@bendyline/gezel-inference 1.0.4 → 1.0.6

package/dist/catalog/provenance.json

@@ -1,6 +1,6 @@
 {
   "package": "@bendyline/gilde",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "kinds": [
     "chat-models",
     "image-models",

package/dist/engines/resolver.d.ts

@@ -32,7 +32,7 @@ export interface ResolveEngineOptions {
     signaturePolicy?: SignaturePolicy;
     fetchImpl?: typeof fetch;
     signal?: AbortSignal;
-    /** Pre-resolved token: `undefined` = auto-resolve; `null` = explicitly none. */
+    /** Pre-resolved token: `undefined` = from the environment; `null` = explicitly none. */
     token?: string | null;
     /** Override the source-pinned SHA256SUMS digest (tests). */
     expectedSha256sumsDigest?: string;

package/dist/engines/resolver.js

@@ -3,7 +3,7 @@ import { createReadStream, existsSync, readdirSync } from 'node:fs';
 import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { HttpStatusError, createLogger, nowIso, resolveDistributionProfile, retryTransient, } from '@bendyline/gezel';
-import { DUCKDB_APPLE_TEAM_ID, DUCKDB_ARCHIVE_SHA256, DUCKDB_ASSET, DUCKDB_BINARY_SHA256, DUCKDB_VERSION, DUCKDB_WINDOWS_PUBLISHER, MXC_EXECUTOR_NAME, MXC_EXECUTOR_SHA256, MXC_LICENSE_SHA256, MXC_TARBALL_INTEGRITY, MXC_TARBALL_LICENSE_ENTRY, MXC_TARBALL_SHA256, MXC_TARBALL_URL, MXC_VERIFIED_SENTINEL, MXC_VERSION, MXC_WINDOWS_PUBLISHER, duckdbAssetUrl, duckdbBinaryName, duckdbInstallDir, duckdbPlatformKey, mxcArch, mxcInstallDir, mxcTarballEntry, resolvePlatformKey, windowsHeadlessSpawnOptions, } from '@bendyline/gezel/native';
+import { DUCKDB_APPLE_TEAM_ID, DUCKDB_ARCHIVE_SHA256, DUCKDB_ASSET, DUCKDB_BINARY_SHA256, DUCKDB_VERSION, DUCKDB_WINDOWS_PUBLISHER, MXC_EXECUTOR_NAME, MXC_EXECUTOR_SHA256, MXC_LICENSE_SHA256, MXC_TARBALL_INTEGRITY, MXC_TARBALL_LICENSE_ENTRY, MXC_TARBALL_SHA256, MXC_TARBALL_URL, MXC_VERIFIED_SENTINEL, MXC_VERSION, MXC_WINDOWS_PUBLISHER, duckdbAssetUrl, duckdbBinaryName, duckdbInstallDir, duckdbPlatformKey, mxcArch, mxcInstallDir, mxcTarballEntry, resolvePlatformKey, } from '@bendyline/gezel/native';
 import * as tar from 'tar';
 import { downloadWithRetry, friendlyErrors, } from '../utils/download-with-retry.js';
 import { extractZip } from '../utils/extract-zip.js';
@@ -541,14 +541,16 @@ export async function* resolveEngine(opts) {
     // `bendyline/gezel` is public, so release metadata and assets are readable
     // anonymously. A token stays OPTIONAL and is used when present purely to
     // lift GitHub's 60-request/hour unauthenticated API rate limit. Do not
-    // reinstate a hard gate here: users who install from npm have no `gh`
-    // login, and requiring one would make on-device engines unreachable for
-    // every consumer outside this repo.
-    const token = opts.token !== undefined ? opts.token : await resolveGitHubToken();
+    // reinstate a hard gate here: users who install from npm have no token,
+    // and requiring one would make on-device engines unreachable for every
+    // consumer outside this repo.
+    const auth = {
+        token: opts.token !== undefined ? opts.token : resolveGitHubToken(),
+    };
     const baseFetch = opts.fetchImpl ?? globalThis.fetch;
     const tag = `native-v${version}`;
     // ── 1. Resolve release + assets ──
-    const release = await ghJson(`${apiBase}/repos/${REPO}/releases/tags/${tag}`, baseFetch, token);
+    const release = await ghJson(`${apiBase}/repos/${REPO}/releases/tags/${tag}`, baseFetch, auth);
     const archiveAsset = release.assets?.find((a) => a.name === archiveName);
     const sumsAsset = release.assets?.find((a) => a.name === 'SHA256SUMS');
     if (!archiveAsset) {
@@ -558,7 +560,7 @@ export async function* resolveEngine(opts) {
         yield* fail(`release ${tag} is missing its SHA256SUMS manifest — refusing to install unverified`);
     }
     // ── 2. SHA256SUMS: verify own digest against the source pin, then parse ──
-    const sumsBytes = await ghBytes(sumsAsset.url, baseFetch, token);
+    const sumsBytes = await ghBytes(sumsAsset.url, baseFetch, auth);
     const sumsDigest = createHash('sha256').update(sumsBytes).digest('hex');
     if (!unpinned && sumsDigest !== expectedDigest) {
         yield* fail(`SHA256SUMS digest mismatch for ${tag}: this build pins ${expectedDigest.slice(0, 16)}… but the release served ${sumsDigest.slice(0, 16)}…. Refusing — the release may have been tampered with or re-cut.`);
@@ -584,7 +586,7 @@ export async function* resolveEngine(opts) {
         url: archiveAsset.url,
         destPath: archivePath,
         approxSizeBytes: archiveAsset.size ?? 0,
-        fetchImpl: makeAuthedFetch(baseFetch, token),
+        fetchImpl: gitHubFetch(baseFetch, auth, 'application/octet-stream'),
         ...(opts.signal ? { signal: opts.signal } : {}),
     });
     let outcome;
@@ -765,35 +767,37 @@ function stampEnv(engine, binPath, variant, versionDir) {
         process.env.GEZEL_SQLITE_VEC_PATH = sqliteVec;
     }
 }
-async function resolveGitHubToken() {
-    if (process.env.GEZEL_GITHUB_TOKEN)
-        return process.env.GEZEL_GITHUB_TOKEN;
-    if (process.env.GITHUB_TOKEN)
-        return process.env.GITHUB_TOKEN;
-    try {
-        const { execFileSync } = await import('node:child_process');
-        // Named host: a bare `gh auth token` answers for gh's default host, which
-        // can be a GitHub Enterprise server whose token must not go to github.com.
-        const out = execFileSync('gh', ['auth', 'token', '--hostname', 'github.com'], {
-            encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore'],
-            ...windowsHeadlessSpawnOptions(),
-        });
-        return out.trim() || null;
-    }
-    catch {
-        return null;
-    }
+/**
+ * An optional token, from the environment only. This module runs inside apps
+ * that embed Gezel, so it never borrows the user's GitHub CLI login: `gh` is
+ * not its credential to use, and a stale one used to fail public downloads.
+ */
+function resolveGitHubToken() {
+    return process.env.GEZEL_GITHUB_TOKEN || process.env.GITHUB_TOKEN || null;
 }
-function makeAuthedFetch(base, token) {
-    return ((input, init) => base(input, {
-        ...init,
-        headers: {
-            ...init?.headers,
-            Accept: 'application/octet-stream',
-            ...(token ? { Authorization: `Bearer ${token}` } : {}),
-        },
-    }));
+/**
+ * Fetch from GitHub with the optional token. The release is public, so a token
+ * GitHub rejects (expired, revoked) is dropped for the rest of the resolve and
+ * the request repeats anonymously instead of failing the install.
+ */
+function gitHubFetch(base, auth, accept) {
+    return (async (input, init) => {
+        const send = () => base(input, {
+            ...init,
+            headers: {
+                ...init?.headers,
+                Accept: accept,
+                ...(auth.token ? { Authorization: `Bearer ${auth.token}` } : {}),
+            },
+        });
+        const res = await send();
+        if (res.status !== 401 || !auth.token)
+            return res;
+        await res.body?.cancel().catch(() => { });
+        log.warn('[engine-resolver] GitHub rejected the token from GEZEL_GITHUB_TOKEN / GITHUB_TOKEN (401); continuing anonymously');
+        auth.token = null;
+        return send();
+    });
 }
 /**
  * The archive itself goes through `downloadWithRetry`, but the two small
@@ -808,31 +812,23 @@ function ghRetryLog(what) {
         log.warn(`[engine-resolver] ${what} failed (${info.reason}); retrying in ${info.delayMs}ms (attempt ${info.attempt}/${info.maxAttempts})`);
     };
 }
-async function ghJson(url, fetchImpl, token) {
+async function ghJson(url, fetchImpl, auth) {
+    const get = gitHubFetch(fetchImpl, auth, 'application/vnd.github+json');
     return retryTransient(async () => {
-        const res = await fetchImpl(url, {
-            headers: {
-                Accept: 'application/vnd.github+json',
-                ...(token ? { Authorization: `Bearer ${token}` } : {}),
-            },
-        });
+        const res = await get(url);
         if (!res.ok) {
             await res.body?.cancel().catch(() => { });
             // A transient status is thrown as HttpStatusError so retryTransient
             // takes another pass; 4xx becomes the terminal EngineUnavailableError.
-            throw new HttpStatusError(res.status, `GitHub API returned ${res.status} for ${url}${res.status === 404 ? ' (release not found — or no access while private)' : ''}`);
+            throw new HttpStatusError(res.status, `GitHub API returned ${res.status} for ${url}${res.status === 404 ? ' (release not found)' : ''}`);
         }
         return (await res.json());
     }, { attempts: GH_METADATA_ATTEMPTS, onRetry: ghRetryLog('GitHub release lookup') }).catch(rethrowAsEngineUnavailable);
 }
-async function ghBytes(assetApiUrl, fetchImpl, token) {
+async function ghBytes(assetApiUrl, fetchImpl, auth) {
+    const get = gitHubFetch(fetchImpl, auth, 'application/octet-stream');
     return retryTransient(async () => {
-        const res = await fetchImpl(assetApiUrl, {
-            headers: {
-                Accept: 'application/octet-stream',
-                ...(token ? { Authorization: `Bearer ${token}` } : {}),
-            },
-        });
+        const res = await get(assetApiUrl);
         if (!res.ok) {
             await res.body?.cancel().catch(() => { });
             throw new HttpStatusError(res.status, `asset download returned ${res.status} for ${assetApiUrl}`);

package/dist/http/openai-compat/responses-streaming.d.ts

@@ -1,4 +1,5 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, TurnUsage } from '../../providers/types.js';
+import type { ToolCallScreen } from './tool-call-screen.js';
 export type ResponsesToolKind = 'function' | 'custom';
 /**
  * Maps a provider-safe local tool name back to the identity advertised on
@@ -243,6 +244,12 @@ export interface ResponsesSerializerOptions {
     toolNamespaces?: Record<string, string>;
     echo?: ResponsesRequestEcho;
     limits?: ResponsesSerializerLimits;
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * A withheld call that was already announced closes `incomplete` with no
+     * arguments, since Responses clients run a call from its `done` item.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 /**
  * Stateful Responses output serializer. Every returned event is an immutable
@@ -259,6 +266,7 @@ export declare class ResponsesStreamSerializer {
     private readonly toolNamespaces;
     private readonly echo;
     private readonly limits;
+    private readonly toolCallScreen;
     private started;
     private terminal;
     private sequenceNumber;
@@ -305,6 +313,11 @@ export declare class ResponsesStreamSerializer {
     private finalizeActive;
     private finalizeMessage;
     private finalizeTool;
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    private withholdTool;
     private reconcileToolCalls;
     private reconcileFinalText;
     private markActiveIncomplete;

package/dist/http/openai-compat/responses-streaming.js

@@ -64,6 +64,7 @@ export class ResponsesStreamSerializer {
     toolNamespaces;
     echo;
     limits;
+    toolCallScreen;
     started = false;
     terminal = false;
     sequenceNumber = 0;
@@ -88,6 +89,7 @@ export class ResponsesStreamSerializer {
         this.toolNamespaces = options.toolNamespaces ?? {};
         this.echo = options.echo ?? {};
         this.limits = { ...DEFAULT_LIMITS, ...options.limits };
+        this.toolCallScreen = options.toolCallScreen;
     }
     get isTerminal() {
         return this.terminal;
@@ -162,6 +164,7 @@ export class ResponsesStreamSerializer {
             const calls = this.echo.parallelToolCalls === false ? toolCalls.slice(0, 1) : toolCalls;
             events.push(...this.reconcileToolCalls(calls));
             events.push(...this.reconcileFinalText(text));
+            events.push(...this.pushTextDelta(this.toolCallScreen?.notice() ?? ''));
             events.push(...this.finalizeActive());
             this.terminal = true;
             this.completedAt = this.nowSeconds();
@@ -438,6 +441,8 @@ export class ResponsesStreamSerializer {
         const events = [];
         const finalRaw = finalArguments ?? state.rawArguments;
         this.assertToolCapacity(finalRaw.length);
+        if (this.toolCallScreen?.blocks(state.localName, finalRaw))
+            return this.withholdTool(state);
         if (!state.announced)
             events.push(...this.announceTool(state));
         if (!state.item || state.outputIndex === null)
@@ -503,6 +508,27 @@ export class ResponsesStreamSerializer {
         }));
         return events;
     }
+    /**
+     * Close a screened call so no client can run it. One never announced stays
+     * out of the output; an announced one ends `incomplete` with no arguments.
+     */
+    withholdTool(state) {
+        state.completed = true;
+        if (!state.announced || !state.item || state.outputIndex === null)
+            return [];
+        if (state.item.type === 'function_call')
+            state.item.arguments = '';
+        else
+            state.item.input = '';
+        state.item.status = 'incomplete';
+        return [
+            this.event({
+                type: 'response.output_item.done',
+                output_index: state.outputIndex,
+                item: cloneOutputItem(state.item),
+            }),
+        ];
+    }
     reconcileToolCalls(calls) {
         const events = [];
         const matched = new Set();
@@ -519,6 +545,9 @@ export class ResponsesStreamSerializer {
                 }
                 continue;
             }
+            // Never streamed, so a withheld call need not appear at all.
+            if (this.toolCallScreen?.blocks(call.name, call.arguments))
+                continue;
             if (this.active)
                 events.push(...this.finalizeActive());
             events.push(...this.openTool(call.name, call.id));
@@ -626,6 +655,7 @@ function serializerOptions(model, nowSeconds, options) {
         ...(options.toolKinds ? { toolKinds: options.toolKinds } : {}),
         ...(options.toolNamespaces ? { toolNamespaces: options.toolNamespaces } : {}),
         ...(options.limits ? { limits: options.limits } : {}),
+        ...(options.toolCallScreen ? { toolCallScreen: options.toolCallScreen } : {}),
         echo: {
             ...options.echo,
             ...(options.echo?.maxOutputTokens === undefined && options.lengthCapTokens !== undefined

package/dist/http/openai-compat/streaming.d.ts

@@ -1,5 +1,6 @@
 import type { ExternalToolCall, ImageAttachment, LLMSession, SendAndWaitOpts } from '../../providers/types.js';
 import { type StreamingDiagnostics } from './streaming-telemetry.js';
+import { type ToolCallScreen } from './tool-call-screen.js';
 /**
  * One-shot, non-streaming chat completion. Subscribes to usage to fill
  * the OpenAI `usage` envelope and returns the full response in the
@@ -52,6 +53,8 @@ export interface RunNonStreamingOpts {
     sendOptions?: Omit<SendAndWaitOpts, 'attachments'>;
     /** Effective output-token cap — reaching it reports `finish_reason: 'length'`. */
     lengthCapTokens?: number;
+    /** Withholds calls that name an egress indicator; see tool-call-screen.ts. */
+    toolCallScreen?: ToolCallScreen;
 }
 export declare function runNonStreaming(session: LLMSession, prompt: string, echoModel: string, nowSeconds: () => number, opts?: RunNonStreamingOpts): Promise<NonStreamingChatResult>;
 /**
@@ -117,6 +120,12 @@ export interface RunStreamingOpts {
     streamToolCallDeltas?: boolean;
     /** Tool names supplied by the caller; gates early textual-call detection. */
     toolCallNames?: readonly string[];
+    /**
+     * Withholds calls that name an egress indicator; see tool-call-screen.ts.
+     * With live tool-call deltas on, each call's closing tail is held back
+     * until the call is screened, so the client cannot run it early.
+     */
+    toolCallScreen?: ToolCallScreen;
 }
 export interface RunStreamingResult {
     content: string;

package/dist/http/openai-compat/streaming.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { createChatProgressReporter } from './chat-progress.js';
 import { noteStreamingOutbound, noteStreamingProviderActivity, } from './streaming-telemetry.js';
+import { screenableArgumentsPrefix } from './tool-call-screen.js';
 import { ToolCallStreamFilter } from './tool-call-stream-filter.js';
 /**
  * Truncation detection. An engine that reports its own stop reason
@@ -111,7 +112,7 @@ function streamedJsonObjectEnd(body, start) {
     return body.length;
 }
 export async function runNonStreaming(session, prompt, echoModel, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, lengthCapTokens } = opts;
+    const { attachments, sendOptions, lengthCapTokens, toolCallScreen } = opts;
     // Wrapped so TypeScript's control-flow narrowing doesn't infer
     // `usage` as `never` after the post-callback null check — closures
     // that assign to a captured variable confuse the analyzer.
@@ -127,8 +128,10 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
                 ...(attachments && attachments.length > 0 ? { attachments } : {}),
             }
             : undefined;
-        const content = await session.sendAndWait(prompt, sendOpts);
-        const captured = session.capturedToolCalls?.() ?? [];
+        const reply = await session.sendAndWait(prompt, sendOpts);
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const content = `${reply}${toolCallScreen?.notice() ?? ''}`;
         const hasToolCalls = captured.length > 0;
         return {
             id: `chatcmpl-${randomUUID()}`,
@@ -173,7 +176,7 @@ export async function runNonStreaming(session, prompt, echoModel, nowSeconds, op
  * token).
  */
 export async function runStreaming(session, prompt, echoModel, sink, nowSeconds, opts = {}) {
-    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], } = opts;
+    const { attachments, sendOptions, includeReasoning = false, keepaliveIntervalMs = 0, diagnostics, suppressTextualToolCalls = false, includeUsage = false, includeProgress = false, lengthCapTokens, onContentDelta, onReasoningDelta, onToolArgsDelta, streamToolCallDeltas = false, toolCallNames = [], toolCallScreen, } = opts;
     const id = `chatcmpl-${randomUUID()}`;
     if (diagnostics)
         diagnostics.responseId = id;
@@ -198,6 +201,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
     const usageRef = { value: null };
     let visibleContent = '';
     let reasoningContent = '';
+    const sendableArguments = (received) => toolCallScreen ? screenableArgumentsPrefix(received) : received;
     const liveToolCalls = [];
     let activeLiveToolCall;
     let unnamedToolArguments = '';
@@ -238,7 +242,8 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
             index: meta.index ?? nextLiveToolIndex(),
             id: meta.id ?? `call_${randomUUID()}`,
             name,
-            arguments: argumentsChunk,
+            arguments: sendableArguments(argumentsChunk),
+            received: argumentsChunk,
         };
         liveToolCalls.push(call);
         activeLiveToolCall = call;
@@ -269,10 +274,15 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
         }, 'tool_calls');
         return call;
     };
-    const appendLiveToolArguments = (call, chunk) => {
+    const appendLiveToolArguments = (call, received) => {
+        if (!received)
+            return;
+        call.received += received;
+        const next = sendableArguments(call.received);
+        const chunk = next.slice(call.arguments.length);
         if (!chunk)
             return;
-        call.arguments += chunk;
+        call.arguments = next;
         enqueueSSE({
             data: JSON.stringify({
                 id,
@@ -516,9 +526,27 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 }),
             }, 'content');
         }
-        const captured = session.capturedToolCalls?.() ?? [];
+        const rawCaptured = session.capturedToolCalls?.() ?? [];
         if (diagnostics)
-            diagnostics.capturedToolCalls = captured.length;
+            diagnostics.capturedToolCalls = rawCaptured.length;
+        // A withheld call's live stream stops short of its closing tail, so the
+        // client is left holding arguments it cannot parse.
+        const captured = toolCallScreen ? toolCallScreen.admit(rawCaptured) : rawCaptured;
+        const notice = toolCallScreen?.notice();
+        if (notice) {
+            visibleContent += notice;
+            onContentDelta?.(notice);
+            await writeSSE({
+                data: JSON.stringify({
+                    id,
+                    object: 'chat.completion.chunk',
+                    created,
+                    model: echoModel,
+                    choices: [{ index: 0, delta: { content: notice }, finish_reason: null }],
+                    ...nullUsage,
+                }),
+            }, 'content');
+        }
         const hasToolCalls = captured.length > 0;
         if (hasToolCalls) {
             if (!streamToolCallDeltas || liveToolCalls.length === 0) {
@@ -554,6 +582,17 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                 // any suffix that did not arrive live; never replay the complete
                 // arguments, which would make clients concatenate invalid JSON.
                 const matchedLive = new Set();
+                // Take the withheld calls' streams out of the running first, so an
+                // admitted call of the same tool name cannot be matched onto one.
+                for (const call of rawCaptured) {
+                    if (captured.includes(call))
+                        continue;
+                    const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
+                        (candidate.id === call.id ||
+                            (candidate.name === call.name && call.arguments.startsWith(candidate.arguments))));
+                    if (live)
+                        matchedLive.add(live);
+                }
                 for (const call of captured) {
                     const live = liveToolCalls.find((candidate) => !matchedLive.has(candidate) &&
                         (candidate.id === call.id || candidate.name === call.name));
@@ -565,6 +604,7 @@ export async function runStreaming(session, prompt, echoModel, sink, nowSeconds,
                             id: call.id,
                             name: call.name,
                             arguments: call.arguments,
+                            received: call.arguments,
                         });
                         await writeSSE({
                             data: JSON.stringify({

package/dist/http/openai-compat/tool-call-screen.d.ts

@@ -0,0 +1,28 @@
+import { type EgressIndicator } from '@bendyline/gezel';
+import type { ExternalToolCall } from '@bendyline/gezel/local-loop';
+/**
+ * Screens the tool calls a `/v1` turn hands back to the calling app.
+ *
+ * On these surfaces the app runs the tools, often with a real shell (Codex,
+ * OpenCode, Pi on a local model), so the response is the last place Gezel
+ * sees a call before it runs. A call naming an egress indicator (core
+ * `security/egress-indicators.ts`) never reaches the app as a runnable call;
+ * the reply says so instead.
+ */
+export interface ToolCallScreen {
+    /** The calls the app may run. Records the rest. */
+    admit(calls: readonly ExternalToolCall[]): ExternalToolCall[];
+    /** True when this call must not reach the app. Records it. */
+    blocks(name: string, args: string): boolean;
+    /** A line for the visible reply once anything was blocked. */
+    notice(): string | undefined;
+}
+export declare function createToolCallScreen(onBlocked?: (tool: string, indicators: EgressIndicator[]) => void): ToolCallScreen;
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export declare function screenableArgumentsPrefix(received: string): string;

package/dist/http/openai-compat/tool-call-screen.js

@@ -0,0 +1,43 @@
+import { describeEgressIndicators, findEgressIndicators, findEgressIndicatorsInValue, } from '@bendyline/gezel';
+export function createToolCallScreen(onBlocked) {
+    const blocked = [];
+    const seen = new Set();
+    const blocks = (name, args) => {
+        const indicators = indicatorsIn(args);
+        if (indicators.length === 0)
+            return false;
+        // The serializer and the final reconciliation can both see one call.
+        const key = `${name}\u0000${args}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            blocked.push(`${name} (it named ${describeEgressIndicators(indicators)})`);
+            onBlocked?.(name, indicators);
+        }
+        return true;
+    };
+    return {
+        admit: (calls) => calls.filter((call) => !blocks(call.name, call.arguments)),
+        blocks,
+        notice: () => blocked.length === 0
+            ? undefined
+            : `\n\n[Gezel stopped ${blocked.length === 1 ? 'a tool call' : `${blocked.length} tool calls`} before ${blocked.length === 1 ? 'it' : 'they'} ran: ${blocked.join('; ')}.]`,
+    };
+}
+function indicatorsIn(args) {
+    try {
+        return findEgressIndicatorsInValue(JSON.parse(args));
+    }
+    catch {
+        return findEgressIndicators(args);
+    }
+}
+/**
+ * The part of a live-streamed argument string that is safe to send before
+ * the call has been screened: everything but a trailing run of closing
+ * brackets and whitespace. A tool call's arguments are a JSON object, which
+ * must end in `}`, so a client cannot parse — and so cannot run — a call
+ * until the screened tail arrives. Grows monotonically as `received` grows.
+ */
+export function screenableArgumentsPrefix(received) {
+    return received.replace(/[\s}\]]+$/, '');
+}

package/dist/http/routes/v1-chat.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { createLogger, isLocalProvider } from '@bendyline/gezel';
+import { createLogger, isLocalProvider, toolCallBlockedHistoryEntry, } from '@bendyline/gezel';
 import { Hono } from 'hono';
 import { streamSSE } from 'hono/streaming';
 import { ZodError } from 'zod';
@@ -14,6 +14,7 @@ import { engineFailure } from '../openai-compat/engine-failure.js';
 import { overlayOpenAiRequestTuning } from '../openai-compat/request-tuning.js';
 import { createStreamingDiagnostics, snapshotStreamingDiagnostics, } from '../openai-compat/streaming-telemetry.js';
 import { runNonStreaming, runStreaming } from '../openai-compat/streaming.js';
+import { createToolCallScreen } from '../openai-compat/tool-call-screen.js';
 import { ChatCompletionRequestSchema, flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, translateMessagesWithPrefix, } from '../openai-compat/translate.js';
 const log = createLogger('v1-chat');
 // Match ChatManager's user-turn ceilings. Caller-owned app routes create a
@@ -402,6 +403,17 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ctx.chat.recordExternalUsage?.(target.provider, u);
             });
             const appId = c.get('auth')?.appId ?? 'unauthenticated';
+            const toolCallScreen = createToolCallScreen((tool, indicators) => {
+                const entry = toolCallBlockedHistoryEntry({
+                    tool,
+                    surface: 'openai',
+                    indicators,
+                    appId,
+                    ...(externalTurn ? { sessionId: externalTurn.sessionId } : {}),
+                });
+                log.warn(`${entry.summary} (app ${appId})`);
+                void ctx.history?.log(entry).catch(() => { });
+            });
             const logCompletion = () => {
                 void ctx.history
                     ?.log({
@@ -482,6 +494,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                             ...(opts.keepaliveIntervalMs !== undefined
                                 ? { keepaliveIntervalMs: opts.keepaliveIntervalMs }
                                 : {}),
+                            toolCallScreen,
                             ...(opts.streamToolCallDeltas === true ? { streamToolCallDeltas: true } : {}),
                             ...(opts.streamToolCallDeltas === true && externalTools
                                 ? { toolCallNames: externalTools.map((tool) => tool.name) }
@@ -574,6 +587,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 ...(attachments.length > 0 ? { attachments } : {}),
                 sendOptions: { queue, timeoutMs: turnTimeoutMs },
                 ...(lengthCapTokens !== undefined ? { lengthCapTokens } : {}),
+                toolCallScreen,
             });
             const choice = response.choices[0];
             await externalTurn

package/dist/http/routes/v1-responses.js

@@ -1,4 +1,4 @@
-import { createLogger } from '@bendyline/gezel';
+import { createLogger, toolCallBlockedHistoryEntry } from '@bendyline/gezel';
 import { Hono } from 'hono';
 import { bodyLimit } from 'hono/body-limit';
 import { streamSSE } from 'hono/streaming';
@@ -11,6 +11,7 @@ import { resolveChatTarget, resolvePinnedModelTarget, } from '../openai-compat/c
 import { engineFailure } from '../openai-compat/engine-failure.js';
 import { runResponsesNonStreaming, runResponsesStreaming, } from '../openai-compat/responses-streaming.js';
 import { ResponsesRequestSchema, translateResponsesRequest, } from '../openai-compat/responses-translate.js';
+import { createToolCallScreen } from '../openai-compat/tool-call-screen.js';
 import { flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, } from '../openai-compat/translate.js';
 const log = createLogger('v1-responses');
 const MAX_RESPONSES_BODY_BYTES = 16 * 1024 * 1024;
@@ -180,8 +181,19 @@ export function v1ResponsesRoutes(ctx, opts = {}) {
             const detachRequestAbort = () => {
                 requestSignal.removeEventListener('abort', abortTurn);
             };
+            const toolCallScreen = createToolCallScreen((tool, indicators) => {
+                const entry = toolCallBlockedHistoryEntry({
+                    tool,
+                    surface: 'responses',
+                    indicators,
+                    appId,
+                });
+                log.warn(`${entry.summary} (app ${appId})`);
+                void ctx.history?.log(entry).catch(() => { });
+            });
             const runnerOptions = {
                 ...(attachments.length > 0 ? { attachments } : {}),
+                toolCallScreen,
                 ...(lengthCapTokens !== undefined ? { lengthCapTokens } : {}),
                 toolBindings: translated.toolBindings,
                 toolKinds: translated.toolKinds,

package/dist/providers/image/types.d.ts

@@ -118,6 +118,8 @@ export interface ImageGenerationMeta {
      * forward it untouched.
      */
     img2imgSkippedReason?: string;
+    /** Provider limits or adjustments to the requested image settings. */
+    settingsNotes?: string[];
 }
 export interface ImageGenerationOutput {
     png: Buffer;

package/dist/providers/llama-cpp/provider.js

@@ -32,6 +32,13 @@ import { classifyStartupLine } from './stdout-parser.js';
 export * from '@bendyline/gezel/local-loop';
 export { isFileRepairTurn as isScenarioFileRepairTurn } from '@bendyline/gezel/local-loop';
 const log = createLogger('llama-cpp');
+/**
+ * How long shutdown waits for the slot caches to reach disk. The app gives
+ * the whole daemon 15 s to quit, and a save the engine never answers must
+ * not spend all of it: an unsaved or half-written slot only means a fresh
+ * prefill next time, because a restore that fails falls back to one.
+ */
+const SHUTDOWN_FLUSH_BUDGET_MS = 8_000;
 export class LlamaCppProvider {
     name = 'llama-cpp';
     queue;
@@ -627,12 +634,21 @@ export class LlamaCppProvider {
         // llama-server exits the slot save endpoint is gone. flushAll is
         // best-effort; failures during shutdown shouldn't block the stop.
         if (this.cacheAdapter) {
+            let timer;
+            const budget = new Promise((resolve) => {
+                timer = setTimeout(() => resolve('timeout'), SHUTDOWN_FLUSH_BUDGET_MS);
+                timer.unref?.();
+            });
             try {
-                await this.cacheAdapter.flushAll();
+                // Best-effort persistence: a failure only means the next boot pays
+                // the prefill cost on resume.
+                const outcome = await Promise.race([this.cacheAdapter.flushAll().catch(() => 0), budget]);
+                if (outcome === 'timeout') {
+                    log.warn(`slot cache save still running after ${SHUTDOWN_FLUSH_BUDGET_MS}ms at shutdown; stopping the engine`);
+                }
             }
-            catch {
-                // Best-effort persistence — failure here just means the next
-                // boot pays the prefill cost on resume, same as before.
+            finally {
+                clearTimeout(timer);
             }
         }
         await this.supervisor?.stop();

package/dist/providers/types.d.ts

@@ -1,4 +1,4 @@
-import type { CodexPermissionModeCompat, ProviderName } from '@bendyline/gezel';
+import type { CodexPermissionModeCompat, EgressIndicator, ProviderName } from '@bendyline/gezel';
 import type { ActiveCraftbookStep, CompactionRequester, ExternalToolCall, ExternalToolSpec, LLMSession, ProviderSessionState, TerminalToolPolicy, WireTranscriptEntry } from '@bendyline/gezel/local-loop';
 import type { McpServerSpec } from '@bendyline/gezel/local-loop';
 import type { ResolvedModelProfile } from '../model-profile/types.js';
@@ -537,6 +537,12 @@ export interface ToolCallEvent {
     durationMs: number;
     success: boolean;
     errorMessage?: string;
+    /**
+     * Set when Gezel refused the call before it ran because it named a cloud
+     * metadata service, link-local address, data-drop or tunnel host, or
+     * namespace tool. The consumer records it in History.
+     */
+    egressIndicators?: EgressIndicator[];
     /**
      * Text returned by the tool when the provider exposes it. Producers must
      * redact known secrets before firing the event. ChatManager bounds this

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bendyline/gezel-inference",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Gezel's on-device inference runtime: native engines, local model management, embeddings, knowledge search, and OpenAI-compatible routes.",
   "license": "MIT",
   "keywords": [
@@ -73,9 +73,9 @@
     "!dist/**/__pycache__"
   ],
   "dependencies": {
-    "@bendyline/gezel": "1.2.9",
-    "@bendyline/gezel-catalog": "1.2.9",
-    "@bendyline/gezel-client": "1.2.9",
+    "@bendyline/gezel": "1.2.11",
+    "@bendyline/gezel-catalog": "1.2.11",
+    "@bendyline/gezel-client": "1.2.11",
     "@bendyline/gezel-knowledge": "1.2.9",
     "hono": "4.13.9",
     "tar": "7.5.21",