@bendyline/gezel-inference 1.0.3 → 1.0.5

package/dist/engines/native-manifest.d.ts

@@ -40,12 +40,12 @@
  * but logs that it could not anchor to a baked-in digest.
  */
 /** Native release version this build pins. Placeholder until first public release. */
-export declare const NATIVE_ENGINE_RELEASE = "0.1.52";
+export declare const NATIVE_ENGINE_RELEASE = "0.1.54";
 /** sha256 of the pinned release's `SHA256SUMS` asset. All-zeros = unpinned. */
-export declare const SHA256SUMS_DIGEST = "1a2183ad785671be0f78a0f25816f7c802ce668ebe4fa58d640d336ebcbd7023";
-/** Exact SHA256 values for every engine archive published by native-v0.1.52. */
+export declare const SHA256SUMS_DIGEST = "087215a12096127a779b20e0dcb7d2ed9ce5dda1c81f33fdeb6b6eb730485b20";
+/** Exact SHA256 values for every engine archive published by native-v0.1.54. */
 export declare const NATIVE_ENGINE_ARCHIVE_SHA256: Readonly<Record<string, string>>;
-/** Download size in bytes of every engine archive published by native-v0.1.52. */
+/** Download size in bytes of every engine archive published by native-v0.1.54. */
 export declare const NATIVE_ENGINE_ARCHIVE_BYTES: Readonly<Record<string, number>>;
 /**
  * True only when the pinned release's standalone macOS archives were

package/dist/engines/native-manifest.js

@@ -40,47 +40,47 @@
  * but logs that it could not anchor to a baked-in digest.
  */
 /** Native release version this build pins. Placeholder until first public release. */
-export const NATIVE_ENGINE_RELEASE = '0.1.52';
+export const NATIVE_ENGINE_RELEASE = '0.1.54';
 /** sha256 of the pinned release's `SHA256SUMS` asset. All-zeros = unpinned. */
-export const SHA256SUMS_DIGEST = '1a2183ad785671be0f78a0f25816f7c802ce668ebe4fa58d640d336ebcbd7023';
+export const SHA256SUMS_DIGEST = '087215a12096127a779b20e0dcb7d2ed9ce5dda1c81f33fdeb6b6eb730485b20';
 // BEGIN PINNED NATIVE ARCHIVE HASHES
-/** Exact SHA256 values for every engine archive published by native-v0.1.52. */
+/** Exact SHA256 values for every engine archive published by native-v0.1.54. */
 export const NATIVE_ENGINE_ARCHIVE_SHA256 = Object.freeze({
-    'gezel-native-0.1.52-darwin-arm64-metal.tar.gz': '8c8619530592692ad9fd905823a5bc7772a652d4257905919dac088c5fa86347',
-    'gezel-native-0.1.52-darwin-arm64.tar.gz': '3088b7d97968ea206bf58a516da2a9c635d7622672da220d48d790fd5555a797',
-    'gezel-native-0.1.52-linux-arm64-cpu.tar.gz': 'ec4b992eb372e735156691950eadb2aa8f7e5ef29437b53a9da6fe8cc2a7912b',
-    'gezel-native-0.1.52-linux-arm64-cuda.tar.gz': '4f97fd70f0d132f0bfcaadfd113f63add7d8b63982edf8b1b7a46301702047f5',
-    'gezel-native-0.1.52-linux-arm64.tar.gz': '3fa2c58ff75bea7ec0f739821250307bfba78cb026779ec3ad1ef935286af534',
-    'gezel-native-0.1.52-linux-x64-cpu.tar.gz': '1fbfd06acfea1ef9e2629c121da2d7da13ee2e76a0cebb8cf07b779938817966',
-    'gezel-native-0.1.52-linux-x64-cuda.tar.gz': '5c3c05f285c3922845b72e470ecfcd5e510b874a35ae841cd655a7098b541ffd',
-    'gezel-native-0.1.52-linux-x64-vulkan.tar.gz': '33a6dd016bd2cf0aada7f34c364a457acc524373b52a1d3f1f6e83c1240e93a7',
-    'gezel-native-0.1.52-linux-x64.tar.gz': 'f17afac30f984da17b6098bf5f9c5e88e9f9e128b8fbea0b5ff67a360a494313',
-    'gezel-native-0.1.52-win32-arm64-cpu.zip': '49f011b05eec55cc3f60730fdd46e3d28de331f60b195eb29abaa04fe62835a3',
-    'gezel-native-0.1.52-win32-arm64-cuda.zip': '7dbc99fd9516ea5a5cc49ad2c157bb66a240ecc2b5a5e22fae33142a6615caec',
-    'gezel-native-0.1.52-win32-arm64.zip': 'dfe61d86eae932e03d92665aa42b81121e21cfa76a85424d993b5726ee5fa504',
-    'gezel-native-0.1.52-win32-x64-cpu.zip': 'b1147052367daf694d6001ef0d45a8897a39a1d74cb776a42f22529d5c21f919',
-    'gezel-native-0.1.52-win32-x64-cuda.zip': '3c9568591d19ba04ceb12ae2e9f9f2a4ac7ade4597458a8674d444c06407324f',
-    'gezel-native-0.1.52-win32-x64-vulkan.zip': '9cb1e7721d1dbebfa830ec8cba1bbbbcb41f0145d60461e4bf50c4e347feecb2',
-    'gezel-native-0.1.52-win32-x64.zip': '7c94605b0783695174773ac2327274d91bb9d7ae31e7d932a2b9df78d44424df',
+    'gezel-native-0.1.54-darwin-arm64-metal.tar.gz': 'f2990970303b954af2fd2e2bd31efef7d1c231bea16e026e0cdc0a7f9cc17842',
+    'gezel-native-0.1.54-darwin-arm64.tar.gz': '850f28338c52f945996c55edd77cf14d451c9bc4a09f719f6608885ddab99687',
+    'gezel-native-0.1.54-linux-arm64-cpu.tar.gz': '7dac7fed45c46b591cd6d597d639c385f54a3a367ac15d6097d3ad04d9c3c6e6',
+    'gezel-native-0.1.54-linux-arm64-cuda.tar.gz': 'f73c4569c356c4584199513c6c1f1f0bd3f0151fb1845696e2fa43f2b3626803',
+    'gezel-native-0.1.54-linux-arm64.tar.gz': 'f034ad2d3d12165c979d2fff2d34752c8d4f8ff836d3c416c9c64535f3bb652b',
+    'gezel-native-0.1.54-linux-x64-cpu.tar.gz': '57de7d52b0e95e3886bf4ffad7e015b98ba8bbea96b95d8cb3e26bc1ff309e99',
+    'gezel-native-0.1.54-linux-x64-cuda.tar.gz': 'c2d8616410f72b8bb217194f7c71d5175ed1c94ac6d9d94f660e0f535a3cff22',
+    'gezel-native-0.1.54-linux-x64-vulkan.tar.gz': '89f3233f41861404db082219962eb25d1b2c3f6e42bbc2696fda122ce845371d',
+    'gezel-native-0.1.54-linux-x64.tar.gz': 'f42e42d71187c6ef5af9685ebb65511bb7ac638815105f09f3df22cfdb9e6bce',
+    'gezel-native-0.1.54-win32-arm64-cpu.zip': 'e482e2af92f28135aea2e21ae97290e231b0dc77eadc8cc532d2506304d27575',
+    'gezel-native-0.1.54-win32-arm64-cuda.zip': 'ff6eaf7f070e9aba7fc087a155896f73b12664d867e0374af5546e941c153b82',
+    'gezel-native-0.1.54-win32-arm64.zip': '9b854d824117fe56d7d532ab83c01693a97cf6b45752e69cb895aa183c8cff35',
+    'gezel-native-0.1.54-win32-x64-cpu.zip': '93c8f22b47831ba8e0808033e87ce91cdb0d481890602857b6b8b5295cc7d50b',
+    'gezel-native-0.1.54-win32-x64-cuda.zip': '84da0b362e502d0bb6e3509528e7a4ccff50c2b9fcaa2fa1a62b3d9b0ad9f5d2',
+    'gezel-native-0.1.54-win32-x64-vulkan.zip': '1a3c99ce8343552fb17af80c36ba8ebb7c13ac8d6b4966f3aa3054018d41fa11',
+    'gezel-native-0.1.54-win32-x64.zip': 'f224fcdea6945ce574d32bee6ace345f82847f317c40cfa9059feba9b87ac0ca',
 });
-/** Download size in bytes of every engine archive published by native-v0.1.52. */
+/** Download size in bytes of every engine archive published by native-v0.1.54. */
 export const NATIVE_ENGINE_ARCHIVE_BYTES = Object.freeze({
-    'gezel-native-0.1.52-darwin-arm64-metal.tar.gz': 7056567,
-    'gezel-native-0.1.52-darwin-arm64.tar.gz': 42206061,
-    'gezel-native-0.1.52-linux-arm64-cpu.tar.gz': 8836310,
-    'gezel-native-0.1.52-linux-arm64-cuda.tar.gz': 620408821,
-    'gezel-native-0.1.52-linux-arm64.tar.gz': 42037958,
-    'gezel-native-0.1.52-linux-x64-cpu.tar.gz': 12914985,
-    'gezel-native-0.1.52-linux-x64-cuda.tar.gz': 993543364,
-    'gezel-native-0.1.52-linux-x64-vulkan.tar.gz': 25672744,
-    'gezel-native-0.1.52-linux-x64.tar.gz': 57183428,
-    'gezel-native-0.1.52-win32-arm64-cpu.zip': 5618616,
-    'gezel-native-0.1.52-win32-arm64-cuda.zip': 219555740,
-    'gezel-native-0.1.52-win32-arm64.zip': 42114295,
-    'gezel-native-0.1.52-win32-x64-cpu.zip': 8714442,
-    'gezel-native-0.1.52-win32-x64-cuda.zip': 749856660,
-    'gezel-native-0.1.52-win32-x64-vulkan.zip': 21123132,
-    'gezel-native-0.1.52-win32-x64.zip': 55662940,
+    'gezel-native-0.1.54-darwin-arm64-metal.tar.gz': 7056387,
+    'gezel-native-0.1.54-darwin-arm64.tar.gz': 42224129,
+    'gezel-native-0.1.54-linux-arm64-cpu.tar.gz': 8838944,
+    'gezel-native-0.1.54-linux-arm64-cuda.tar.gz': 620429935,
+    'gezel-native-0.1.54-linux-arm64.tar.gz': 42037092,
+    'gezel-native-0.1.54-linux-x64-cpu.tar.gz': 12914025,
+    'gezel-native-0.1.54-linux-x64-cuda.tar.gz': 993587032,
+    'gezel-native-0.1.54-linux-x64-vulkan.tar.gz': 25672135,
+    'gezel-native-0.1.54-linux-x64.tar.gz': 57185943,
+    'gezel-native-0.1.54-win32-arm64-cpu.zip': 5623741,
+    'gezel-native-0.1.54-win32-arm64-cuda.zip': 242341587,
+    'gezel-native-0.1.54-win32-arm64.zip': 42236457,
+    'gezel-native-0.1.54-win32-x64-cpu.zip': 8719660,
+    'gezel-native-0.1.54-win32-x64-cuda.zip': 749849595,
+    'gezel-native-0.1.54-win32-x64-vulkan.zip': 21128362,
+    'gezel-native-0.1.54-win32-x64.zip': 55668353,
 });
 // END PINNED NATIVE ARCHIVE HASHES
 /**

package/dist/engines/resolver.js

@@ -755,6 +755,15 @@ function stampEnv(engine, binPath, variant, versionDir) {
     process.env.GEZEL_NATIVE_BIN_DIR = versionDir;
     if (engine === 'llama-server' && variant)
         process.env.GEZEL_LLAMA_SERVER_BACKEND = variant;
+    // Windows on ARM's bare archive also carries sqlite-vec, which npm has no
+    // build of there. The sqlite driver reads this on every database open, so
+    // vector search starts with the next query rather than the next boot.
+    const platformKey = resolvePlatformKey();
+    const ext = process.platform === 'win32' ? 'dll' : process.platform === 'darwin' ? 'dylib' : 'so';
+    const sqliteVec = platformKey ? join(versionDir, platformKey, `vec0.${ext}`) : null;
+    if (sqliteVec && !process.env.GEZEL_SQLITE_VEC_PATH && existsSync(sqliteVec)) {
+        process.env.GEZEL_SQLITE_VEC_PATH = sqliteVec;
+    }
 }
 async function resolveGitHubToken() {
     if (process.env.GEZEL_GITHUB_TOKEN)

package/dist/http/openai-compat/engine-failure.js

@@ -53,10 +53,15 @@ function internalCode(err) {
         const code = current.code;
         const wire = typeof code === 'string' ? WIRE_CODES.get(code) : undefined;
         // A crash the out-of-memory killer caused is a capacity fact, not a fault.
-        if (wire === 'engine_crashed' &&
-            current.panicKind === 'host-out-of-memory') {
+        const panicKind = current.panicKind;
+        if (wire === 'engine_crashed' && panicKind === 'host-out-of-memory') {
             return 'engine_out_of_memory';
         }
+        // A runtime the machine lacks: the engine never started, and retrying
+        // cannot help until it is installed.
+        if (wire === 'engine_crashed' && panicKind === 'missing-runtime') {
+            return 'engine_launch_failed';
+        }
         if (wire)
             return wire;
         current = current.cause;

package/dist/http/openai-compat/responses-streaming.d.ts

@@ -1,4 +1,5 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, TurnUsage } from '../../providers/types.js';
+import type { ToolCallScreen } from './tool-call-screen.js';
 export type ResponsesToolKind = 'function' | 'custom';
 /**
  * Maps a provider-safe local tool name back to the identity advertised on
@@ -243,6 +244,12 @@ export interface ResponsesSerializerOptions {
     toolNamespaces?: Record<string, string>;
     echo?: ResponsesRequestEcho;
     limits?: ResponsesSerializerLimits;
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * A withheld call that was already announced closes `incomplete` with no
+     * arguments, since Responses clients run a call from its `done` item.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 /**
  * Stateful Responses output serializer. Every returned event is an immutable
@@ -259,6 +266,7 @@ export declare class ResponsesStreamSerializer {
     private readonly toolNamespaces;
     private readonly echo;
     private readonly limits;
+    private readonly toolCallScreen;
     private started;
     private terminal;
     private sequenceNumber;
@@ -305,6 +313,11 @@ export declare class ResponsesStreamSerializer {
     private finalizeActive;
     private finalizeMessage;
     private finalizeTool;
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    private withholdTool;
     private reconcileToolCalls;
     private reconcileFinalText;
     private markActiveIncomplete;

package/dist/http/openai-compat/responses-streaming.js

@@ -64,6 +64,7 @@ export class ResponsesStreamSerializer {
     toolNamespaces;
     echo;
     limits;
+    toolCallScreen;
     started = false;
     terminal = false;
     sequenceNumber = 0;
@@ -88,6 +89,7 @@ export class ResponsesStreamSerializer {
         this.toolNamespaces = options.toolNamespaces ?? {};
         this.echo = options.echo ?? {};
         this.limits = { ...DEFAULT_LIMITS, ...options.limits };
+        this.toolCallScreen = options.toolCallScreen;
     }
     get isTerminal() {
         return this.terminal;
@@ -162,6 +164,7 @@ export class ResponsesStreamSerializer {
             const calls = this.echo.parallelToolCalls === false ? toolCalls.slice(0, 1) : toolCalls;
             events.push(...this.reconcileToolCalls(calls));
             events.push(...this.reconcileFinalText(text));
+            events.push(...this.pushTextDelta(this.toolCallScreen?.notice() ?? ''));
             events.push(...this.finalizeActive());
             this.terminal = true;
             this.completedAt = this.nowSeconds();
@@ -438,6 +441,8 @@ export class ResponsesStreamSerializer {
         const events = [];
         const finalRaw = finalArguments ?? state.rawArguments;
         this.assertToolCapacity(finalRaw.length);
+        if (this.toolCallScreen?.blocks(state.localName, finalRaw))
+            return this.withholdTool(state);
         if (!state.announced)
             events.push(...this.announceTool(state));
         if (!state.item || state.outputIndex === null)
@@ -503,6 +508,27 @@ export class ResponsesStreamSerializer {
         }));
         return events;
     }
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    withholdTool(state) {
+        state.completed = true;
+        if (!state.announced || !state.item || state.outputIndex === null)
+            return [];
+        if (state.item.type === 'function_call')
+            state.item.arguments = '';
+        else
+            state.item.input = '';
+        state.item.status = 'incomplete';
+        return [
+            this.event({
+                type: 'response.output_item.done',
+                output_index: state.outputIndex,
+                item: cloneOutputItem(state.item),
+            }),
+        ];
+    }
     reconcileToolCalls(calls) {
         const events = [];
         const matched = new Set();
@@ -519,6 +545,9 @@ export class ResponsesStreamSerializer {
                 }
                 continue;
             }
+            // Never streamed, so a withheld call need not appear at all.
+            if (this.toolCallScreen?.blocks(call.name, call.arguments))
+                continue;
             if (this.active)
                 events.push(...this.finalizeActive());
             events.push(...this.openTool(call.name, call.id));
@@ -626,6 +655,7 @@ function serializerOptions(model, nowSeconds, options) {
         ...(options.toolKinds ? { toolKinds: options.toolKinds } : {}),
         ...(options.toolNamespaces ? { toolNamespaces: options.toolNamespaces } : {}),
         ...(options.limits ? { limits: options.limits } : {}),
+        ...(options.toolCallScreen ? { toolCallScreen: options.toolCallScreen } : {}),
         echo: {
             ...options.echo,
             ...(options.echo?.maxOutputTokens === undefined && options.lengthCapTokens !== undefined

package/dist/http/openai-compat/streaming.d.ts

@@ -1,5 +1,6 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, SendAndWaitOpts } from '../../providers/types.js';
 import { type StreamingDiagnostics } from './streaming-telemetry.js';
+import { type ToolCallScreen } from './tool-call-screen.js';
 /**
  * One-shot, non-streaming chat completion. Subscribes to usage to fill
  * the OpenAI `usage` envelope and returns the full response in the
@@ -52,6 +53,8 @@ export interface RunNonStreamingOpts {
     sendOptions?: Omit<SendAndWaitOpts, 'attachments'>;
     /** Effective output-token cap — reaching it reports `finish_reason: 'length'`. */
     lengthCapTokens?: number;
+    /** Withholds calls that name an egress indicator; see tool-call-screen.ts. */
+    toolCallScreen?: ToolCallScreen;
 }
 export declare function runNonStreaming(session: LLMSession, prompt: string, echoModel: string, nowSeconds: () => number, opts?: RunNonStreamingOpts): Promise<NonStreamingChatResult>;
 /**
@@ -117,6 +120,12 @@ export interface RunStreamingOpts {
     streamToolCallDeltas?: boolean;
     /** Tool names supplied by the caller; gates early textual-call detection. */
     toolCallNames?: readonly string[];
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * With live tool-call deltas on, each call's closing tail is held back
+     * until the call is screened, so the client cannot run it early.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 export interface RunStreamingResult {
     content: string;

package/dist/http/openai-compat/streaming.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { createChatProgressReporter } from './chat-progress.js';
 import { noteStreamingOutbound, noteStreamingProviderActivity, } from './streaming-telemetry.js';
+import { screenableArgumentsPrefix } from './tool-call-screen.js';
 import { ToolCallStreamFilter } from './tool-call-stream-filter.js';
 /**
  * Truncation detection. An engine that reports its own stop reason
@@ -111,7 +112,7 @@ function streamedJsonObjectEnd(body, start) {
     return body.length;
 }
 export async function runNonStreaming(session, prompt, echoModel, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, lengthCapTokens } = opts;
+    const { attachments, sendOptions, lengthCapTokens, toolCallScreen } = opts;
     // Wrapped so TypeScript's control-flow narrowing doesn't infer
     // `usage` as `never` after the post-callback null check — closures
     // that assign to a captured variable confuse the analyzer.
@@ -127,8 +128,10 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
                 ...(attachments && attachments.length > 0 ? { attachments } : {}),
             }
             : undefined;
-        const content = await session.sendAndWait(prompt, sendOpts);
-        const captured = session.capturedToolCalls?.() ?? [];
+        const reply = await session.sendAndWait(prompt, sendOpts);
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const content = `${reply}${toolCallScreen?.notice() ?? ''}`;
         const hasToolCalls = captured.length > 0;
         return {
             id: `chatcmpl-${randomUUID()}`,
@@ -173,7 +176,7 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
  * token).
  */
 export async function runStreaming(session, prompt, echoModel, sink, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], } = opts;
+    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], toolCallScreen, } = opts;
     const id = `chatcmpl-${randomUUID()}`;
     if (diagnostics)
         diagnostics.responseId = id;
@@ -198,6 +201,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
     const usageRef = { value: null };
     let visibleContent = '';
     let reasoningContent = '';
+    const sendableArguments = (received) => toolCallScreen ? screenableArgumentsPrefix(received) : received;
     const liveToolCalls = [];
     let activeLiveToolCall;
     let unnamedToolArguments = '';
@@ -238,7 +242,8 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
             index: meta.index ?? nextLiveToolIndex(),
             id: meta.id ?? `call_${randomUUID()}`,
             name,
-            arguments: argumentsChunk,
+            arguments: sendableArguments(argumentsChunk),
+            received: argumentsChunk,
         };
         liveToolCalls.push(call);
         activeLiveToolCall = call;
@@ -269,10 +274,15 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
         }, 'tool_calls');
         return call;
     };
-    const appendLiveToolArguments = (call, chunk) => {
+    const appendLiveToolArguments = (call, received) => {
+        if (!received)
+            return;
+        call.received += received;
+        const next = sendableArguments(call.received);
+        const chunk = next.slice(call.arguments.length);
         if (!chunk)
             return;
-        call.arguments += chunk;
+        call.arguments = next;
         enqueueSSE({
             data: JSON.stringify({
                 id,
@@ -516,9 +526,27 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 }),
             }, 'content');
         }
-        const captured = session.capturedToolCalls?.() ?? [];
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
         if (diagnostics)
-            diagnostics.capturedToolCalls = captured.length;
+            diagnostics.capturedToolCalls = rawCaptured.length;
+        // A withheld call's live stream stops short of its closing tail, so the
+        // client is left holding arguments it cannot parse.
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const notice = toolCallScreen?.notice();
+        if (notice) {
+            visibleContent += notice;
+            onContentDelta?.(notice);
+            await writeSSE({
+                data: JSON.stringify({
+                    id,
+                    object: 'chat.completion.chunk',
+                    created,
+                    model: echoModel,
+                    choices: [{ index: 0, delta: { content: notice }, finish_reason: null }],
+                    ...nullUsage,
+                }),
+            }, 'content');
+        }
         const hasToolCalls = captured.length > 0;
         if (hasToolCalls) {
             if (!streamToolCallDeltas || liveToolCalls.length === 0) {
@@ -554,6 +582,17 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 // any suffix that did not arrive live; never replay the complete
                 // arguments, which would make clients concatenate invalid JSON.
                 const matchedLive = new Set();
+                // Take the withheld calls' streams out of the running first, so an
+                // admitted call of the same tool name cannot be matched onto one.
+                for (const call of rawCaptured) {
+                    if (captured.includes(call))
+                        continue;
+                    const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
+                        (candidate.id === call.id ||
+                            (candidate.name === call.name && call.arguments.startsWith(candidate.arguments))));
+                    if (live)
+                        matchedLive.add(live);
+                }
                 for (const call of captured) {
                     const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
                         (candidate.id === call.id || candidate.name === call.name));
@@ -565,6 +604,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                             id: call.id,
                             name: call.name,
                             arguments: call.arguments,
+                            received: call.arguments,
                         });
                         await writeSSE({
                             data: JSON.stringify({

package/dist/http/openai-compat/tool-call-screen.d.ts

@@ -0,0 +1,28 @@
+import { type EgressIndicator } from '@bendyline/gezel';
+import type { ExternalToolCall } from '@bendyline/gezel/local-loop';
+/**
+ * Screens the tool calls a `/v1` turn hands back to the calling app.
+ *
+ * On these surfaces the app runs the tools, often with a real shell (Codex,
+ * OpenCode, Pi on a local model), so the response is the last place Gezel
+ * sees a call before it runs. A call naming an egress indicator (core
+ * `security/egress-indicators.ts`) never reaches the app as a runnable call;
+ * the reply says so instead.
+ */
+export interface ToolCallScreen {
+    /** The calls the app may run. Records the rest. */
+    admit(calls: readonly ExternalToolCall[]): ExternalToolCall[];
+    /** True when this call must not reach the app. Records it. */
+    blocks(name: string, args: string): boolean;
+    /** A line for the visible reply once anything was blocked. */
+    notice(): string | undefined;
+}
+export declare function createToolCallScreen(onBlocked?: (tool: string, indicators: EgressIndicator[]) => void): ToolCallScreen;
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export declare function screenableArgumentsPrefix(received: string): string;

package/dist/http/openai-compat/tool-call-screen.js

@@ -0,0 +1,43 @@
+import { describeEgressIndicators, findEgressIndicators, findEgressIndicatorsInValue, } from '@bendyline/gezel';
+export function createToolCallScreen(onBlocked) {
+    const blocked = [];
+    const seen = new Set();
+    const blocks = (name, args) => {
+        const indicators = indicatorsIn(args);
+        if (indicators.length === 0)
+            return false;
+        // The serializer and the final reconciliation can both see one call.
+        const key = `${name}\u0000${args}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            blocked.push(`${name} (it named ${describeEgressIndicators(indicators)})`);
+            onBlocked?.(name, indicators);
+        }
+        return true;
+    };
+    return {
+        admit: (calls) => calls.filter((call) => !blocks(call.name, call.arguments)),
+        blocks,
+        notice: () => blocked.length === 0
+            ? undefined
+            : `\n\n[Gezel stopped ${blocked.length === 1 ? 'a tool call' : `${blocked.length} tool calls`} before ${blocked.length === 1 ? 'it' : 'they'} ran: ${blocked.join('; ')}.]`,
+    };
+}
+function indicatorsIn(args) {
+    try {
+        return findEgressIndicatorsInValue(JSON.parse(args));
+    }
+    catch {
+        return findEgressIndicators(args);
+    }
+}
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export function screenableArgumentsPrefix(received) {
+    return received.replace(/[\s}\]]+$/, '');
+}

package/dist/http/routes/v1-chat.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { createLogger, isLocalProvider } from '@bendyline/gezel';
+import { createLogger, isLocalProvider, toolCallBlockedHistoryEntry, } from '@bendyline/gezel';
 import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { ZodError } from 'zod';
@@ -14,6 +14,7 @@ import { engineFailure } from '../openai-compat/engine-failure.js';
 import { overlayOpenAiRequestTuning } from '../openai-compat/request-tuning.js';
 import { createStreamingDiagnostics, snapshotStreamingDiagnostics, } from '../openai-compat/streaming-telemetry.js';
 import { runNonStreaming, runStreaming } from '../openai-compat/streaming.js';
+import { createToolCallScreen } from '../openai-compat/tool-call-screen.js';
 import { ChatCompletionRequestSchema, flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, translateMessagesWithPrefix, } from '../openai-compat/translate.js';
 const log = createLogger('v1-chat');
 // Match ChatManager's user-turn ceilings. Caller-owned app routes create a
@@ -402,6 +403,17 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ctx.chat.recordExternalUsage?.(target.provider, u);
             });
             const appId = c.get('auth')?.appId ?? 'unauthenticated';
+            const toolCallScreen = createToolCallScreen((tool, indicators) => {
+                const entry = toolCallBlockedHistoryEntry({
+                    tool,
+                    surface: 'openai',
+                    indicators,
+                    appId,
+                    ...(externalTurn ? { sessionId: externalTurn.sessionId } : {}),
+                });
+                log.warn(`${entry.summary} (app ${appId})`);
+                void ctx.history?.log(entry).catch(() => { });
+            });
             const logCompletion = () => {
                 void ctx.history
                     ?.log({
@@ -482,6 +494,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                             ...(opts.keepaliveIntervalMs !== undefined
                                 ? { keepaliveIntervalMs: opts.keepaliveIntervalMs }
                                 : {}),
+                            toolCallScreen,
                             ...(opts.streamToolCallDeltas === true ? { streamToolCallDeltas: true } : {}),
                             ...(opts.streamToolCallDeltas === true && externalTools
                                 ? { toolCallNames: externalTools.map((tool) => tool.name) }
@@ -574,6 +587,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ...(attachments.length > 0 ? { attachments } : {}),
                 sendOptions: { queue, timeoutMs: turnTimeoutMs },
                 ...(lengthCapTokens !== undefined ? { lengthCapTokens } : {}),
+                toolCallScreen,
             });
             const choice = response.choices[0];
             await externalTurn

package/dist/http/routes/v1-images.d.ts

@@ -0,0 +1,44 @@
+import { type GezelConfig } from '@bendyline/gezel';
+import type { CatalogService } from '@bendyline/gezel-catalog';
+import { Hono } from 'hono';
+import type { ImageModelPullRegistry } from '../../providers/image/pull-registry.js';
+import { type ImageProvider } from '../../providers/image/types.js';
+export interface ImagesRouteContext {
+    home: string;
+    catalog: CatalogService;
+    store: {
+        readConfig(): Promise<GezelConfig>;
+    };
+    images: {
+        /** Whether an engine can render here at all. */
+        available(): boolean;
+        current(): Promise<ImageProvider>;
+        /** Stop the engine, draining renders, before its model files change. */
+        reset(): Promise<void>;
+        pulls: ImageModelPullRegistry;
+    };
+}
+/**
+ * `/v1/images/*` — local image generation for apps.
+ *
+ *   GET    /models                   Installed and downloadable image models,
+ *                                    with this machine's fit. Never part of
+ *                                    `/v1/models`, so chat pickers never
+ *                                    offer them.
+ *   POST   /models/ensure            `{model: "sd-cpp:<id>"}` → ready, or a
+ *                                    background download (`job_id`).
+ *   GET    /models/ensure/:jobId     Snapshot of a download.
+ *   GET    /models/ensure/:jobId/events
+ *                                    SSE of `AppEnsureEvent`s, closing after
+ *                                    `done` or `error`. Disconnecting does
+ *                                    not cancel the download.
+ *   DELETE /models/ensure/:jobId     Cancel the download; a later ensure
+ *                                    resumes it.
+ *   DELETE /models/:id               Remove an installed model. A shared
+ *                                    model belongs to another store: 409.
+ *   POST   /generations              SSE of `AppImageGenerationEvent`s:
+ *                                    progress, then one `done` (the PNG) or
+ *                                    `error`. Closing the stream cancels the
+ *                                    render, which stops the engine.
+ */
+export declare function v1ImagesRoutes(ctx: ImagesRouteContext): Hono;