"note": "Heuristic false-green LEADS, not findings. A finding requires a demonstrated reproduction (surviving mutation via mutation-runner). Do not treat a candidate as a confirmed false green. Coverage-theater leads may include tests that delegate their assertion to a custom helper the classifier does not recognise; verify before acting.",

  "sourceDigest": "sha256:dd810dd48c5bdbc9becd7fcc01dd41a4ca2abf0b2d6f6a545907247f6e3e8361",

  "summary": {

    "filesScanned": 2483,

    "filesScanned": 2484,

    "candidateCount": 16,

    "byMode": {

      "false_green_coverage_theater": 15,

{

  "schemaVersion": "1",

  "repository": "OpenAgentsInc/openagents",

  "sourceDigest": "sha256:f6441bc52df1b0a94c3842b9ca752847c53ab41dcd78869b2b2bb6a8abdf2d11",

  "sourceDigest": "sha256:ce37c3926fa88f843846d795ee0ff46b2ab151b93d2e3a99ccaade74dc749f43",

  "surfaces": [

    {

      "id": "app:@openagentsinc/acceptance-runner",

      "oracles": [

        {

          "type": "test",

          "ref": "packages/openagents-cli (74 tracked test files)"

          "ref": "packages/openagents-cli (75 tracked test files)"

        },

        {

          "type": "behavior-contract",

import { rebuild, RELOAD_EXIT_CODE, sourceCheckout } from "./coder-reload.js";

import { loadSkillSelection, standingContext } from "./coder-skills.js";

import { startDevServer } from "./coder-dev-server.js";

import { ResponsesReplySource } from "./coder-responses.js";

import { TIER_MODELS, tierForModel, tierUnavailable, type CoderTierId } from "./coder-tiers.js";

import { ZenReplySource, zenCredential } from "./coder-zen.js";

import { describeWorkspace } from "./coder-workspace.js";

      // session at a server on this machine. A deploy can take half an hour,

      // and iterating against a server nobody has deployed to yet is the

      // difference between a change being testable now and after lunch.

      // `--dev` picks the local profile; an explicit `--api-url` beside it

      // still wins, so a session can point at a server on another port.

      const endpoint = yield* resolveApiEndpoint(

        dev

          ? { profile: Option.some("local" as Profile), apiUrl: Option.none() }

          ? { ...endpointOverrides(flags), profile: Option.some("local" as Profile) }

          : endpointOverrides(flags),

      );

      const thread =

        resumed !== undefined

          ? resumed.source

          : Option.isSome(stored) && !wantsOllama && !wantsZen && !resume

          : Option.isSome(stored) && !wantsOllama && !wantsZen && !resume && !dev

            ? yield* Effect.tryPromise({

                try: () =>

                  openThread({

            })

          : undefined;

      // The dev lane answers from the OpenResponses surface on the dev

      // server rather than a grant-bearing thread: today that is the

      // acknowledgement stub, and the point is that this loop is built

      // against the event grammar before a model stands behind it.

      const responsesSource = dev

        ? new ResponsesReplySource({

            origin: endpoint.origin,

            ...(Option.isSome(stored) ? { token: Redacted.value(stored.value.token) } : {}),

          })

        : undefined;

      const source: ReplySource =

        wantsZen && zenAsked !== undefined && zenKey !== undefined

          ? new ZenReplySource({ model: zenAsked, key: zenKey })

          : (ollamaSource ?? thread ?? new DummyReplySource());

          : (responsesSource ?? ollamaSource ?? thread ?? new DummyReplySource());

      // The local lane reports by default (OpenAgentsInc/openagents#39): with

      // a credential and the switch not off, it opens a transcript-only

        session.notice(`This session cannot delegate: ${childThread.reason}`);

      }

      if (Option.isNone(stored) && !offline && !wantsOllama && !wantsZen) {

      // Not on the dev lane: its replies come from the responses surface,

      // with or without a credential, so the stand-in sentence would be false.

      if (Option.isNone(stored) && !offline && !wantsOllama && !wantsZen && !dev) {

        session.notice(

          "No stored credential, so replies come from the built-in stand-in. " +

            `Run \`${loginCommandFor(endpoint)}\` to reach a real model.`,

/**

 * A reply source speaking the OpenResponses surface at `POST /api/v1/responses`.

 *

 * The dev lane's source: `openagents coder --dev` sends each prompt as an

 * OpenResponses request with `stream: true` and renders the semantic events

 * that come back — today, from the server's acknowledgement stub, which

 * answers every prompt "Acknowledged." in two deltas. No model stands behind

 * it yet; the point is that the client-side turn loop is built against the

 * OpenResponses event grammar before a provider is, so swapping the stub for

 * a real loop changes the server and nothing here.

 *

 * Only `response.output_text.delta` is rendered. The rest of the sequence —

 * created, item and part boundaries, completed — is parsed and passed over,

 * which is exactly what the grammar is for: a client reads the events it

 * understands and survives the ones it does not.

 */

import type { ReplyChunk, ReplySource } from "./coder-session.js";

import { tierLabel } from "./coder-tiers.js";

export interface ResponsesOptions {

  /** The API origin, such as `http://localhost:4000`. */

  readonly origin: string;

  /** The account bearer, sent when held; the stub also answers without one. */

  readonly token?: string | undefined;

}

export class ResponsesReplySource implements ReplySource {

  constructor(private readonly options: ResponsesOptions) {}

  /** The dev lane defers to the server, which is what Coder Auto names. */

  get model(): string {

    return tierLabel("auto");

  }

  /** The product id: no vendor stands behind the stub, so none is named. */

  get modelId(): string {

    return "openagents-coder";

  }

  async *reply(prompt: string, signal: AbortSignal): AsyncIterable<ReplyChunk> {

    const response = await fetch(new URL("/api/v1/responses", this.options.origin), {

      method: "POST",

      headers: {

        ...(this.options.token === undefined

          ? {}

          : { authorization: `Bearer ${this.options.token}` }),

        "content-type": "application/json",

        // Both named: the pipeline negotiates on json, the answer is SSE.

        accept: "text/event-stream, application/json",

      },

      body: JSON.stringify({ input: prompt, stream: true }),

      signal,

    });

    if (!response.ok || response.body === null) {

      throw new Error(

        `The responses API at ${this.options.origin} answered HTTP ${String(response.status)}.`,

      );

    }

    let calls = 0;

    for await (const data of frames(response.body, signal)) {

      const event = parse(data);

      if (event === undefined) continue;

      if (event["type"] === "response.output_text.delta") {

        const delta = event["delta"];

        if (typeof delta === "string" && delta.length > 0) {

          yield { type: "text", value: delta };

        }

      }

      if (event["type"] === "response.completed") calls += 1;

    }

    yield { type: "usage", promptTokens: 0, completionTokens: 0, calls: Math.max(calls, 1) };

  }

}

/** Each SSE frame's `data:` payload, in order. */

async function* frames(

  body: ReadableStream<Uint8Array>,

  signal: AbortSignal,

): AsyncIterable<string> {

  const decoder = new TextDecoder();

  const reader = body.getReader();

  let buffer = "";

  try {

    for (;;) {

      const { done, value } = await reader.read();

      if (done || signal.aborted) break;

      buffer += decoder.decode(value, { stream: true });

      for (;;) {

        const boundary = buffer.indexOf("\n\n");

        if (boundary < 0) break;

        const frame = buffer.slice(0, boundary);

        buffer = buffer.slice(boundary + 2);

        for (const line of frame.split("\n")) {

          if (line.startsWith("data: ")) yield line.slice(6);

        }

      }

    }

  } finally {

    reader.releaseLock();

  }

}

const parse = (data: string): Record<string, unknown> | undefined => {

  try {

    const value: unknown = JSON.parse(data);

    return value !== null && typeof value === "object"

      ? (value as Record<string, unknown>)

      : undefined;

  } catch {

    return undefined;

  }

};

import { afterEach, describe, expect, it, vi } from "vitest";

import { ResponsesReplySource } from "../src/coder-responses.js";

import type { ReplyChunk } from "../src/coder-session.js";

const sse = (frames: ReadonlyArray<string>) =>

  new Response(

    new ReadableStream<Uint8Array>({

      start(controller) {

        const encoder = new TextEncoder();

        for (const frame of frames) controller.enqueue(encoder.encode(frame));

        controller.close();

      },

    }),

    { status: 200, headers: { "content-type": "text/event-stream" } },

  );

/** The stub's own sequence, as the server sends it. */

const STREAM = [

  'event: response.created\ndata: {"type":"response.created","sequence_number":0}\n\n',

  'event: response.output_text.delta\ndata: {"type":"response.output_text.delta","sequence_number":1,"delta":"Acknow"}\n\n',

  'event: response.output_text.delta\ndata: {"type":"response.output_text.delta","sequence_number":2,"delta":"ledged."}\n\n',

  'event: response.completed\ndata: {"type":"response.completed","sequence_number":3}\n\n',

];

afterEach(() => {

  vi.unstubAllGlobals();

});

const collect = async (source: ResponsesReplySource) => {

  const out: ReplyChunk[] = [];

  for await (const chunk of source.reply("hello", new AbortController().signal)) out.push(chunk);

  return out;

};

describe("ResponsesReplySource", () => {

  it("streams the request and concatenates the deltas it is sent", async () => {

    const calls: Array<{ url: string; body: Record<string, unknown>; accept: string }> = [];

    vi.stubGlobal(

      "fetch",

      vi.fn(async (target: URL | string, init?: RequestInit) => {

        const headers = (init?.headers ?? {}) as Record<string, string>;

        calls.push({

          url: target.toString(),

          body: JSON.parse(typeof init?.body === "string" ? init.body : "{}") as Record<

            string,

            unknown

          >,

          accept: headers["accept"] ?? "",

        });

        return sse(STREAM);

      }),

    );

    const source = new ResponsesReplySource({ origin: "http://localhost:4000", token: "oa_pat_x" });

    const chunks = await collect(source);

    expect(calls[0]?.url).toBe("http://localhost:4000/api/v1/responses");

    expect(calls[0]?.body).toEqual({ input: "hello", stream: true });

    // Both named: the pipeline negotiates on json, the answer is SSE.

    expect(calls[0]?.accept).toContain("application/json");

    const text = chunks

      .map((chunk) => (chunk.type === "text" ? chunk.value : ""))

      .join("");

    expect(text).toBe("Acknowledged.");

    expect(chunks.at(-1)).toMatchObject({ type: "usage", calls: 1 });

  });

  it("labels itself as Coder Auto and records the product id", () => {

    const source = new ResponsesReplySource({ origin: "http://localhost:4000" });

    expect(source.model).toBe("Coder Auto");

    expect(source.modelId).toBe("openagents-coder");

  });

  it("reports a refusal with the origin and the status", async () => {

    vi.stubGlobal("fetch", vi.fn(async () => new Response("no", { status: 503 })));

    const source = new ResponsesReplySource({ origin: "http://localhost:4000" });

    await expect(collect(source)).rejects.toThrow("http://localhost:4000 answered HTTP 503");

  });

});