supercode-harness 0.4.13

The optional native Supercode agent and tool harness
Documentation
//! PARITY-9 dev/01/dev/03: a GENUINE, committed real-Codex corpus, so the
//! "audited real rollout" (dev/01) and "diagonal no-loss holds over real
//! sessions" (dev/03) closures are reproducible from a clean clone, not just
//! runtime-only on the machine that happened to provision them.
//!
//! Provenance of the three fixtures below (`codex_real_rollout_*.jsonl`):
//! each was written by the REAL, installed `codex` CLI (`codex-cli 0.142.5`)
//! running its genuine engine — sandboxing, tool-calling loop, rollout
//! writer — fully OFFLINE against a local Responses-API stub
//! (`scripts/codex-real-corpus/stub_server.py`) standing in for
//! `[model_providers.local]`, with a dummy `env_key` and no ChatGPT auth or
//! paid API key involved anywhere in the loop. The stub's wire shape was
//! reverse-engineered by pointing a real `codex exec` at a logging probe
//! first (`scripts/codex-real-corpus/probe_server.py`), not guessed. Full
//! reproduction recipe: `docs/interop/codex-real-corpus-provisioning.md`.
//! None of the three files below were hand-edited after codex wrote them;
//! content is stub-canned model text (deterministic strings like
//! `"echo round1"`), so there is no privacy concern in committing them
//! verbatim.
//!
//! Three genuine record-type shapes, chosen to maximize coverage:
//! - `codex_real_rollout_compacted.jsonl` — a real `compacted` record
//!   (codex's own remote-compaction path, forced by a deliberately tiny
//!   `model_context_window`/`model_auto_compact_token_limit` override) with
//!   real `window_id`/`first_window_id`/`previous_window_id`/
//!   `replacement_history` fields, plus `response_item/reasoning` (a
//!   genuinely non-null `encrypted_content` blob) and a
//!   `function_call`/`function_call_output` pair (`exec_command`: `ls -la`,
//!   `pwd`).
//! - `codex_real_rollout_tools.jsonl` — three genuine
//!   `reasoning`+`function_call`(`exec_command`)+`function_call_output`
//!   triples in one session (`echo round1`/`round2`/`round3`), the richest
//!   function-call/reasoning coverage of the batch.
//! - `codex_real_rollout_patch.jsonl` — a real `apply_patch <<'PATCH' ...
//!   PATCH` invocation via `exec_command` (codex's own
//!   apply-patch-via-shell-heredoc convention) that genuinely wrote
//!   `corpus_probe.txt` to disk, alongside `reasoning` (non-null
//!   `encrypted_content`) and a `function_call`/`function_call_output` pair.
//!
//! This corpus is committed ALONGSIDE (never replacing)
//! `codex_session.jsonl`/`codex_session_eventmsg*.jsonl` and the existing
//! `SUPERCODE_CORPUS`-gated
//! `parity9_dev03_diagonal_holds_over_ten_real_codex_sessions`
//! (`crates/cli/tests/codex_fidelity_cli.rs`), which is untouched by this
//! file and stays the "at least ten, from whatever live `~/.codex/sessions`
//! corpus this machine happens to have" breadth check. These three fixtures
//! give the durable, always-available version of the same proof shape, with
//! no live corpus or `SUPERCODE_CORPUS=1` required — every test below runs
//! unconditionally.

use std::path::{Path, PathBuf};

use supercode_harness::audit::{audit_dir, Corpus, Coverage};
use supercode_harness::session::{Session, SessionFormat};
use supercode_harness::Role;

fn fixture(name: &str) -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR"))
        .join("tests/fixtures")
        .join(name)
}

const REAL_CORPUS_FILES: [&str; 3] = [
    "codex_real_rollout_compacted.jsonl",
    "codex_real_rollout_tools.jsonl",
    "codex_real_rollout_patch.jsonl",
];

/// Strip the `to_native_jsonl`/`to_native_jsonl_v2` envelope header line —
/// mirrors the CLI's own diagonal-check convention (`codex_fidelity_cli.rs`
/// compares raw file bytes directly via the CLI's `convert`, which has no
/// such header; this test exercises the library-level `to_native_jsonl()`
/// entry point instead, which does emit one).
fn strip_native_header(native: &str) -> &str {
    let idx = native
        .find('\n')
        .expect("native output must have a header line");
    &native[idx + 1..]
}

// ---- dev/01: three REAL codex sessions load with expected message counts -

#[test]
fn codex_real_corpus_three_sessions_load_with_expected_message_counts() {
    // Counts confirmed against the real, installed codex CLI's own rollout
    // output (via `supercode inspect --json` on each fixture) — see
    // docs/interop/codex-real-corpus-provisioning.md for how these three
    // were produced.
    let expected: [(&str, usize); 3] = [
        ("codex_real_rollout_compacted.jsonl", 5),
        ("codex_real_rollout_tools.jsonl", 10),
        ("codex_real_rollout_patch.jsonl", 6),
    ];
    assert_eq!(
        expected.len(),
        REAL_CORPUS_FILES.len(),
        "keep the summary table and the file list in sync"
    );

    for (name, expected_count) in expected {
        let session = Session::from_codex(fixture(name)).expect("real codex fixture must load");
        assert_eq!(
            session.messages.len(),
            expected_count,
            "{name}: unexpected message count: {:?}",
            session.messages
        );
        println!(
            "{name}: {} messages, {} tool calls — REAL codex-engine output",
            session.messages.len(),
            session
                .messages
                .iter()
                .map(|m| m.tool_calls().len())
                .sum::<usize>(),
        );
    }
}

#[test]
fn codex_real_corpus_directory_audit_has_zero_gaps_over_genuine_output() {
    let tmp =
        std::env::temp_dir().join(format!("sc-codex-real-corpus-audit-{}", std::process::id()));
    std::fs::create_dir_all(&tmp).unwrap();
    for name in REAL_CORPUS_FILES {
        std::fs::copy(fixture(name), tmp.join(name)).unwrap();
    }

    let report = audit_dir(&tmp, Corpus::Codex, None);
    assert_eq!(report.files, REAL_CORPUS_FILES.len() as u64);
    assert_eq!(report.parse_errors, 0);
    assert!(
        report
            .records
            .keys()
            .all(|k| !k.starts_with("<line>/") && !k.contains("Unknown")),
        "3 genuine codex-engine sessions must hit zero unknown-record buckets: {:?}",
        report.records.keys().collect::<Vec<_>>()
    );

    std::fs::remove_dir_all(&tmp).ok();
}

/// dev/03 core assertion, at the audit level: `response_item/reasoning` is
/// reported `Retained` (not silently dropped — N1/N2, see `Coverage::
/// Retained`'s doc comment), and the genuine `compacted` record from
/// `codex_real_rollout_compacted.jsonl` is reported `Normalized` (its
/// `replacement_history` actually replaces prior turns on load, not just
/// noted).
#[test]
fn codex_real_corpus_audit_reports_reasoning_retained_and_compacted_normalized() {
    let tmp = std::env::temp_dir().join(format!(
        "sc-codex-real-corpus-audit2-{}",
        std::process::id()
    ));
    std::fs::create_dir_all(&tmp).unwrap();
    for name in REAL_CORPUS_FILES {
        std::fs::copy(fixture(name), tmp.join(name)).unwrap();
    }

    let report = audit_dir(&tmp, Corpus::Codex, None);

    let (reasoning_cov, reasoning_tally) = report
        .records
        .get("response_item/reasoning")
        .expect("all 3 genuine sessions carry response_item/reasoning items");
    assert_eq!(
        *reasoning_cov,
        Coverage::Retained,
        "reasoning must be reported Retained, not Dropped/Unmodeled — this is the N1/N2 gap \
         this real corpus proves is fixed"
    );
    assert!(
        reasoning_tally.count >= 5,
        "expected at least 5 reasoning items across the 3 real sessions, got {}",
        reasoning_tally.count
    );

    let (compacted_cov, compacted_tally) = report
        .records
        .get("compacted")
        .expect("codex_real_rollout_compacted.jsonl carries a genuine compacted record");
    assert_eq!(
        *compacted_cov,
        Coverage::Normalized,
        "the genuine compacted record must be Normalized (replacement_history actually \
         replaces prior turns), not merely Retained/Dropped"
    );
    assert_eq!(compacted_tally.count, 1);

    std::fs::remove_dir_all(&tmp).ok();
}

// ---- turn-type coverage: reasoning/encrypted_content, real tool pairs, apply_patch --

#[test]
fn codex_real_corpus_reasoning_encrypted_content_is_captured_on_the_next_assistant_turn() {
    // codex_real_rollout_patch.jsonl: response_item/reasoning (non-null
    // encrypted_content) immediately precedes the exec_command function_call
    // that carries the real apply_patch invocation. `Session::from_codex`
    // threads that reasoning's presence-of-encrypted-content flag onto the
    // NEXT assistant ChatMessage's metadata (`audit.rs`'s `Coverage::
    // Retained` doc comment, the `Reasoning` arm of `audit_codex_item`).
    let session = Session::from_codex(fixture("codex_real_rollout_patch.jsonl")).unwrap();
    let patch_call = session
        .messages
        .iter()
        .find(|m| {
            m.role == Role::Assistant
                && m.tool_calls()
                    .iter()
                    .any(|c| c.function.name == "exec_command")
        })
        .expect("the real apply_patch-carrying exec_command turn");
    assert_eq!(
        patch_call
            .metadata
            .get("reasoning_encrypted")
            .map(String::as_str),
        Some("true"),
        "the reasoning item ahead of this real apply_patch call had a genuinely non-null \
         encrypted_content blob, and that must be captured onto this turn's metadata: {:?}",
        patch_call.metadata
    );
    let args = patch_call
        .tool_calls()
        .iter()
        .find(|c| c.function.name == "exec_command")
        .unwrap()
        .function
        .parsed_arguments()
        .unwrap();
    let cmd = args["cmd"].as_str().unwrap_or_default();
    assert!(
        cmd.contains("apply_patch <<'PATCH'") && cmd.contains("corpus_probe.txt"),
        "this must be the genuine apply_patch heredoc codex's own engine emitted, not a \
         paraphrase: {cmd:?}"
    );
}

#[test]
fn codex_real_corpus_tools_session_has_three_genuine_exec_command_round_trips() {
    let session = Session::from_codex(fixture("codex_real_rollout_tools.jsonl")).unwrap();
    let exec_calls: Vec<&str> = session
        .messages
        .iter()
        .flat_map(|m| m.tool_calls())
        .filter(|c| c.function.name == "exec_command")
        .map(|c| c.id.as_str())
        .collect();
    assert_eq!(
        exec_calls.len(),
        3,
        "expected 3 real exec_command calls in this session: {:?}",
        session.messages
    );
    for call_id in &exec_calls {
        assert!(
            session
                .messages
                .iter()
                .any(|m| m.role == Role::Tool && m.tool_call_id.as_deref() == Some(*call_id)),
            "call {call_id} must have a paired function_call_output tool message"
        );
    }
}

#[test]
fn codex_real_corpus_compacted_session_replacement_history_replaces_prior_turns() {
    // The compacted record's `message` field ("Another language model
    // started to solve this problem...") is codex's own real
    // remote-compaction summary text, injected by `Session::from_codex` in
    // place of the turns it replaced — proving `replacement_history` isn't
    // just noted, it actually drives the loaded conversation.
    let session = Session::from_codex(fixture("codex_real_rollout_compacted.jsonl")).unwrap();
    let has_compaction_summary = session.messages.iter().any(|m| {
        m.content
            .as_deref()
            .unwrap_or("")
            .contains("Another language model started to solve this problem")
    });
    assert!(
        has_compaction_summary,
        "the compacted record's own summary text must surface in the loaded conversation: {:?}",
        session.messages
    );
}

// ---- native round-trip: byte-lossless on all three genuine files ----------

#[test]
fn codex_real_corpus_native_round_trip_is_byte_lossless_for_all_three() {
    for name in REAL_CORPUS_FILES {
        let path = fixture(name);
        let original = std::fs::read(&path).unwrap();
        let session = Session::from_codex(&path).unwrap();
        let native = session.to_native_jsonl();
        let body = strip_native_header(&native);
        assert_eq!(
            body.as_bytes(),
            original.as_slice(),
            "{name}: native round-trip must reproduce genuine codex-engine bytes exactly"
        );
        assert_eq!(session.raw_verbatim().as_bytes(), original.as_slice());
    }
}

/// NOTE: unlike `codex_fidelity_cli.rs`'s `parity9_diagonal_preserves_
/// every_record_type_byte_for_byte` (which exercises the CLI `convert`
/// command's spliced/raw-preserving same-format path and so is genuinely
/// byte-identical), this test calls `Session::to_jsonl` directly — the
/// full-synthesis writer, which regenerates output and is NOT guaranteed
/// byte-identical to the source even for a same-format hop. True
/// byte-identity for these three real files is already covered separately by
/// `codex_real_corpus_native_round_trip_is_byte_lossless_for_all_three`
/// above (via `raw_verbatim`). This test's actual job is narrower: prove the
/// full-synthesis writer's same-format diagonal reloads cleanly with the
/// same message count, not that it reproduces the original bytes.
#[test]
fn codex_real_corpus_same_format_to_jsonl_diagonal_reloads_and_preserves_message_count() {
    for name in REAL_CORPUS_FILES {
        let path = fixture(name);
        let original = std::fs::read_to_string(&path).unwrap();
        let session = Session::from_codex(&path).unwrap();
        let out = session.to_jsonl(SessionFormat::Codex).unwrap();
        let reloaded = Session::load_str(&out, SessionFormat::Codex)
            .unwrap_or_else(|e| panic!("{name}: same-format writer output must reload: {e}"));
        assert_eq!(
            reloaded.messages.len(),
            session.messages.len(),
            "{name}: same-format diagonal must preserve message count"
        );
        assert!(!original.trim().is_empty());
    }
}

// ---- dev/03: Codex -> {Claude Code, Codex} exit cleanly and stay replayable --

#[test]
fn codex_real_corpus_all_three_convert_to_claude_code_and_codex_and_stay_replayable() {
    for name in REAL_CORPUS_FILES {
        let session = Session::from_codex(fixture(name)).unwrap();
        let source_user_texts: Vec<String> = session
            .messages
            .iter()
            .filter(|m| m.role == Role::User)
            .filter_map(|m| m.content.clone())
            .collect();
        assert!(
            !source_user_texts.is_empty(),
            "{name}: fixture must have user turns to check replay"
        );

        for target in [SessionFormat::ClaudeCode, SessionFormat::Codex] {
            let out = session
                .to_jsonl(target)
                .unwrap_or_else(|e| panic!("{name} -> {target:?} must exit cleanly: {e}"));
            assert!(
                !out.trim().is_empty(),
                "{name} -> {target:?}: output must be non-empty"
            );

            let reloaded = Session::load_str(&out, target).unwrap_or_else(|e| {
                panic!("{name} -> {target:?}: writer output must itself reload cleanly: {e}")
            });
            for text in &source_user_texts {
                let found = reloaded.messages.iter().any(|m| {
                    m.content
                        .as_deref()
                        .map(|c| c.contains(text.as_str()))
                        .unwrap_or(false)
                });
                assert!(
                    found,
                    "{name} -> {target:?}: source user text {text:?} must still be present and \
                     replayable after round-tripping through the writer + that format's own \
                     loader"
                );
            }
        }
    }
}