@bendyline/gezel-inference 1.0.4 → 1.0.5

package/dist/http/openai-compat/responses-streaming.d.ts

@@ -1,4 +1,5 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, TurnUsage } from '../../providers/types.js';
+import type { ToolCallScreen } from './tool-call-screen.js';
 export type ResponsesToolKind = 'function' | 'custom';
 /**
  * Maps a provider-safe local tool name back to the identity advertised on
@@ -243,6 +244,12 @@ export interface ResponsesSerializerOptions {
     toolNamespaces?: Record<string, string>;
     echo?: ResponsesRequestEcho;
     limits?: ResponsesSerializerLimits;
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * A withheld call that was already announced closes `incomplete` with no
+     * arguments, since Responses clients run a call from its `done` item.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 /**
  * Stateful Responses output serializer. Every returned event is an immutable
@@ -259,6 +266,7 @@ export declare class ResponsesStreamSerializer {
     private readonly toolNamespaces;
     private readonly echo;
     private readonly limits;
+    private readonly toolCallScreen;
     private started;
     private terminal;
     private sequenceNumber;
@@ -305,6 +313,11 @@ export declare class ResponsesStreamSerializer {
     private finalizeActive;
     private finalizeMessage;
     private finalizeTool;
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    private withholdTool;
     private reconcileToolCalls;
     private reconcileFinalText;
     private markActiveIncomplete;

package/dist/http/openai-compat/responses-streaming.js

@@ -64,6 +64,7 @@ export class ResponsesStreamSerializer {
     toolNamespaces;
     echo;
     limits;
+    toolCallScreen;
     started = false;
     terminal = false;
     sequenceNumber = 0;
@@ -88,6 +89,7 @@ export class ResponsesStreamSerializer {
         this.toolNamespaces = options.toolNamespaces ?? {};
         this.echo = options.echo ?? {};
         this.limits = { ...DEFAULT_LIMITS, ...options.limits };
+        this.toolCallScreen = options.toolCallScreen;
     }
     get isTerminal() {
         return this.terminal;
@@ -162,6 +164,7 @@ export class ResponsesStreamSerializer {
             const calls = this.echo.parallelToolCalls === false ? toolCalls.slice(0, 1) : toolCalls;
             events.push(...this.reconcileToolCalls(calls));
             events.push(...this.reconcileFinalText(text));
+            events.push(...this.pushTextDelta(this.toolCallScreen?.notice() ?? ''));
             events.push(...this.finalizeActive());
             this.terminal = true;
             this.completedAt = this.nowSeconds();
@@ -438,6 +441,8 @@ export class ResponsesStreamSerializer {
         const events = [];
         const finalRaw = finalArguments ?? state.rawArguments;
         this.assertToolCapacity(finalRaw.length);
+        if (this.toolCallScreen?.blocks(state.localName, finalRaw))
+            return this.withholdTool(state);
         if (!state.announced)
             events.push(...this.announceTool(state));
         if (!state.item || state.outputIndex === null)
@@ -503,6 +508,27 @@ export class ResponsesStreamSerializer {
         }));
         return events;
     }
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    withholdTool(state) {
+        state.completed = true;
+        if (!state.announced || !state.item || state.outputIndex === null)
+            return [];
+        if (state.item.type === 'function_call')
+            state.item.arguments = '';
+        else
+            state.item.input = '';
+        state.item.status = 'incomplete';
+        return [
+            this.event({
+                type: 'response.output_item.done',
+                output_index: state.outputIndex,
+                item: cloneOutputItem(state.item),
+            }),
+        ];
+    }
     reconcileToolCalls(calls) {
         const events = [];
         const matched = new Set();
@@ -519,6 +545,9 @@ export class ResponsesStreamSerializer {
                 }
                 continue;
             }
+            // Never streamed, so a withheld call need not appear at all.
+            if (this.toolCallScreen?.blocks(call.name, call.arguments))
+                continue;
             if (this.active)
                 events.push(...this.finalizeActive());
             events.push(...this.openTool(call.name, call.id));
@@ -626,6 +655,7 @@ function serializerOptions(model, nowSeconds, options) {
         ...(options.toolKinds ? { toolKinds: options.toolKinds } : {}),
         ...(options.toolNamespaces ? { toolNamespaces: options.toolNamespaces } : {}),
         ...(options.limits ? { limits: options.limits } : {}),
+        ...(options.toolCallScreen ? { toolCallScreen: options.toolCallScreen } : {}),
         echo: {
             ...options.echo,
             ...(options.echo?.maxOutputTokens === undefined && options.lengthCapTokens !== undefined

package/dist/http/openai-compat/streaming.d.ts

@@ -1,5 +1,6 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, SendAndWaitOpts } from '../../providers/types.js';
 import { type StreamingDiagnostics } from './streaming-telemetry.js';
+import { type ToolCallScreen } from './tool-call-screen.js';
 /**
  * One-shot, non-streaming chat completion. Subscribes to usage to fill
  * the OpenAI `usage` envelope and returns the full response in the
@@ -52,6 +53,8 @@ export interface RunNonStreamingOpts {
     sendOptions?: Omit<SendAndWaitOpts, 'attachments'>;
     /** Effective output-token cap — reaching it reports `finish_reason: 'length'`. */
     lengthCapTokens?: number;
+    /** Withholds calls that name an egress indicator; see tool-call-screen.ts. */
+    toolCallScreen?: ToolCallScreen;
 }
 export declare function runNonStreaming(session: LLMSession, prompt: string, echoModel: string, nowSeconds: () => number, opts?: RunNonStreamingOpts): Promise<NonStreamingChatResult>;
 /**
@@ -117,6 +120,12 @@ export interface RunStreamingOpts {
     streamToolCallDeltas?: boolean;
     /** Tool names supplied by the caller; gates early textual-call detection. */
     toolCallNames?: readonly string[];
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * With live tool-call deltas on, each call's closing tail is held back
+     * until the call is screened, so the client cannot run it early.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 export interface RunStreamingResult {
     content: string;

package/dist/http/openai-compat/streaming.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { createChatProgressReporter } from './chat-progress.js';
 import { noteStreamingOutbound, noteStreamingProviderActivity, } from './streaming-telemetry.js';
+import { screenableArgumentsPrefix } from './tool-call-screen.js';
 import { ToolCallStreamFilter } from './tool-call-stream-filter.js';
 /**
  * Truncation detection. An engine that reports its own stop reason
@@ -111,7 +112,7 @@ function streamedJsonObjectEnd(body, start) {
     return body.length;
 }
 export async function runNonStreaming(session, prompt, echoModel, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, lengthCapTokens } = opts;
+    const { attachments, sendOptions, lengthCapTokens, toolCallScreen } = opts;
     // Wrapped so TypeScript's control-flow narrowing doesn't infer
     // `usage` as `never` after the post-callback null check — closures
     // that assign to a captured variable confuse the analyzer.
@@ -127,8 +128,10 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
                 ...(attachments && attachments.length > 0 ? { attachments } : {}),
             }
             : undefined;
-        const content = await session.sendAndWait(prompt, sendOpts);
-        const captured = session.capturedToolCalls?.() ?? [];
+        const reply = await session.sendAndWait(prompt, sendOpts);
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const content = `${reply}${toolCallScreen?.notice() ?? ''}`;
         const hasToolCalls = captured.length > 0;
         return {
             id: `chatcmpl-${randomUUID()}`,
@@ -173,7 +176,7 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
  * token).
  */
 export async function runStreaming(session, prompt, echoModel, sink, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], } = opts;
+    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], toolCallScreen, } = opts;
     const id = `chatcmpl-${randomUUID()}`;
     if (diagnostics)
         diagnostics.responseId = id;
@@ -198,6 +201,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
     const usageRef = { value: null };
     let visibleContent = '';
     let reasoningContent = '';
+    const sendableArguments = (received) => toolCallScreen ? screenableArgumentsPrefix(received) : received;
     const liveToolCalls = [];
     let activeLiveToolCall;
     let unnamedToolArguments = '';
@@ -238,7 +242,8 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
             index: meta.index ?? nextLiveToolIndex(),
             id: meta.id ?? `call_${randomUUID()}`,
             name,
-            arguments: argumentsChunk,
+            arguments: sendableArguments(argumentsChunk),
+            received: argumentsChunk,
         };
         liveToolCalls.push(call);
         activeLiveToolCall = call;
@@ -269,10 +274,15 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
         }, 'tool_calls');
         return call;
     };
-    const appendLiveToolArguments = (call, chunk) => {
+    const appendLiveToolArguments = (call, received) => {
+        if (!received)
+            return;
+        call.received += received;
+        const next = sendableArguments(call.received);
+        const chunk = next.slice(call.arguments.length);
         if (!chunk)
             return;
-        call.arguments += chunk;
+        call.arguments = next;
         enqueueSSE({
             data: JSON.stringify({
                 id,
@@ -516,9 +526,27 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 }),
             }, 'content');
         }
-        const captured = session.capturedToolCalls?.() ?? [];
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
         if (diagnostics)
-            diagnostics.capturedToolCalls = captured.length;
+            diagnostics.capturedToolCalls = rawCaptured.length;
+        // A withheld call's live stream stops short of its closing tail, so the
+        // client is left holding arguments it cannot parse.
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const notice = toolCallScreen?.notice();
+        if (notice) {
+            visibleContent += notice;
+            onContentDelta?.(notice);
+            await writeSSE({
+                data: JSON.stringify({
+                    id,
+                    object: 'chat.completion.chunk',
+                    created,
+                    model: echoModel,
+                    choices: [{ index: 0, delta: { content: notice }, finish_reason: null }],
+                    ...nullUsage,
+                }),
+            }, 'content');
+        }
         const hasToolCalls = captured.length > 0;
         if (hasToolCalls) {
             if (!streamToolCallDeltas || liveToolCalls.length === 0) {
@@ -554,6 +582,17 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 // any suffix that did not arrive live; never replay the complete
                 // arguments, which would make clients concatenate invalid JSON.
                 const matchedLive = new Set();
+                // Take the withheld calls' streams out of the running first, so an
+                // admitted call of the same tool name cannot be matched onto one.
+                for (const call of rawCaptured) {
+                    if (captured.includes(call))
+                        continue;
+                    const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
+                        (candidate.id === call.id ||
+                            (candidate.name === call.name && call.arguments.startsWith(candidate.arguments))));
+                    if (live)
+                        matchedLive.add(live);
+                }
                 for (const call of captured) {
                     const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
                         (candidate.id === call.id || candidate.name === call.name));
@@ -565,6 +604,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                             id: call.id,
                             name: call.name,
                             arguments: call.arguments,
+                            received: call.arguments,
                         });
                         await writeSSE({
                             data: JSON.stringify({

package/dist/http/openai-compat/tool-call-screen.d.ts

@@ -0,0 +1,28 @@
+import { type EgressIndicator } from '@bendyline/gezel';
+import type { ExternalToolCall } from '@bendyline/gezel/local-loop';
+/**
+ * Screens the tool calls a `/v1` turn hands back to the calling app.
+ *
+ * On these surfaces the app runs the tools, often with a real shell (Codex,
+ * OpenCode, Pi on a local model), so the response is the last place Gezel
+ * sees a call before it runs. A call naming an egress indicator (core
+ * `security/egress-indicators.ts`) never reaches the app as a runnable call;
+ * the reply says so instead.
+ */
+export interface ToolCallScreen {
+    /** The calls the app may run. Records the rest. */
+    admit(calls: readonly ExternalToolCall[]): ExternalToolCall[];
+    /** True when this call must not reach the app. Records it. */
+    blocks(name: string, args: string): boolean;
+    /** A line for the visible reply once anything was blocked. */
+    notice(): string | undefined;
+}
+export declare function createToolCallScreen(onBlocked?: (tool: string, indicators: EgressIndicator[]) => void): ToolCallScreen;
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export declare function screenableArgumentsPrefix(received: string): string;

package/dist/http/openai-compat/tool-call-screen.js

@@ -0,0 +1,43 @@
+import { describeEgressIndicators, findEgressIndicators, findEgressIndicatorsInValue, } from '@bendyline/gezel';
+export function createToolCallScreen(onBlocked) {
+    const blocked = [];
+    const seen = new Set();
+    const blocks = (name, args) => {
+        const indicators = indicatorsIn(args);
+        if (indicators.length === 0)
+            return false;
+        // The serializer and the final reconciliation can both see one call.
+        const key = `${name}\u0000${args}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            blocked.push(`${name} (it named ${describeEgressIndicators(indicators)})`);
+            onBlocked?.(name, indicators);
+        }
+        return true;
+    };
+    return {
+        admit: (calls) => calls.filter((call) => !blocks(call.name, call.arguments)),
+        blocks,
+        notice: () => blocked.length === 0
+            ? undefined
+            : `\n\n[Gezel stopped ${blocked.length === 1 ? 'a tool call' : `${blocked.length} tool calls`} before ${blocked.length === 1 ? 'it' : 'they'} ran: ${blocked.join('; ')}.]`,
+    };
+}
+function indicatorsIn(args) {
+    try {
+        return findEgressIndicatorsInValue(JSON.parse(args));
+    }
+    catch {
+        return findEgressIndicators(args);
+    }
+}
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export function screenableArgumentsPrefix(received) {
+    return received.replace(/[\s}\]]+$/, '');
+}

package/dist/http/routes/v1-chat.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { createLogger, isLocalProvider } from '@bendyline/gezel';
+import { createLogger, isLocalProvider, toolCallBlockedHistoryEntry, } from '@bendyline/gezel';
 import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { ZodError } from 'zod';
@@ -14,6 +14,7 @@ import { engineFailure } from '../openai-compat/engine-failure.js';
 import { overlayOpenAiRequestTuning } from '../openai-compat/request-tuning.js';
 import { createStreamingDiagnostics, snapshotStreamingDiagnostics, } from '../openai-compat/streaming-telemetry.js';
 import { runNonStreaming, runStreaming } from '../openai-compat/streaming.js';
+import { createToolCallScreen } from '../openai-compat/tool-call-screen.js';
 import { ChatCompletionRequestSchema, flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, translateMessagesWithPrefix, } from '../openai-compat/translate.js';
 const log = createLogger('v1-chat');
 // Match ChatManager's user-turn ceilings. Caller-owned app routes create a
@@ -402,6 +403,17 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ctx.chat.recordExternalUsage?.(target.provider, u);
             });
             const appId = c.get('auth')?.appId ?? 'unauthenticated';
+            const toolCallScreen = createToolCallScreen((tool, indicators) => {
+                const entry = toolCallBlockedHistoryEntry({
+                    tool,
+                    surface: 'openai',
+                    indicators,
+                    appId,
+                    ...(externalTurn ? { sessionId: externalTurn.sessionId } : {}),
+                });
+                log.warn(`${entry.summary} (app ${appId})`);
+                void ctx.history?.log(entry).catch(() => { });
+            });
             const logCompletion = () => {
                 void ctx.history
                     ?.log({
@@ -482,6 +494,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                             ...(opts.keepaliveIntervalMs !== undefined
                                 ? { keepaliveIntervalMs: opts.keepaliveIntervalMs }
                                 : {}),
+                            toolCallScreen,
                             ...(opts.streamToolCallDeltas === true ? { streamToolCallDeltas: true } : {}),
                             ...(opts.streamToolCallDeltas === true && externalTools
                                 ? { toolCallNames: externalTools.map((tool) => tool.name) }
@@ -574,6 +587,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ...(attachments.length > 0 ? { attachments } : {}),
                 sendOptions: { queue, timeoutMs: turnTimeoutMs },
                 ...(lengthCapTokens !== undefined ? { lengthCapTokens } : {}),
+                toolCallScreen,
             });
             const choice = response.choices[0];
             await externalTurn

package/dist/http/routes/v1-responses.js

@@ -1,4 +1,4 @@
-import { createLogger } from '@bendyline/gezel';
+import { createLogger, toolCallBlockedHistoryEntry } from '@bendyline/gezel';
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
 import { streamSSE } from 'hono/streaming';
@@ -11,6 +11,7 @@ import { resolveChatTarget, resolvePinnedModelTarget, } from '../openai-compat/c
 import { engineFailure } from '../openai-compat/engine-failure.js';
 import { runResponsesNonStreaming, runResponsesStreaming, } from '../openai-compat/responses-streaming.js';
 import { ResponsesRequestSchema, translateResponsesRequest, } from '../openai-compat/responses-translate.js';
+import { createToolCallScreen } from '../openai-compat/tool-call-screen.js';
 import { flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, } from '../openai-compat/translate.js';
 const log = createLogger('v1-responses');
 const MAX_RESPONSES_BODY_BYTES = 16 * 1024 * 1024;
@@ -180,8 +181,19 @@ export function v1ResponsesRoutes(ctx, opts = {}) {
             const detachRequestAbort = () => {
                 requestSignal.removeEventListener('abort', abortTurn);
             };
+            const toolCallScreen = createToolCallScreen((tool, indicators) => {
+                const entry = toolCallBlockedHistoryEntry({
+                    tool,
+                    surface: 'responses',
+                    indicators,
+                    appId,
+                });
+                log.warn(`${entry.summary} (app ${appId})`);
+                void ctx.history?.log(entry).catch(() => { });
+            });
             const runnerOptions = {
                 ...(attachments.length > 0 ? { attachments } : {}),
+                toolCallScreen,
                 ...(lengthCapTokens !== undefined ? { lengthCapTokens } : {}),
                 toolBindings: translated.toolBindings,
                 toolKinds: translated.toolKinds,

package/dist/providers/image/types.d.ts

@@ -118,6 +118,8 @@ export interface ImageGenerationMeta {
      * forward it untouched.
      */
     img2imgSkippedReason?: string;
+    /** Provider limits or adjustments to the requested image settings. */
+    settingsNotes?: string[];
 }
 export interface ImageGenerationOutput {
     png: Buffer;

package/dist/providers/types.d.ts

@@ -1,4 +1,4 @@
-import type { CodexPermissionModeCompat, ProviderName } from '@bendyline/gezel';
+import type { CodexPermissionModeCompat, EgressIndicator, ProviderName } from '@bendyline/gezel';
 import type { ActiveCraftbookStep, CompactionRequester, ExternalToolCall, ExternalToolSpec, LLMSession, ProviderSessionState, TerminalToolPolicy, WireTranscriptEntry } from '@bendyline/gezel/local-loop';
 import type { McpServerSpec } from '@bendyline/gezel/local-loop';
 import type { ResolvedModelProfile } from '../model-profile/types.js';
@@ -537,6 +537,12 @@ export interface ToolCallEvent {
     durationMs: number;
     success: boolean;
     errorMessage?: string;
+    /**
+     * Set when Gezel refused the call before it ran because it named a cloud
+     * metadata service, link-local address, data-drop or tunnel host, or
+     * namespace tool. The consumer records it in History.
+     */
+    egressIndicators?: EgressIndicator[];
     /**
      * Text returned by the tool when the provider exposes it. Producers must
      * redact known secrets before firing the event. ChatManager bounds this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bendyline/gezel-inference",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Gezel's on-device inference runtime: native engines, local model management, embeddings, knowledge search, and OpenAI-compatible routes.",
   "license": "MIT",
   "keywords": [
@@ -73,9 +73,9 @@
     "!dist/**/__pycache__"
   ],
   "dependencies": {
-    "@bendyline/gezel": "1.2.9",
-    "@bendyline/gezel-catalog": "1.2.9",
-    "@bendyline/gezel-client": "1.2.9",
+    "@bendyline/gezel": "1.2.10",
+    "@bendyline/gezel-catalog": "1.2.10",
+    "@bendyline/gezel-client": "1.2.10",
     "@bendyline/gezel-knowledge": "1.2.9",
     "hono": "4.13.9",
     "tar": "7.5.21",