePrompt,

  firstAvailableChildModel,

  OpencodeHarness,

} from "./coder-delegate.js";

import { fleetPlainLines } from "./coder-fleet.js";

import { runCoderPlain } from "./coder-plain.js";

import type { CoderDelegation } from "./coder-session.js";

  readonly cwd: string;

  /** The session's grant, when it has one. Children spend it by default. */

  readonly grant: ChildGrant | undefined;

  /** Mint a fresh grant, for when the one in hand has expired. */

  readonly refreshGrant?: (() => Promise<ChildGrant | undefined>) | undefined;

}): Promise<DelegationSetup | undefined> {

  const named = options.model ?? process.env["OPENAGENTS_DELEGATE_MODEL"];

  const command = options.command ?? process.env["OPENAGENTS_DELEGATE_COMMAND"];

  let configPath: string | undefined;

  let close: () => Promise<void>;

  // Free and grant-free first. A thread grant lives an hour, has to be minted,

  // and expires under a console that outlives it; the harness's own catalog

  // costs nothing and needs no credential from us. The grant stays as the

  // fallback for a machine whose harness lists none of them.

  const free =

    named === undefined || named.trim().length === 0

      ? await firstAvailableChildModel(command ?? "opencode")

      : undefined;

  if (free !== undefined) {

    const harness = new OpencodeHarness({

      model: free,

      ...(command === undefined ? {} : { command }),

      ...(namedConfig === undefined ? {} : { configPath: namedConfig }),

      autoApprove: options.autoApprove,

    });

    const registry = new CoderTaskRegistry();

    const fleet = new DelegateFleet(registry, harness, {

      maxConcurrent: Math.max(1, options.concurrency),

      cwd: options.cwd,

    });

    return {

      delegation: { registry, fleet, label: `${harness.agent} (${free})` },

      close: () => Promise.resolve(),

    };

  }

  if (named !== undefined && named.trim().length > 0) {

    model = named;

    configPath = namedConfig;

    close = () => Promise.resolve();

  } else if (options.grant !== undefined) {

    const gateway = await startChildGateway(options.grant);

    const gateway = await startChildGateway(options.grant, options.refreshGrant);

    const harnessConfig = writeChildHarnessConfig({

      baseUrl: gateway.baseUrl,

      model: options.grant.model,

          concurrency,

          cwd: process.cwd(),

          grant: childGrant,

          // A thread grant lives an hour; a console does not stop at one. When

          // the grant in hand has expired, another thread is opened and its

          // grant used, so a fan-out started in the afternoon does not fail on

          // a credential minted at breakfast.

          refreshGrant: async () => {

            if (Option.isNone(stored)) return undefined;

            const reopened = await openChildThread({

              origin: endpoint.origin,

              token: Redacted.value(stored.value.token),

              objective: `delegated children of openagents coder in ${workspace.repository}`,

            }).catch(() => undefined);

            return reopened?.kind === "opened" ? reopened.thread.childGrant : undefined;

          },

        }),

      );

 * Resolves once it is listening, because a child launched against a port that

 * is not up yet fails on its first call and reports it as a provider error.

 */

export async function startChildGateway(grant: ChildGrant): Promise<ChildGateway> {

export async function startChildGateway(

  grant: ChildGrant,

  /**

   * Mint a fresh grant, when the one in hand has expired.

   *

   * A thread grant lives an hour and the session that minted it does not. A

   * console open longer than that dispatched four children onto a grant minted

   * at breakfast, and all four came back `grant_expired` — the first sign of

   * which was four failed children rather than anything about the grant.

   *

   * Left out by a caller that has no way to mint another, and the refusal then

   * reaches the child as it did before.

   */

  refresh?: () => Promise<ChildGrant | undefined>,

): Promise<ChildGateway> {

  // The grant in hand, replaced rather than reused once it has expired.

  let current = grant;

  const server = createServer((request, response) => {

    const chunks: Buffer[] = [];

    request.on("data", (chunk: Buffer) => chunks.push(chunk));

    request.on("end", () => {

      void forward(Buffer.concat(chunks).toString("utf8"), grant, response);

      void (async () => {

        const body = Buffer.concat(chunks).toString("utf8");

        const first = await forward(body, current, response, refresh !== undefined);

        if (first !== "grant_expired" || refresh === undefined) return;

        // Once. A second expiry on a grant minted moments ago is a refusal

        // about something else, and retrying it forever would hide that.

        const minted = await refresh().catch(() => undefined);

        if (minted === undefined) {

          await forward(body, current, response, false);

          return;

        }

        current = minted;

        await forward(body, current, response, false);

      })();

    });

  });

  body: string,

  grant: ChildGrant,

  response: import("node:http").ServerResponse,

): Promise<void> {

  /** When set, an expired grant is reported to the caller instead of the child. */

  reportExpiry: boolean,

): Promise<"grant_expired" | undefined> {

  let payload: Record<string, unknown> = {};

  try {

    const parsed: unknown = JSON.parse(body === "" ? "{}" : body);

    // message is the difference between a child that says

    // `budget_exhausted` and three children that say `exited with code 1`.

    const detail = (await upstream.text().catch(() => "")).slice(0, 400);

    if (reportExpiry && upstream.status === 403 && detail.includes("grant_expired")) {

      return "grant_expired";

    }

    response.writeHead(upstream.status, { "content-type": "application/json" });

    response.end(

      JSON.stringify({

        },

      }),

    );

    return;

    return undefined;

  }

  response.writeHead(upstream.status, {

  if (upstream.body === null) {

    response.end();

    return;

    return undefined;

  }

  const reader = upstream.body.getReader();

    response.write(Buffer.from(value));

  }

  response.end();

  return undefined;

}

  }

}

/**

 * The models a child is given, in the order they are preferred.

 *

 * Free and grant-free, both on purpose. A thread grant lives an hour, has to be

 * minted, and expires under a console that outlives it — four children once

 * came back `grant_expired` together — while the harness's own catalog costs

 * nothing and needs no credential from us at all.

 *

 * Resolved against what the harness actually lists, so a name that goes away

 * falls through to the next rather than failing a fan-out.

 */

export const FREE_CHILD_MODELS: ReadonlyArray<string> = [

  "opencode/big-pickle",

  "opencode/gemini-3.7-flash",

  "opencode/gemini-3.6-flash",

  "opencode/gemini-3.5-flash",

];

/**

 * The first preferred model the harness offers, or undefined when it lists none.

 *

 * A listing that cannot be read says nothing rather than guessing, for the same

 * reason the preflight does: a harness whose subcommand differs must not be

 * able to block a fan-out that would have worked.

 */

export async function firstAvailableChildModel(

  command = "opencode",

  preferred: ReadonlyArray<string> = FREE_CHILD_MODELS,

): Promise<string | undefined> {

  const listed = await new Promise<string>((resolve) => {

    const probe = spawn(command, ["models"], { stdio: ["ignore", "pipe", "ignore"] });

    let out = "";

    probe.stdout.setEncoding("utf8");

    probe.stdout.on("data", (chunk: string) => {

      out += chunk;

    });

    probe.on("error", () => resolve(""));

    probe.on("close", () => resolve(out));

  });

  if (listed.trim().length === 0) return undefined;

  const names = new Set(listed.split("\n").map((line) => line.trim()));

  return preferred.find((candidate) => names.has(candidate));

}

export class OpencodeHarness implements DelegateHarness {

  readonly agent = "opencode";

  readonly model: string;

import { request as httpRequest } from "node:http";

import { Redacted } from "effect";

import { describe, expect, it, vi, afterEach } from "vitest";

import { startChildGateway, type ChildGrant } from "../src/coder-child-gateway.js";

const grant = (token: string): ChildGrant => ({

  proxyUrl: "https://openagents.test/api/inference/proxy",

  token: Redacted.make(token),

  model: "ox-alpha",

});

/**

 * Call the gateway over raw HTTP.

 *

 * Not `fetch`: these tests replace `fetch` to stand in for the proxy upstream,

 * and a client that also used it would be answered by the stand-in without the

 * gateway ever running.

 */

const call = async (baseUrl: string): Promise<number> => {

  const url = new URL(`${baseUrl}/chat/completions`);

  return await new Promise<number>((resolve, reject) => {

    const request = httpRequest(

      { hostname: url.hostname, port: url.port, path: url.pathname, method: "POST" },

      (response) => {

        response.resume();

        response.on("end", () => resolve(response.statusCode ?? 0));

      },

    );

    request.on("error", reject);

    request.end(JSON.stringify({ messages: [{ role: "user", content: "hi" }] }));

  });

};

afterEach(() => {

  vi.restoreAllMocks();

});

describe("a child gateway whose grant has expired", () => {

  it("mints another and sends the same request on it", async () => {

    const sentWith: string[] = [];

    vi.spyOn(globalThis, "fetch").mockImplementation(

      // eslint-disable-next-line @typescript-eslint/require-await -- a stand-in upstream

      async (_input, init) => {

        const auth = String((init?.headers as Record<string, string>)?.["authorization"] ?? "");

        sentWith.push(auth);

        // A grant minted an hour ago, then one minted moments ago.

        return auth.includes("stale")

          ? new Response(JSON.stringify({ error: { code: "grant_expired" } }), { status: 403 })

          : new Response(JSON.stringify({ ok: true }), { status: 200 });

      },

    );

    const gateway = await startChildGateway(grant("stale"), async () =>

      Promise.resolve(grant("fresh")),

    );

    const status = await call(gateway.baseUrl);

    // The child sees the answer, not the refusal: four children failing on a

    // credential minted at breakfast is the failure this exists to stop.

    expect(status).toBe(200);

    expect(sentWith.some((auth) => auth.includes("stale"))).toBe(true);

    expect(sentWith.some((auth) => auth.includes("fresh"))).toBe(true);

    await gateway.close();

  });

  it("reports the refusal when no fresh grant can be had", async () => {

    vi.spyOn(globalThis, "fetch").mockImplementation(async () =>

      Promise.resolve(

        new Response(JSON.stringify({ error: { code: "grant_expired" } }), { status: 403 }),

      ),

    );

    const gateway = await startChildGateway(grant("stale"), async () => Promise.resolve(undefined));

    // Reported rather than retried forever.

    expect(await call(gateway.baseUrl)).toBe(403);

    await gateway.close();

  });

  it("does not retry a caller that cannot mint one", async () => {

    let calls = 0;

    vi.spyOn(globalThis, "fetch").mockImplementation(async () => {

      calls += 1;

      return await Promise.resolve(

        new Response(JSON.stringify({ error: { code: "grant_expired" } }), { status: 403 }),

      );

    });

    const gateway = await startChildGateway(grant("stale"));

    await call(gateway.baseUrl);

    expect(calls).toBe(1);

    await gateway.close();

  });

});