[mldangelo-oai]

Summary

The eval TypeScript build loads the SDK and MCP app with separate installations of Ajv 8.20.0. A type assertion on the SDK’s custom oneOf keyword mixes the two installations’ compiler contexts. TypeScript rejects the handler before deterministic evals start. Failing CI job

Changes

Derive the code keyword type from the validator’s own getKeyword method. The existing oneOf callback continues to delegate to that validator’s keyword implementation.

Testing

• Reproduced all three TS2345 diagnostics with the frozen SDK, MCP and eval dependencies. pnpm --dir sdk/typescript run build:evals and the complete eval setup, including the native host build, passed with the change.
• All six existing custom-validation scenarios for provisional deferred paths passed, including the conditional and referenced schema cases.
• Compared the SDK builds before and after the fix. The emitted custom-validation.js was byte-for-byte identical.
• The SDK’s full type and format checks, build:ci, and git diff --check passed.
• The first deterministic eval run hit a Promptfoo saved-config assertion when its sanitizer masked a long local Node executable path. The same saved-config replay passed with a short path to the byte-identical Node executable.

Risk and rollout

The change affects TypeScript type checking. The SDK emits the same validator implementation and uses the existing Ajv version.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T20:18:44.357255Z	a4168df	PR opened
🔒 Security Review	✅ Completed 2026-10-25T20:19:24.304471Z	a4168df	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for fixing the separate-install Ajv build. Owner-level merge-safety pass: no blocking findings. I reproduced the base's three TS2345 errors, verified the head's eval build, and confirmed byte-identical emitted validator JavaScript. SDK/MCP type checks, formatting, CI/plugin builds, and diff checks passed. Local runtime tests were blocked by filesystem ownership checks; the hosted deterministic eval job passed on a merge tree identical to this head. Full CI is still running.