@aexol/spectral 0.9.228 → 0.9.230

package/dist/relay/registration.d.ts

@@ -3,12 +3,14 @@
  *
  * Contract (Batch 1 backend):
  *   POST <backend>/api/machines/register
- *     Headers: Authorization: Bearer <teamApiKey|userJwt>
+ *     Headers: Authorization: Bearer <userJwt|userApiKey|teamApiKey>
  *     Body:    { name?: string, hostname: string, version: string, pid: number }
- *     200:     { machineId: string, jwt: string, name: string, ownerId?: string }
+ *     200:     { machineId: string, jwt: string, name: string, teamId?, ownerId?, visibility? }
  *
  * Auth priority:
  *   - If `userJwt` is set → used as Bearer token (machine gets ownerId)
+ *   - Else if `userApiKey` is set → used as Bearer token (machine is PRIVATE
+ *     with ownerId derived from the key by the backend)
  *   - Else → `apiKey` (team API key, machine gets no owner)
  *
  * Why this lives in its own module:
@@ -30,6 +32,12 @@ export interface RegistrationDeps {
     backendUrl: string;
     /** Team API key — used when `userJwt` is not set. */
     apiKey: string;
+    /**
+     * Optional user API key ("sk-aexol-user-"), pinned to a team but owned by a
+     * single user. Used when `userJwt` is not set; takes priority over `apiKey`.
+     * The backend registers the machine as PRIVATE with ownerId from the key.
+     */
+    userApiKey?: string;
     /** Optional user JWT from OAuth login. When set, used instead of `apiKey` for registration. */
     userJwt?: string;
     /** Display name override (from `--machine-name`). Falls back to hostname. */

package/dist/relay/registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA+G3B"}
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA2I3B"}

package/dist/relay/registration.js

@@ -3,12 +3,14 @@
  *
  * Contract (Batch 1 backend):
  *   POST <backend>/api/machines/register
- *     Headers: Authorization: Bearer <teamApiKey|userJwt>
+ *     Headers: Authorization: Bearer <userJwt|userApiKey|teamApiKey>
  *     Body:    { name?: string, hostname: string, version: string, pid: number }
- *     200:     { machineId: string, jwt: string, name: string, ownerId?: string }
+ *     200:     { machineId: string, jwt: string, name: string, teamId?, ownerId?, visibility? }
  *
  * Auth priority:
  *   - If `userJwt` is set → used as Bearer token (machine gets ownerId)
+ *   - Else if `userApiKey` is set → used as Bearer token (machine is PRIVATE
+ *     with ownerId derived from the key by the backend)
  *   - Else → `apiKey` (team API key, machine gets no owner)
  *
  * Why this lives in its own module:
@@ -92,6 +94,7 @@ export async function ensureMachineRegistered(deps) {
     const skew = deps.expirySkewSec ?? 60;
     const existing = await loadMachine();
     const forceRefresh = deps.forceRefresh === true;
+    const usingUserApiKey = !deps.userJwt && !!deps.userApiKey;
     if (!forceRefresh && existing && !isJwtExpired(existing.machineJwt, skew)) {
         // The cached machine JWT is still valid. If the caller authenticated with a
         // user JWT (OAuth login) and the cached machine was previously owned by a
@@ -106,6 +109,21 @@ export async function ensureMachineRegistered(deps) {
                 shouldReuse = false;
             }
         }
+        else if (usingUserApiKey) {
+            // A user API key carries no `sub` claim, so identity is tracked by the
+            // key itself: `ensureMachineRegistered` records the key used for the
+            // last registration in `machine.json` extra. A different key means a
+            // different user (the backend derives `ownerId` from the key), so the
+            // machine must be re-registered to transfer ownership and flip
+            // visibility to PRIVATE. A missing marker means the cached machine was
+            // registered with a team key — re-register so the backend can make it
+            // PRIVATE for this user.
+            const previousKey = existing.extra?.userApiKey;
+            if (previousKey !== deps.userApiKey) {
+                console.log("Machine registered under a different user API key, re-registering to transfer ownership...");
+                shouldReuse = false;
+            }
+        }
         if (shouldReuse) {
             return { reused: true, record: existing };
         }
@@ -114,6 +132,8 @@ export async function ensureMachineRegistered(deps) {
         console.warn("Re-registering machine: cached JWT was rejected by the backend (forceRefresh).");
     }
     const fetchImpl = deps.fetchImpl ?? fetch;
+    // Token priority: userJwt (OAuth) > userApiKey (user-pinned key) > team key.
+    const authToken = deps.userJwt ?? deps.userApiKey ?? deps.apiKey;
     const url = `${deps.backendUrl.replace(/\/$/, "")}/api/machines/register`;
     const body = {
         // Reuse the cached display name on JWT-expiry refresh so the backend's
@@ -129,7 +149,7 @@ export async function ensureMachineRegistered(deps) {
         res = await fetchImpl(url, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${deps.userJwt ?? deps.apiKey}`,
+                Authorization: `Bearer ${authToken}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(body),
@@ -163,6 +183,14 @@ export async function ensureMachineRegistered(deps) {
         typeof obj.name !== "string") {
         throw new Error(`Machine registration: backend response missing required fields (machineId, jwt, name)`);
     }
+    const extra = { ...(existing?.extra ?? {}) };
+    delete extra.userApiKey;
+    if (usingUserApiKey) {
+        // Record which key was used so a later run with a different user key
+        // (a different account) forces re-registration. machine.json is 0600,
+        // same as config.json where the key already lives.
+        extra.userApiKey = deps.userApiKey;
+    }
     const record = {
         machineId: obj.machineId,
         machineName: obj.name,
@@ -173,6 +201,7 @@ export async function ensureMachineRegistered(deps) {
         registeredAt: Date.now(),
         hostname: hostname(),
         version: deps.version,
+        extra: Object.keys(extra).length > 0 ? extra : undefined,
     };
     await saveMachine(record);
     return { reused: false, forced: forceRefresh, record };

package/dist/sdk/ai/providers/leaked-tool-call-parser.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Parser for tool calls that a model leaked into plain text output as
+ * antml-style XML markup instead of emitting them through the native
+ * `tool_calls` stream.
+ *
+ * Observed shape (OpenRouter models occasionally emit this despite native
+ * tools being passed in the request):
+ *
+ *   wrapper-open tag
+ *     invoke-open tag with name attribute
+ *       parameter-open tag with name attribute ... value ... parameter-close tag
+ *     invoke-close tag
+ *   wrapper-close tag
+ *
+ * where the wrapper tag is `function_calls` (optionally with an `antml:`
+ * namespace prefix) and invoke/parameter tags follow the same convention.
+ *
+ * Everything here is pure string logic — no provider imports — so the tests
+ * cover it without any streaming harness.
+ */
+/** Longest opener tag is the antml-prefixed one (22 chars). Keep a margin. */
+export declare const LEAK_TAIL_LENGTH = 32;
+export type LeakedToolCall = {
+    name: string;
+    args: Record<string, string>;
+};
+export type LeakOpenerMatch = "full" | "partial" | "none";
+/**
+ * Locate a leaked wrapper-opener tag in `text`.
+ * - "full": a complete opener tag exists; `index` points at its `<`.
+ * - "partial": the text ENDS with a strict prefix of an opener tag (an opener
+ *   split across streaming deltas); `index` points at the start of that tail.
+ * - "none": no opener, complete or partial.
+ */
+export declare function findLeakedToolCallOpener(text: string): {
+    match: LeakOpenerMatch;
+    index: number;
+};
+/**
+ * Extract tool calls from a leaked wrapper block.
+ *
+ * Returns:
+ * - `complete: true` → the wrapper closer was found; `calls` holds every
+ *   invoke in order and `remaining` is the text outside the block (prose
+ *   before + after). `consumed` is the raw block text (opener→closer
+ *   inclusive) so callers can fall back to emitting it as text when the
+ *   parsed tool names turn out to be unknown.
+ * - `complete: false` → no closed wrapper block yet; `calls` is empty and
+ *   `remaining`/`consumed` echo the input so nothing is cut prematurely.
+ */
+export declare function extractLeakedToolCalls(text: string): {
+    calls: LeakedToolCall[];
+    complete: boolean;
+    remaining: string;
+    consumed: string;
+};
+/**
+ * Coerce a leaked parameter string into a JSON value when it clearly parses
+ * as one — native `tool_calls` arguments are real JSON, so a leaked
+ * `<parameter name="x">[1,2]</parameter>` should arrive as an array, not a
+ * string. Anything that does not fully parse stays a string.
+ */
+export declare function coerceLeakedParameterValue(raw: string): unknown;
+//# sourceMappingURL=leaked-tool-call-parser.d.ts.map

package/dist/sdk/ai/providers/leaked-tool-call-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaked-tool-call-parser.d.ts","sourceRoot":"","sources":["../../../../src/sdk/ai/providers/leaked-tool-call-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,MAAM,MAAM,cAAc,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;AAI1D;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACvC,IAAI,EAAE,MAAM,GACV;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0B3C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG;IACrD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACjB,CAoCA;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAW/D"}

package/dist/sdk/ai/providers/leaked-tool-call-parser.js

@@ -0,0 +1,134 @@
+/**
+ * Parser for tool calls that a model leaked into plain text output as
+ * antml-style XML markup instead of emitting them through the native
+ * `tool_calls` stream.
+ *
+ * Observed shape (OpenRouter models occasionally emit this despite native
+ * tools being passed in the request):
+ *
+ *   wrapper-open tag
+ *     invoke-open tag with name attribute
+ *       parameter-open tag with name attribute ... value ... parameter-close tag
+ *     invoke-close tag
+ *   wrapper-close tag
+ *
+ * where the wrapper tag is `function_calls` (optionally with an `antml:`
+ * namespace prefix) and invoke/parameter tags follow the same convention.
+ *
+ * Everything here is pure string logic — no provider imports — so the tests
+ * cover it without any streaming harness.
+ */
+/** Namespace prefix variants are matched verbatim, case-sensitively. */
+const NS = "(?:antml:)?";
+const INVOKE_RE = new RegExp(`<${NS}invoke\\s+name="([^"]*)"\\s*>([\\s\\S]*?)</${NS}invoke\\s*>`, "g");
+const PARAMETER_RE = new RegExp(`<${NS}parameter\\s+name="([^"]*)"\\s*>([\\s\\S]*?)</${NS}parameter\\s*>`, "g");
+const WRAPPER_OPEN_RE = /<(?:antml:)?function_calls\s*>/;
+const WRAPPER_CLOSE = /<\/(?:antml:)?function_calls\s*>/;
+/** Longest opener tag is the antml-prefixed one (22 chars). Keep a margin. */
+export const LEAK_TAIL_LENGTH = 32;
+const OPENER_PREFIXES = ["<function_calls", "<antml:function_calls"];
+/**
+ * Locate a leaked wrapper-opener tag in `text`.
+ * - "full": a complete opener tag exists; `index` points at its `<`.
+ * - "partial": the text ENDS with a strict prefix of an opener tag (an opener
+ *   split across streaming deltas); `index` points at the start of that tail.
+ * - "none": no opener, complete or partial.
+ */
+export function findLeakedToolCallOpener(text) {
+    let best = {
+        match: "none",
+        index: -1,
+    };
+    // Full openers allow trailing whitespace before `>`, mirroring
+    // WRAPPER_OPEN_RE so both matchers agree on what an opener is.
+    for (const m of text.matchAll(/<(?:antml:)?function_calls\s*>/g)) {
+        if (best.match !== "full" || m.index < best.index) {
+            best = { match: "full", index: m.index };
+        }
+    }
+    if (best.match === "full")
+        return best;
+    for (const opener of OPENER_PREFIXES) {
+        const maxLen = Math.min(opener.length - 1, text.length);
+        for (let size = maxLen; size > 0; size--) {
+            if (text.endsWith(opener.slice(0, size))) {
+                const index = text.length - size;
+                if (best.match === "none" || index < best.index) {
+                    best = { match: "partial", index };
+                }
+                break;
+            }
+        }
+    }
+    return best;
+}
+/**
+ * Extract tool calls from a leaked wrapper block.
+ *
+ * Returns:
+ * - `complete: true` → the wrapper closer was found; `calls` holds every
+ *   invoke in order and `remaining` is the text outside the block (prose
+ *   before + after). `consumed` is the raw block text (opener→closer
+ *   inclusive) so callers can fall back to emitting it as text when the
+ *   parsed tool names turn out to be unknown.
+ * - `complete: false` → no closed wrapper block yet; `calls` is empty and
+ *   `remaining`/`consumed` echo the input so nothing is cut prematurely.
+ */
+export function extractLeakedToolCalls(text) {
+    const openMatch = WRAPPER_OPEN_RE.exec(text);
+    if (!openMatch) {
+        return { calls: [], complete: false, remaining: text, consumed: "" };
+    }
+    const openStart = openMatch.index;
+    const bodyStart = openStart + openMatch[0].length;
+    let closeStart = -1;
+    let closeEnd = -1;
+    for (const closer of ["</function_calls", "</antml:function_calls"]) {
+        const idx = text.indexOf(closer, bodyStart);
+        if (idx >= 0 && (closeStart === -1 || idx < closeStart)) {
+            closeStart = idx;
+            const gt = text.indexOf(">", idx);
+            if (gt === -1)
+                return { calls: [], complete: false, remaining: text, consumed: "" };
+            closeEnd = gt;
+        }
+    }
+    if (closeStart === -1) {
+        return { calls: [], complete: false, remaining: text, consumed: "" };
+    }
+    const region = text.slice(bodyStart, closeStart);
+    const calls = [];
+    for (const m of region.matchAll(INVOKE_RE)) {
+        const args = {};
+        for (const p of m[2].matchAll(PARAMETER_RE)) {
+            args[p[1]] = p[2].trim();
+        }
+        calls.push({ name: m[1], args });
+    }
+    return {
+        calls,
+        complete: true,
+        consumed: text.slice(openStart, closeEnd + 1),
+        remaining: text.slice(0, openStart) + text.slice(closeEnd + 1),
+    };
+}
+/**
+ * Coerce a leaked parameter string into a JSON value when it clearly parses
+ * as one — native `tool_calls` arguments are real JSON, so a leaked
+ * `<parameter name="x">[1,2]</parameter>` should arrive as an array, not a
+ * string. Anything that does not fully parse stays a string.
+ */
+export function coerceLeakedParameterValue(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return raw;
+    if (!/^[[{"]/.test(trimmed) && !/^(true|false|null)$/.test(trimmed) && !/^-?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(trimmed)) {
+        return raw;
+    }
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return raw;
+    }
+}

package/dist/sdk/ai/providers/openai-completions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai-completions.d.ts","sourceRoot":"","sources":["../../../../src/sdk/ai/providers/openai-completions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAMX,0BAA0B,EAE1B,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAGX,OAAO,EAGP,KAAK,EACL,uBAAuB,EACvB,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAoErB,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC9D,UAAU,CAAC,EACR,MAAM,GACN,MAAM,GACN,UAAU,GACV;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACpD,eAAe,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;CAClE;AAED,KAAK,+BAA+B,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;AAqRzE,eAAO,MAAM,uBAAuB,EAAE,cAAc,CACnD,oBAAoB,EACpB,wBAAwB,CAsexB,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,cAAc,CACzD,oBAAoB,EACpB,mBAAmB,CAyBnB,CAAC;AAkNF,wBAAgB,eAAe,CAC9B,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,+BAA+B,GACrC,0BAA0B,EAAE,CA0R9B"}
+{"version":3,"file":"openai-completions.d.ts","sourceRoot":"","sources":["../../../../src/sdk/ai/providers/openai-completions.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAMX,0BAA0B,EAE1B,MAAM,sCAAsC,CAAC;AAI9C,OAAO,KAAK,EAGX,OAAO,EAGP,KAAK,EACL,uBAAuB,EACvB,mBAAmB,EAEnB,cAAc,EACd,aAAa,EAMb,MAAM,aAAa,CAAC;AAmFrB,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC9D,UAAU,CAAC,EACR,MAAM,GACN,MAAM,GACN,UAAU,GACV;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IACpD,eAAe,CAAC,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;CAClE;AAED,KAAK,+BAA+B,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;AAqRzE,eAAO,MAAM,uBAAuB,EAAE,cAAc,CACnD,oBAAoB,EACpB,wBAAwB,CAylBxB,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,cAAc,CACzD,oBAAoB,EACpB,mBAAmB,CAyBnB,CAAC;AAkNF,wBAAgB,eAAe,CAC9B,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,EAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,+BAA+B,GACrC,0BAA0B,EAAE,CA0R9B"}

package/dist/sdk/ai/providers/openai-completions.js

@@ -1,4 +1,5 @@
 import OpenAI from "openai";
+import { coerceLeakedParameterValue, extractLeakedToolCalls, findLeakedToolCallOpener, } from "./leaked-tool-call-parser.js";
 import { backendHostedImageResolver } from "../utils/hosted-image-resolver.js";
 import { getApiUrl, readConfig } from "../../../config.js";
 import { getEnvApiKey } from "../env-api-keys.js";
@@ -30,6 +31,19 @@ function hasToolHistory(messages) {
     }
     return false;
 }
+/**
+ * Parse streaming tool-call arguments without throwing. Returns undefined
+ * when the accumulated JSON fragment cannot be parsed (yet), so a malformed
+ * delta never aborts the whole agent turn.
+ */
+function safeParseArgs(partial) {
+    try {
+        return parseStreamingJson(partial);
+    }
+    catch {
+        return undefined;
+    }
+}
 function isTextContentBlock(block) {
     return block.type === "text";
 }
@@ -366,6 +380,16 @@ export const streamOpenAICompletions = (model, context, options) => {
             let rawChunkCount = 0;
             let inlineThinkingPending = "";
             let inInlineThinking = false;
+            // Leaked tool-call XML: some OpenRouter models emit antml-style
+            // markup in plain content instead of native tool_calls. Text is
+            // buffered here until a complete wrapper block arrives, then parsed
+            // into real toolCall blocks (see leaked-tool-call-parser.ts).
+            let leakMode = false;
+            let leakBuffer = "";
+            let leakPending = "";
+            let leakedToolCallSeq = 0;
+            let emittedLeakedToolCalls = false;
+            const availableToolNames = new Set((context.tools ?? []).map((tool) => tool.name));
             const toolCallBlocksByIndex = new Map();
             const toolCallBlocksById = new Map();
             const blocks = output.content;
@@ -393,7 +417,7 @@ export const streamOpenAICompletions = (model, context, options) => {
                     });
                 }
                 else if (block.type === "toolCall") {
-                    block.arguments = parseStreamingJson(block.partialArgs);
+                    block.arguments = safeParseArgs(block.partialArgs) ?? {};
                     // Finalize in-place and strip the scratch buffers so replay only
                     // carries parsed arguments.
                     delete block.partialArgs;
@@ -486,7 +510,7 @@ export const streamOpenAICompletions = (model, context, options) => {
                         emitThinkingDelta("inline_think", part.delta);
                     }
                     else {
-                        emitTextDelta(part.delta);
+                        processTextDelta(part.delta);
                     }
                 }
             };
@@ -529,6 +553,91 @@ export const streamOpenAICompletions = (model, context, options) => {
                 }
                 return block;
             };
+            // Synthetic tool calls parsed from leaked XML travel the same path
+            // as native ones (ensureToolCallBlock → finishBlock → toolcall_end),
+            // but use negative stream indexes so they can never collide with
+            // native tool_call indexes in the same response.
+            const emitSyntheticToolCall = (call) => {
+                const args = {};
+                for (const [key, value] of Object.entries(call.args)) {
+                    args[key] = coerceLeakedParameterValue(value);
+                }
+                const block = ensureToolCallBlock({
+                    id: `leaked_tc_${Date.now().toString(36)}_${Math.random()
+                        .toString(36)
+                        .slice(2, 8)}_${++leakedToolCallSeq}`,
+                    index: -1 - leakedToolCallSeq,
+                    function: { name: call.name, arguments: JSON.stringify(args) },
+                });
+                block.partialArgs = JSON.stringify(args);
+                block.arguments = args;
+                sawStreamOutput = true;
+                stream.push({
+                    type: "toolcall_delta",
+                    contentIndex: getContentIndex(block),
+                    delta: block.partialArgs,
+                    partial: output,
+                });
+            };
+            const drainLeakBuffer = () => {
+                while (true) {
+                    if (!leakMode) {
+                        const m = findLeakedToolCallOpener(leakPending);
+                        if (m.match === "full") {
+                            const before = leakPending.slice(0, m.index);
+                            if (before)
+                                emitTextDelta(before);
+                            leakBuffer = leakPending.slice(m.index);
+                            leakPending = "";
+                            leakMode = true;
+                        }
+                        else if (m.match === "partial") {
+                            const before = leakPending.slice(0, m.index);
+                            if (before)
+                                emitTextDelta(before);
+                            leakPending = leakPending.slice(m.index);
+                            return;
+                        }
+                        else {
+                            if (leakPending)
+                                emitTextDelta(leakPending);
+                            leakPending = "";
+                            return;
+                        }
+                    }
+                    const parsed = extractLeakedToolCalls(leakBuffer);
+                    if (!parsed.complete)
+                        return; // keep buffering until the closer arrives
+                    // All-or-nothing tool-name validation: a block naming a tool
+                    // that does not exist in this context is prose (legal XML in
+                    // an answer), not a tool call — emit it as text instead.
+                    if (parsed.calls.length > 0 &&
+                        parsed.calls.every((c) => availableToolNames.has(c.name))) {
+                        for (const call of parsed.calls)
+                            emitSyntheticToolCall(call);
+                        emittedLeakedToolCalls = true;
+                    }
+                    else {
+                        emitTextDelta(parsed.consumed);
+                    }
+                    leakBuffer = "";
+                    leakMode = false;
+                    leakPending = parsed.remaining; // may contain another block
+                }
+            };
+            // Route plain content text through leak detection. Holds back a
+            // bounded tail so an opener split across deltas is still caught.
+            const processTextDelta = (text) => {
+                if (!text)
+                    return;
+                if (leakMode) {
+                    leakBuffer += text;
+                }
+                else {
+                    leakPending += text;
+                }
+                drainLeakBuffer();
+            };
             for await (const chunk of openaiStream) {
                 rawChunkCount++;
                 if (!chunk || typeof chunk !== "object")
@@ -597,7 +706,12 @@ export const streamOpenAICompletions = (model, context, options) => {
                                 delta = toolCall.function.arguments;
                                 block.partialArgs =
                                     (block.partialArgs ?? "") + toolCall.function.arguments;
-                                block.arguments = parseStreamingJson(block.partialArgs);
+                                const parsed = safeParseArgs(block.partialArgs);
+                                if (parsed !== undefined) {
+                                    // Keep the last-good arguments if this fragment fails to
+                                    // parse; a later delta usually completes the JSON.
+                                    block.arguments = parsed;
+                                }
                             }
                             sawStreamOutput = true;
                             stream.push({
@@ -632,13 +746,31 @@ export const streamOpenAICompletions = (model, context, options) => {
                     emitThinkingDelta("inline_think", inlineThinkingPending);
                 }
                 else {
-                    emitTextDelta(inlineThinkingPending);
+                    processTextDelta(inlineThinkingPending);
                 }
                 inlineThinkingPending = "";
             }
+            // Flush leak buffers. A never-closed block is emitted as plain text
+            // (graceful degradation) so no content is lost; a held-back tail
+            // without an opener is just prose.
+            if (leakMode && leakBuffer) {
+                emitTextDelta(leakBuffer);
+                leakBuffer = "";
+                leakMode = false;
+            }
+            if (leakPending) {
+                emitTextDelta(leakPending);
+                leakPending = "";
+            }
             for (const block of blocks) {
                 finishBlock(block);
             }
+            // The provider finished with "stop" even though the model leaked its
+            // tool calls into text; the agent loop only continues on "toolUse",
+            // so promote the parsed synthetic calls.
+            if (emittedLeakedToolCalls && output.stopReason === "stop") {
+                output.stopReason = "toolUse";
+            }
             if (options?.signal?.aborted) {
                 throw new Error("Request was aborted");
             }

package/dist/sdk/coding-agent/core/system-prompt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACxC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CAsM3E"}
+{"version":3,"file":"system-prompt.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/core/system-prompt.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,WAAW,wBAAwB;IACxC,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,qFAAqF;IACrF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,uCAAuC;IACvC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yBAAyB;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,yBAAyB;IACzB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CACjB;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,MAAM,CA6M3E"}

package/dist/sdk/coding-agent/core/system-prompt.js

@@ -75,6 +75,11 @@ export function buildSystemPrompt(options) {
     }
     addGuideline("When creating new files, maintain a tree-like directory structure. Place files in semantically meaningful subdirectories (e.g. `handlers/auth/`, `utils/string/`) rather than dumping them at the project root or in shallow flat folders. Group related files into dedicated folders, prefer `feature/module/file.ts` over `feature-file.ts` at root. Avoid creating files directly in root unless they are truly project-wide (e.g. config, package.json). Keep folder depth reasonable (max 5–6 levels) but prefer nesting over flattening — tree-like structure improves LLM navigability and agentic coding efficiency.");
     addGuideline("When editing code, first inspect nearby files and existing patterns; follow the codebase’s conventions and libraries");
+    // Some models (notably via OpenRouter) emit antml-style XML tool calls in
+    // plain text instead of using the native tool-call mechanism. The provider
+    // parses those as a fallback, but the native path is strictly better
+    // (streaming, validation, real tool results in the transcript) — say so.
+    addGuideline("Always invoke tools through the native tool-call mechanism. Never write tool calls as XML markup or fake tags in plain text (e.g. wrapper/invoke/parameter style blocks) — they must never appear in your prose output.");
     // Always include these
     if (hasSubagent) {
         addGuideline("Subagent mode is enabled: use the subagent tool for non-trivial work when specialized or parallel delegation improves quality or speed.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.228",
+  "version": "0.9.230",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,