qiwei66/model-bump

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• check lists every older Claude model ID to bump: Real input produced the expected result: Model IDs to bump: 7

  Source: - Lists every older Claude model ID you'll need to bump.

  Input: <guest-path>

  Expected: Model ID count reported

  Command: node <guest-path> check <guest-path> --skip-tests --fail-on never

  Observed: Model IDs to bump: 7 (claude-opus-5 ×5, claude-opus-4-6 ×1, anthropic.claude-opus-5-v1:0 ×1) Static checks can't see what your framework sends. Next: npx github:qiwei66/model-bump probe -- <your command>

• rules command lists the full rule set: Real input produced the expected result: content-by-position

  Source: Run `npx github:qiwei66/model-bump rules` for the full list.

  Input: rules

  Expected: content-by-position rule listed

  Command: node <guest-path> rules

  Observed: content-by-position: Reads content[0] as text — Opus 5.5 responses can start with a thinking block, and then this is empty/undefined or throws [warn] content-by-position: Reads content[0].text — if this is a Claude response, block 0 can now be a thinking block [warn] content-by-position: Reads a tool_use block by position — on Opus 5.5 a thinking block can come first [warn] stream-first-block: Stream handler special-cases block index 0 — on Opus 5.5 block 0 can be a thinking block [error] computer-use-legacy: Legacy computer use tool — rejected on the Claude API and Google Cloud (Bedro

Examples

• static scan of the fixtures reports the Opus 5.5 findings: command completed successfully

  Source: README.md ## check: static scan

  Input: fixtures directory

  Expected: summary of errors and warnings

  Command: node <guest-path> check <guest-path> --skip-tests --fail-on never

  Observed: edrock response_format can return plain text with HTTP 200 [dep:litellm] broken-py/requirements.txt fix: Check tool_calls / parse structured output defensively when drop_params is on. Fix for Bedrock tracked in BerriAI/litellm#42718. docs: https://github.com/BerriAI/litellm/issues/42717 Summary: 15 errors · 8 warnings · 1 info in 3 files, 3 manifests (1 info hidden, use --verbose) Model IDs to bump: 7 (claude-opus-5 ×5, claude-opus-4-6 ×1, anthropic.claude-opus-5-v1:0 ×1) Static checks can't see what your framework sends. Next: npx github:qiwei66/model-bump probe -- <your command>

• repo offline test suite passes (documented in package.json and CI): command completed successfully

  Source: package.json scripts.test

  Input: none

  Expected: all tests pass

  Command: npm test

  Observed: ns inside strings, comments and type declarations are skipped --- duration_ms: 0.42254 type: 'test' ... # Subtest: capability-gated forced choice is downgraded to info ok 26 - capability-gated forced choice is downgraded to info --- duration_ms: 0.087556 type: 'test' ... # Subtest: content[0].text on a response is an error, on other names a warning ok 27 - content[0].text on a response is an error, on other names a warning --- duration_ms: 0.117943 type: 'test' ... 1..27 # tests 27 # suites 0 # pass 27 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 628.190584

• probe wraps a real app command (README probe example): command completed successfully

  Source: README.md ## probe: a fake Opus 5.5 for your real app

  Input: fixtures/demo/app.py run via probe

  Expected: probe reports requests checked; app only defines functions so 0 requests

  Command: node <guest-path> probe -- /tmp/mbvenv/bin/python <guest-path>

  Observed: [model-bump] emulating Claude Opus 5.5 at http://127.0.0.1:35995 → running: /tmp/mbvenv/bin/python <guest-path> model-bump probe · 0 requests checked against Claude Opus 5.5 No requests reached the probe. Does your client read ANTHROPIC_BASE_URL? Bedrock / Vertex / Foundry clients bypass it; point them at the Anthropic provider for the probe run.

Local or hosted: local

Static Opus 5.5 breaking-change scan of code and dependencies (check), rule listing (rules), and running an app under the fake Opus 5.5 API (probe)

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,260p README.md; echo ----; cat package.json; echo ----; ls bin scripts src test .coldpass; echo ----; which node npm npx git; node -v 2>&1; npm -v 2>&1; cat /etc/os-release | head -2
cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 300 npx --yes github:qiwei66/model-bump check <guest-path> --skip-tests 2>&1 | tail -40; echo "rc=${PIPESTATUS[0]}"; ls <guest-path>
cd <guest-path> && git init -q && git remote add origin https://github.com/qiwei66/model-bump && timeout 200 git fetch --depth 1 origin b368b836d61d97f26a88d05e2d04e54663268cb3 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head -20
cd <guest-path> && ls -R fixtures | head -40; echo ----; cat fixtures/demo/app.py 2>/dev/null | head -30; echo ----; ls src/probe; grep -n "argv\|--out\|--dump\|--serve\|--lenient\|--simulate" bin/model-bump.js | head -40
cd <guest-path> && sed -n 1,80p src/probe/run.js | head -90; echo ----; grep -n "400\|temperature\|thinking\|listen\|port" src/probe/server.js | head -40
cd <guest-path> && cat fixtures/broken-py/agent.py | head -50; echo ----; tail -20 fixtures/demo/app.py; echo ----; sed -n 20,70p src/probe/server.js
cd <guest-path> && cat fixtures/broken-ts/package.json; echo ----; cat fixtures/broken-ts/index.ts | head -30; echo ----; cat fixtures/demo/requirements.txt; cat fixtures/broken-py/requirements.txt; echo; python3 -m pip --version
cd /tmp && export NODE_USE_ENV_PROXY=1 && P=github:qiwei66/model-bump#b368b836d61d97f26a88d05e2d04e54663268cb3 && timeout 300 npx --yes $P check <guest-path> --skip-tests --fail-on never > /tmp/mb_check.txt 2>&1; echo rc=$?; tail -4 /tmp/mb_check.txt; echo ----; timeout 300 npx --yes $P rules 2>&1 | head -8; echo rc=$?
cd /tmp && export NODE_USE_ENV_PROXY=1 && M=<guest-path> && node $M check <guest-path> --skip-tests --fail-on never > /tmp/mb_check.txt 2>&1; echo rc=$?; tail -4 /tmp/mb_check.txt; echo ----; node $M rules 2>&1 | head -8; echo rc=$?; echo ----; grep -c . /tmp/mb_check.txt
cd /tmp && M=<guest-path> && (node $M probe --serve --port 8787 > /tmp/mb_serve.log 2>&1 & echo $! > /tmp/mb_serve.pid); sleep 2; curl -s -X POST http://127.0.0.1:8787/v1/messages -H 'content-type: application/json' -d '{"model":"claude-opus-5","max_tokens":64,"temperature":0,"thinking":{"type":"disabled"},"messages":[{"role":"user","content":"hi"}]}'; echo; echo ----; curl -s -X POST http://127.0.0.1:8787/v1/messages -H 'content-type: application/json' -d '{"model":"claude-opus-5","max_tokens":64,"messages":[{"role":"user","content":"hi"}]}' | head -c 400; echo; kill $(cat /tmp/mb_serve.pid); sleep 1; kill -0 $(cat /tmp/mb_serve.pid) 2>/dev/null && echo still-running || echo stopped; cat /tmp/mb_serve.log | head -5
cd <guest-path> && grep -rn "setInterval\|cron\|--once\|--now\|--watch\|webhook\|schedule" bin src README.md docs 2>/dev/null | head; echo ----; cat .github/workflows/* 2>/dev/null | grep -n "run:" ; echo ----; python3 -m venv /tmp/mbvenv 2>&1 | tail -2 && /tmp/mbvenv/bin/pip install -q anthropic==1.8.0 2>&1 | tail -3; /tmp/mbvenv/bin/python -c 'import anthropic,sys;print(anthropic.__version__, sys.version.split()[0])' -I 2>&1 | head -2
cd /tmp && node <guest-path> probe -- /tmp/mbvenv/bin/python <guest-path>; echo rc=$?; echo ----; cd <guest-path> && node bin/model-bump.js probe -- /tmp/mbvenv/bin/python fixtures/demo/app.py 2>&1 | tail -3; echo rc=$?
cd <guest-path> && ls .github/workflows/; node bin/model-bump.js rules | grep -c "content-by-position"; cd <guest-path> && timeout 200 npm test 2>&1 | tail -8; echo rc=$?; grep -n "Run \`npx github:qiwei66/model-bump rules\`" README.md | cut -c1-200; grep -n "Lists every older Claude model ID" README.md
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["node","<guest-path>","check","<guest-path>","--skip-tests","--fail-on","never"],"cwd":"/tmp","expected_text":"Model IDs to bump: 7"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"check lists every older Claude model ID to bump","source":"- Lists every older Claude model ID you'll need to bump.","input":"<guest-path>","expected":"Model ID count reported","probe_kind":"cli","argv":["node","<guest-path>","check","<guest-path>","--skip-tests","--fail-on","never"],"expected_text":"Model IDs to bump: 7","cwd":"/tmp"},
{"kind":"claim","claim":"rules command lists the full rule set","source":"Run `npx github:qiwei66/model-bump rules` for the full list.","input":"rules","expected":"content-by-position rule listed","probe_kind":"cli","argv":["node","<guest-path>","rules"],"expected_text":"content-by-position","cwd":"/tmp"}]
EOF
python3 -I -c 'import json;json.load(open("probe.json"));json.load(open("claims.json"));print("json ok")'
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"static scan of the fixtures reports the Opus 5.5 findings","source":"README.md ## check: static scan","input":"fixtures directory","expected":"summary of errors and warnings","argv":["node","<guest-path>","check","<guest-path>","--skip-tests","--fail-on","never"],"cwd":"/tmp","expected_text":"Summary: 15 errors"},
{"kind":"example","claim":"repo offline test suite passes (documented in package.json and CI)","source":"package.json scripts.test","input":"none","expected":"all tests pass","argv":["npm","test"],"cwd":"<guest-path>","expected_text":"# pass 27"},
{"kind":"example","claim":"probe wraps a real app command (README probe example)","source":"README.md ## probe: a fake Opus 5.5 for your real app","input":"fixtures/demo/app.py run via probe","expected":"probe reports requests checked; app only defines functions so 0 requests","argv":["node","<guest-path>","probe","--","/tmp/mbvenv/bin/python","<guest-path>"],"cwd":"/tmp","expected_text":"No requests reached the probe."}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (bin/model-bump.js, src/, README.md, package.json, .github/workflows/test.yml). No cron, scheduler, loop, webhook, --once or --now option exists; the tool runs once per invocation of check, rules, or probe.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open(f)) for f in ["examples.json","cycles.json"]];print("json ok")'
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Static Opus 5.5 breaking-change scan of code and dependencies (check), rule listing (rules), and running an app under the fake Opus 5.5 API (probe)","operation_scope":"Local only, no API key. Node 22.23.4 and npm 10.9.9 on Ubuntu 24.04. Python 3.12.3 with a venv at /tmp/mbvenv holding anthropic==1.8.0 for the probe example. Source pinned to b368b836d61d97f26a88d05e2d04e54663268cb3, run via its bin/model-bump.js.","steps":["git init; git remote add origin https://github.com/qiwei66/model-bump; git fetch --depth 1 origin b368b836d61d97f26a88d05e2d04e54663268cb3; git reset --mixed FETCH_HEAD","npx github:qiwei66/model-bump check . (README; ran unpinned from /tmp, produced findings and exit 1)","npx github:qiwei66/model-bump rules (README; run via local bin instead, see deviations)","npx github:qiwei66/model-bump probe --serve (README; run via local bin, POSTed requests with curl)","npx github:qiwei66/model-bump probe -- python app.py (README; run via local bin with a venv python)"],"deviations":["The pinned npx spec github:qiwei66/model-bump#b368b836... fails inside npm 10.9.9 with 'GitFetcher requires an Arborist constructor to pack a tarball'. Substitute: node bin/model-bump.js from the pinned checkout, the package's own declared bin, run from cwd /tmp.","The unpinned npx github:qiwei66/model-bump check ran successfully before the pin was used; it resolves the default branch, so its commit was not verified against the pin.","The fixture demo/app.py only defines functions and never calls them, so probe -- python app.py reported 0 requests. To show the fake API rejects and accepts requests, I ran probe --serve on port 8787 and POSTed a thinking-disabled request (got 400 with the Opus 5.5 error text) and a valid request (got 200 with a thinking block first), then stopped the server.","No product cycle exists, so no cycle check was run."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Fix the npm github commit-spec install failure in the npx path, or document the local bin fallback. The fixtures could call their functions so probe receives real requests."}
EOF
python3 -I -c 'import json;json.load(open("report.json"));print("json ok")' && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40; echo rc=$?
pgrep -af "model-bump|probe" | grep -v pgrep || echo "no model-bump processes running"; ls <guest-path>