fix: 50+ fixes across recorder, providers, CI, competitive matrix (#133)

## Summary

Addresses all bucket (c) and (d) items from PR #122's 7-agent CR, plus
correctness issues discovered during this PR's own iterative CR process
(6 rounds, 4 fix cycles).

### Server core
- `readBody` 10MB size limit (DoS surface closed)
- Control API: error detail in responses, one-shot race fix (synchronous
splice), fixtures_loaded gauge updates on mutations
- `normalizeCompatPath` magic number replaced with readable expression
- `source` field ("fixture" | "proxy") added to JournalEntry type

### Recorder correctness
- Crash hardening: `headersSent` guards, `clientDisconnected` tracking,
encoding_format logging
- Content+toolCalls: preserve both (previously dropped content)
- Cohere v2 native detection branch in `buildFixtureResponse`
- Tool-call IDs preserved from 5 provider formats
- Reasoning/thinking extracted from 4 provider formats (including
tool-call-only)
- Multi-block text: `filter+join` instead of `find`
(Anthropic/Gemini/Bedrock)
- Thinking-only Anthropic responses handled (not error fixture)
- Empty-content responses recorded correctly (not error fixture)
- Ollama `/api/generate` format detection
- Streaming collapse reasoning propagated

### Provider handlers
- **Bedrock/Converse**: ContentWithToolCallsResponse guards,
ResponseOverrides wired into all builders + streaming, Converse-wrapped
stream format (matches collapse parser), `text_delta` type field,
Converse error envelope, webSearches warnings
- **Cohere v2**: reasoning in all builders + streaming, webSearches
warnings, response_format forwarding, assistant tool_calls preservation,
full ResponseOverrides (finish_reason, usage, id)
- **Ollama**: ContentWithToolCallsResponse, default stream:true, field
validation
- **Gemini**: tool_call_id collision fix (shared callCounter),
thought-part filtering
- **All**: journal source field on proxy paths, Azure embedding routing

### Competitive matrix pipeline
- `computeChanges` matches actual HTML structure (span class="no")
- `applyChanges` regex matches actual td>span structure
- `updateProviderCounts` scoped to competitor column (not global)
- `extractFeatures` tightened keyword patterns
- Added mokksy/ai-mocks competitor

### CI + framework
- `--auto` instead of `--admin` on fix-drift merge
- Slack secrets via env vars across 5 workflows
- Script injection prevention in notify-pr.yml (env vars + jq)
- Portable `grep -oE`, SLACK_WEBHOOK guards
- Router: RegExp `g`-flag `lastIndex` reset
- Jest/Vitest: save/restore pre-existing env vars, loadFixtures warnings

## Test plan
- [ ] 2573/2573 tests passing (69 test files)
- [ ] TSC clean
- [ ] Prettier + ESLint clean
- [ ] 0 merge conflicts with main
- [ ] 6 CR rounds converged (R1-R4 on original, R1-R6 on additions)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: jpr5

.github/workflows/fix-drift.yml

@@ -119,7 +119,8 @@ jobs:
         if: success() && steps.check.outputs.skip != 'true'
         run: |
           npx tsx scripts/fix-drift.ts --create-pr 2>&1 | tee /tmp/pr-output.txt
-          PR_URL=$(grep -oP 'https://github.com/[^ ]+/pull/\d+' /tmp/pr-output.txt | head -1)
+          PR_URL=$(grep -oE 'https://github.com/[^ ]+/pull/[0-9]+' /tmp/pr-output.txt | head -1)
+          if [ -z "$PR_URL" ]; then echo "No PR URL found"; exit 1; fi
           echo "url=$PR_URL" >> $GITHUB_OUTPUT
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -129,7 +130,7 @@ jobs:
         if: success() && steps.pr.outputs.url != ''
         run: |
           PR_URL="${{ steps.pr.outputs.url }}"
-          gh pr merge "$PR_URL" --merge --admin
+          gh pr merge "$PR_URL" --merge --auto
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -144,15 +145,19 @@ jobs:
       - name: Notify Slack on fix success
         if: success() && steps.pr.outputs.url != ''
         run: |
-          curl -s -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
+          curl -s -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
             -d "{\"text\":\"✅ *Drift auto-fixed and merged*\nPR: ${{ steps.pr.outputs.url }}\nRun: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}\"}"
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
       # Step 8: Slack notification on fix failure
       - name: Notify Slack on fix failure
         if: failure() && steps.check.outputs.skip != 'true'
         run: |
-          curl -s -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
+          curl -s -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
             -d "{\"text\":\"❌ *Drift auto-fix failed* — issue created\nRun: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}\"}"
         env:

.github/workflows/notify-pr.yml

@@ -7,11 +7,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify Slack
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_NUM: ${{ github.event.pull_request.number }}
         run: |
-          PR_TITLE="${{ github.event.pull_request.title }}"
-          PR_URL="${{ github.event.pull_request.html_url }}"
-          PR_AUTHOR="${{ github.event.pull_request.user.login }}"
-          PR_NUM="${{ github.event.pull_request.number }}"
-          curl -sf -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
+          PAYLOAD=$(jq -n \
+            --arg text "New PR #${PR_NUM} on aimock by *${PR_AUTHOR}*: <${PR_URL}|${PR_TITLE}>" \
+            '{text: $text}')
+          curl -sf -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
-            -d "{\"text\": \"🔀 New PR #${PR_NUM} on aimock by *${PR_AUTHOR}*: <${PR_URL}|${PR_TITLE}>\"}"
+            -d "$PAYLOAD"

.github/workflows/publish-release.yml

@@ -96,7 +96,10 @@ jobs:
       - name: Notify Slack
         if: steps.check.outputs.published == 'false'
         run: |
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
           VERSION="v${{ steps.check.outputs.version }}"
-          curl -s -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          curl -s -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
             -d "{\"text\":\"📦 *@copilotkit/aimock ${VERSION} published*\nnpm: https://www.npmjs.com/package/@copilotkit/aimock/v/${{ steps.check.outputs.version }}\nRelease: https://github.com/${{ github.repository }}/releases/tag/${VERSION}\"}"
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/test-drift.yml

@@ -79,7 +79,7 @@ jobs:
       - name: Notify Slack
         if: always()
         run: |
-          if [ -z "${{ secrets.SLACK_WEBHOOK }}" ]; then exit 0; fi
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
 
           PREV="${{ steps.prev.outputs.conclusion }}"
           NOW="${{ job.status }}"
@@ -102,7 +102,7 @@ jobs:
             exit 0
           fi
 
-          curl -s -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          curl -s -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
             -d "{\"text\": \"${EMOJI} ${MSG}\"}"
         env:

.github/workflows/update-competitive-matrix.yml

@@ -58,6 +58,7 @@ jobs:
       - name: Notify Slack
         if: always()
         run: |
+          if [ -z "$SLACK_WEBHOOK" ]; then echo "SLACK_WEBHOOK not set, skipping"; exit 0; fi
           if [ "${{ steps.changes.outputs.changed }}" = "true" ]; then
             EMOJI="📊"
             MSG="*Competitive matrix changes detected* — PR created with updated migration pages. <https://github.com/CopilotKit/aimock/actions/runs/${{ github.run_id }}|View run>"
@@ -68,6 +69,8 @@ jobs:
             EMOJI="❌"
             MSG="*Competitive matrix update failed*. <https://github.com/CopilotKit/aimock/actions/runs/${{ github.run_id }}|View run>"
           fi
-          curl -s -X POST "${{ secrets.SLACK_WEBHOOK }}" \
+          curl -s -X POST "$SLACK_WEBHOOK" \
             -H "Content-Type: application/json" \
             -d "{\"text\": \"${EMOJI} ${MSG}\"}"
+        env:
+          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

CHANGELOG.md

@@ -1,23 +1,33 @@
 # @copilotkit/aimock
 
-## 1.15.0
+## 1.15.1
 
-### Added
+### Fixed
 
-- Chaos injection in proxy mode: drop and disconnect fire pre-flight (upstream is never
-  contacted), malformed proxies the request then corrupts the response body before
-  delivering it to the client.
-- SSE streaming bypass: when upstream responds with `text/event-stream`, malformed chaos
-  is silently skipped (bytes are already on the wire). A bypass metric
-  (`aimock_chaos_bypassed_total`) is emitted so operators can see the configured action
-  did not fire; the normal `aimock_chaos_triggered_total` counter does not increment.
-- Chaos source label (`fixture` vs `proxy`) on Prometheus metrics and journal entries,
-  distinguishing where the chaos decision was made.
-- CORS `Access-Control-Allow-Headers` now includes `X-Aimock-Chaos-Drop`,
-  `X-Aimock-Chaos-Malformed`, `X-Aimock-Chaos-Disconnect`, and `X-Test-Id`, enabling
-  browser-based clients to send per-request chaos overrides via preflight-safe headers.
-- `handleVideoStatus` (`GET /v1/videos/:id`) now evaluates chaos before returning video
-  state, consistent with all other handler endpoints.
+- **Recorder**: crash hardening (headersSent guards, clientDisconnected tracking),
+  preserve content alongside toolCalls, Cohere v2 native detection, tool-call ID
+  extraction from 5 providers, reasoning/thinking extraction from 4 providers,
+  multi-block text join (filter+join instead of find), thinking-only and empty-content
+  response handling, Ollama /api/generate format detection, streaming collapse
+  reasoning propagation.
+- **Bedrock/Converse**: ContentWithToolCallsResponse support, ResponseOverrides wired
+  into all non-streaming and streaming builders, Converse-wrapped stream event format,
+  text_delta type field on text deltas, proper error envelope on Converse errors,
+  webSearches warnings.
+- **Cohere v2**: reasoning in all builders + streaming, webSearches warnings,
+  response_format forwarding, assistant tool_calls preservation, full
+  ResponseOverrides (finish_reason, usage, id) in non-streaming and streaming paths.
+- **Server**: readBody 10MB size limit, control API error detail, one-shot error fixture
+  race fix, normalizeCompatPath clarity, fixtures_loaded gauge updates on mutations.
+- **Competitive matrix**: HTML pipeline fixed (computeChanges, applyChanges,
+  updateProviderCounts, extractFeatures all aligned with actual DOM structure).
+- **CI workflows**: --auto merge (respects branch protection), Slack secrets via env
+  vars, script injection prevention in notify-pr.yml, portable grep.
+- **Router**: RegExp g-flag lastIndex reset prevents alternating match/no-match.
+- **Jest/Vitest**: save/restore pre-existing env vars in afterAll, loadFixtures
+  console.warn on failure.
+- **Gemini**: tool_call_id collision fix (shared callCounter), thought-part filtering.
+- **Ollama**: ContentWithToolCallsResponse support, default stream:true, field validation.
 
 ## 1.14.9
 

docs/chaos-testing/index.html

@@ -69,10 +69,7 @@ <h2>Failure Modes</h2>
               <td>HTTP 500</td>
               <td>
                 Returns a 500 error with
-                <code
-                  >{"error":{"message":"Chaos: request
-                  dropped","type":"server_error","code":"chaos_drop"}}</code
-                >
+                <code>{"error":{"message":"Chaos: request dropped","code":"chaos_drop"}}</code>
               </td>
             </tr>
             <tr>
@@ -207,7 +204,7 @@ <h2>Per-Request Headers</h2>
     <span class="str">"Content-Type"</span>: <span class="str">"application/json"</span>,
     <span class="str">"x-aimock-chaos-disconnect"</span>: <span class="str">"1.0"</span>,
   },
-  <span class="prop">body</span>: <span class="fn">JSON.stringify</span>({ <span class="prop">model</span>: <span class="str">"gpt-4"</span>, <span class="prop">messages</span>: [{ <span class="prop">role</span>: <span class="str">"user"</span>, <span class="prop">content</span>: <span class="str">"hello"</span> }] }),
+  <span class="prop">body</span>: <span class="fn">JSON.stringify</span>({ <span class="prop">model</span>: <span class="str">"gpt-4"</span>, <span class="prop">messages</span>: [...] }),
 });</code></pre>
         </div>
 
@@ -220,7 +217,7 @@ <h2>CLI Flags</h2>
               <div class="code-block-header">
                 CLI chaos flags <span class="lang-tag">shell</span>
               </div>
-              <pre><code>$ npx -p @copilotkit/aimock aimock --fixtures ./fixtures \
+              <pre><code>$ npx -p @copilotkit/aimock llmock --fixtures ./fixtures \
   --chaos-drop 0.1 \
   --chaos-malformed 0.05 \
   --chaos-disconnect 0.02</code></pre>
@@ -242,55 +239,6 @@ <h2>CLI Flags</h2>
           </div>
         </div>
 
-        <h2>Proxy Mode</h2>
-        <p>
-          When aimock is configured as a record/replay proxy (<code>--record</code>), chaos applies
-          to proxied requests too &mdash; so a staging environment pointed at real upstream APIs
-          still sees the failure modes your tests expect. Chaos is rolled <em>once per request</em>,
-          after fixture matching, with the same headers&nbsp;&gt;&nbsp;fixture&nbsp;&gt;&nbsp;server
-          precedence.
-        </p>
-        <table class="endpoint-table">
-          <thead>
-            <tr>
-              <th>Mode</th>
-              <th>When upstream is contacted</th>
-              <th>What the client sees</th>
-            </tr>
-          </thead>
-          <tbody>
-            <tr>
-              <td><code>drop</code></td>
-              <td>Never &mdash; upstream not contacted</td>
-              <td>HTTP 500 chaos body; upstream is not called</td>
-            </tr>
-            <tr>
-              <td><code>disconnect</code></td>
-              <td>Never &mdash; upstream not contacted</td>
-              <td>Connection destroyed; upstream is not called</td>
-            </tr>
-            <tr>
-              <td><code>malformed</code></td>
-              <td>Called &mdash; post-response</td>
-              <td>
-                Request proxies normally; the upstream response is captured, then the body is
-                replaced with invalid JSON before relay. The recorded fixture (if recording) keeps
-                the real upstream response &mdash; chaos is a live-traffic decoration, not a fixture
-                mutation.
-              </td>
-            </tr>
-          </tbody>
-        </table>
-        <p>
-          <strong>SSE bypass.</strong> If upstream returns
-          <code>Content-Type: text/event-stream</code>, aimock streams chunks to the client
-          progressively. By the time <code>malformed</code> would fire, the bytes are already on the
-          wire &mdash; the chaos action cannot be applied. This bypass is observable via the
-          <code>aimock_chaos_bypassed_total</code> counter (see Prometheus Metrics below) and a
-          warning in the server log, so a configured chaos rate doesn't silently drop to 0% on SSE
-          traffic. Streaming mutation is planned for a future phase.
-        </p>
-
         <h2>Journal Tracking</h2>
         <p>
           When chaos triggers, the journal entry includes a <code>chaosAction</code> field recording
@@ -306,7 +254,6 @@ <h2>Journal Tracking</h2>
   "path": "/v1/chat/completions",
   "response": {
     "status": 500,
-    "source": "fixture",
     "fixture": { "...": "elided for brevity" },
     "chaosAction": "drop"
   }
@@ -321,31 +268,15 @@ <h2>Journal Tracking</h2>
         <h2>Prometheus Metrics</h2>
         <p>
           When metrics are enabled (<code>--metrics</code>), each chaos trigger increments the
-          <code>aimock_chaos_triggered_total</code> counter, tagged with <code>action</code> and
-          <code>source</code>. <code>source="fixture"</code> means a fixture matched (or would have,
-          before chaos intervened); <code>source="proxy"</code> means the request was on the proxy
-          dispatch path.
+          <code>aimock_chaos_triggered_total</code> counter with an <code>action</code> label:
         </p>
 
         <div class="code-block">
           <div class="code-block-header">Metrics output <span class="lang-tag">text</span></div>
           <pre><code># TYPE aimock_chaos_triggered_total counter
-aimock_chaos_triggered_total{action="drop",source="fixture"} 3
-aimock_chaos_triggered_total{action="malformed",source="fixture"} 1
-aimock_chaos_triggered_total{action="disconnect",source="proxy"} 2</code></pre>
-        </div>
-
-        <p>
-          When a chaos action is rolled but can't be applied &mdash; today, only
-          <code>malformed</code> on an SSE proxy response &mdash; the bypass is recorded in a
-          separate counter so operators can distinguish "chaos didn't roll" from "chaos rolled but
-          was bypassed":
-        </p>
-
-        <div class="code-block">
-          <div class="code-block-header">Bypass counter <span class="lang-tag">text</span></div>
-          <pre><code># TYPE aimock_chaos_bypassed_total counter
-aimock_chaos_bypassed_total{action="malformed",source="proxy",reason="sse_streamed"} 4</code></pre>
+aimock_chaos_triggered_total{action="drop"} 3
+aimock_chaos_triggered_total{action="malformed"} 1
+aimock_chaos_triggered_total{action="disconnect"} 2</code></pre>
         </div>
       </main>
       <aside class="page-toc" id="page-toc"></aside>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@copilotkit/aimock",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "Mock infrastructure for AI application testing — LLM APIs, image generation, text-to-speech, transcription, video generation, MCP tools, A2A agents, AG-UI event streams, vector databases, search, rerank, and moderation. One package, one port, zero dependencies.",
   "license": "MIT",
   "keywords": [