Skip to content

Extract SchemaStream v4 into dedicated repository#13

Merged
roodboi merged 45 commits into
mainfrom
codex/extract-schema-stream-v4
Jul 11, 2026
Merged

Extract SchemaStream v4 into dedicated repository#13
roodboi merged 45 commits into
mainfrom
codex/extract-schema-stream-v4

Conversation

@roodboi

@roodboi roodboi commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Make this repository the canonical home of schema-stream after schema-stream@4.0.0 shipped from
island-ai, then carry the reviewed opt-in snapshot-policy work on top of that published v4 baseline.

  • preserve the original dedicated repository history and merge the filtered
    public-packages/schemaStream history at the published v4.0.0 tag
  • move the complete v4 source, Zod 3/4/Mini tests, SDK-neutral iterate() API, and OpenAI Agents SDK
    / Vercel AI SDK compatibility fixtures to a focused root package
  • add opt-in chunk, completed-value, byte-threshold, and final snapshot policies while keeping
    per-input-chunk emission as the unchanged default
  • preserve backpressure, cancellation, malformed/truncated/trailing-input errors, UTF-8 boundaries,
    empty-source behavior, and nested empty objects/arrays
  • remove the obsolete docs app, private monorepo packages, Island AI branding, and stale workspace
    tooling
  • point package metadata, issues, homepage, Changesets, CI, and release automation at
    hack-dance/schema-stream
  • migrate formatting and linting to Ultracite/Biome and add contributor guidance, deterministic
    large-payload benchmarks, packed consumer checks, and workflow-security regressions
  • harden release automation with immutable action SHAs, exact same-repository release gates,
    read-only publish repository access, and non-persisted checkout credentials where safe

This is intentionally a two-parent extraction merge. Parent one is the existing schema-stream v2
history; parent two is a subtree-filtered history ending at island-ai's published
schema-stream@4.0.0 tag. Unrelated island-ai packages are not included.

Release sequencing

schema-stream@4.0.0 is already published from island-ai. The package remains at 4.0.0 in this
branch. The repository-migration patch changeset and additive snapshot-policy minor changeset combine
into the next minor release. Merging this PR does not publish immediately: the main push opens or
updates the Changesets release PR, and npm publication occurs only after that exact same-repository
changeset-release/main PR is separately reviewed and merged.

Security and performance review

The extraction and follow-up review found and fixed the following before merging to main:

  • attacker-controlled __proto__ paths could traverse into and mutate Object.prototype; dynamic
    paths now use own-property traversal and safe property definition, with regression coverage
  • incremental long strings rejoined all fragments for every character; buffering removes the
    quadratic path while preserving progressive semantics
  • post-completion chunks could be ignored; trailing whitespace remains valid and later non-whitespace
    content is rejected
  • empty sources could emit a successful-looking schema stub under opt-in policies; no policy now
    emits without a completed JSON value
  • nested empty objects/arrays supplied through unknown or record schemas could be lost; completed
    empty containers now update snapshots safely without changing existing value-policy emission counts
  • mutable third-party Action tags could execute in privileged release jobs; every action is pinned to
    a reviewed full commit SHA and the publish job now uses least-privilege repository access

The production dependency audit reports zero vulnerabilities. GitHub's current Dependabot warning
refers to the old default-branch monorepo/docs dependency graph that this PR removes.

Validation

  • bun x ultracite doctor — 4 passed, 0 warnings, 0 failed
  • bun run lint — 28 files checked, zero diagnostics
  • bun run check — Ultracite, TypeScript 7, 44 tests / 389 assertions, build, and packed consumers
  • bun run test:coverage — all source 90.53% line coverage; streaming parser 96.34%
  • bun run test:packed — Node ESM/CommonJS, Zod 4/Mini, Zod 3, TypeScript 5.9 declarations,
    OpenAI Agents SDK, and Vercel AI SDK
  • bun run benchmark:snapshots 1 — deterministic 1.25 MB policy matrix with correct snapshot counts
  • bun audit --production --audit-level=high — no vulnerabilities
  • bun run changeset status — next schema-stream minor release recognized
  • GitHub Actions — quality gate, Node 22 consumer, Node 24 consumer, and Graphite mergeability pass

Follow-ups outside this PR

  • after the dedicated repository migration and next release, remove/archive
    public-packages/schemaStream in a separate island-ai branch using docs/island-ai-follow-up.md
  • configure npm trusted publishing before replacing NPM_TOKEN with OIDC
  • add required reviewer/deployment-branch protection to the PUBLISH environment
  • enable repository-level full-SHA Action enforcement after these pinned workflows reach main

roodboi and others added 30 commits January 15, 2024 11:19
This reverts commit 7a45aca63e0488aa290f7fa22a1054d945c0c19e.
Releases:
  schema-stream@2.1.0

[skip ci]
…aking sure we just send back the default value right away if available
Releases:
  schema-stream@3.0.0
  zod-stream@0.0.8
  island-next-demos@1.0.11
  stream-hooks@0.0.4

[skip ci]
…rotecting against thecae where we have complete json but stream is still going for whtever reason - in this case ts becaUSE WE RETURN FULL OBJECTS FROM THE XML PARSING BUT COULD ALSO BE A CASE WHERE WE PARSE JSON AND HAVE ADDT CONTENT STREAM
Releases:
  schema-stream@3.1.0
  llm-polyglot@0.0.1

[skip ci]
Releases:
  evalz@0.2.0
  stream-hooks@2.0.0
  llm-polyglot@2.1.0
  schema-stream@3.2.0
  zod-stream@2.0.0
  island-next-demos@1.0.17

[skip ci]
Releases:
  llm-polyglot@2.3.0
  evalz@0.2.1
  schema-stream@3.2.1
  zod-stream@2.0.1
  island-next-demos@1.0.18

[skip ci]
Releases:
  schema-stream@3.2.2
  llm-polyglot@2.3.1
  zod-stream@2.0.2
  evalz@0.2.2
  stream-hooks@2.0.2

[skip ci]
@roodboi
roodboi marked this pull request as ready for review July 10, 2026 04:48

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c39f17d45

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/utils/streaming-json-parser.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba4e8d5dbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/utils/streaming-json-parser.ts Outdated
@roodboi
roodboi merged commit ea83ed9 into main Jul 11, 2026
4 checks passed
@roodboi
roodboi deleted the codex/extract-schema-stream-v4 branch July 11, 2026 00:18

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6592a0dbe4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +367 to +369
if (alreadyPresent) {
return false
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Record empty-container completions even when stub matches

When the JSON completes an empty array/object at a path whose schema stub is already [] or {} (for example z.object({ items: z.array(z.string()) }) receiving {"items":[]}), this early return skips recordCompletedPath() and emitCompletion(). The final snapshot still looks correct, but consumers relying on onKeyComplete.completedPaths never learn that items actually completed; the current guard is fresh evidence separate from the earlier missing-container data-loss issue because it only drops the completion event when the parsed empty value equals the placeholder.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant