@dianshuv/copilot-api 0.10.0 → 0.10.1

package/dist/main.mjs

@@ -1348,7 +1348,7 @@ const patchClaude = defineCommand({
 
 //#endregion
 //#region package.json
-var version = "0.10.0";
+var version = "0.10.1";
 
 //#endregion
 //#region src/lib/adaptive-rate-limiter.ts
@@ -8011,6 +8011,472 @@ function translateErrorToAnthropicErrorEvent(error) {
 	};
 }
 
+//#endregion
+//#region src/routes/messages/tool-call-recovery.ts
+const ENVELOPE = String.raw`(?:<(?:antml:)?function_calls>|call)`;
+const INVOKE_BODY = String.raw`<(?:antml:)?invoke\s+name="[^"]+">[\s\S]*?</(?:antml:)?invoke>`;
+const LEAKED_REGION_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*(?:` + INVOKE_BODY + String.raw`\s*)+(?:</(?:antml:)?function_calls>)?`, "g");
+const INCOMPLETE_LEAK_TAIL_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\b[\s\S]*$`);
+const LEAK_OPEN_RE = new RegExp(String.raw`(?:^|\n)[ \t]*` + ENVELOPE + String.raw`[ \t\n]*<(?:antml:)?invoke\s+name="`);
+const INVOKE_RE = /<(?:antml:)?invoke\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?invoke>/g;
+const PARAMETER_RE = /<(?:antml:)?parameter\s+name="([^"]+)">([\s\S]*?)<\/(?:antml:)?parameter>/g;
+function coerceParamValue(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.startsWith("{") && trimmed.endsWith("}") || trimmed.startsWith("[") && trimmed.endsWith("]")) try {
+		return JSON.parse(trimmed);
+	} catch {
+		return raw;
+	}
+	return raw;
+}
+function parseRegionInvokes(region, knownTools) {
+	const calls = [];
+	for (const invokeMatch of region.matchAll(INVOKE_RE)) {
+		const name = invokeMatch[1];
+		if (knownTools && !knownTools.has(name)) continue;
+		const input = {};
+		for (const paramMatch of invokeMatch[2].matchAll(PARAMETER_RE)) input[paramMatch[1]] = coerceParamValue(paramMatch[2]);
+		calls.push({
+			name,
+			input
+		});
+	}
+	return calls;
+}
+/**
+* Split assistant text into ordered segments — dropping leaked envelope markup
+* (and undeclared-tool invokes) while preserving the natural-language on either
+* side and the pre/tool/post ordering. Returns a single text segment when there
+* is no leak. Shared by both response recovery paths so they cannot diverge.
+*/
+function recoverSegments(text, knownTools) {
+	const segments = [];
+	let cursor = 0;
+	let sawRegion = false;
+	for (const region of text.matchAll(LEAKED_REGION_RE)) {
+		sawRegion = true;
+		const pre = text.slice(cursor, region.index);
+		if (pre.trim() !== "") segments.push({
+			kind: "text",
+			text: pre
+		});
+		for (const call of parseRegionInvokes(region[0], knownTools)) segments.push({
+			kind: "tool",
+			call
+		});
+		cursor = region.index + region[0].length;
+	}
+	if (!sawRegion) return [{
+		kind: "text",
+		text
+	}];
+	const post = text.slice(cursor);
+	if (post.trim() !== "") segments.push({
+		kind: "text",
+		text: post
+	});
+	return segments;
+}
+/** True when `text` contains at least one complete, envelope-wrapped leak. */
+function containsLeakedToolCall(text) {
+	if (!text.includes("invoke")) return false;
+	for (const _region of text.matchAll(LEAKED_REGION_RE)) return true;
+	return false;
+}
+/**
+* Remove complete leaked tool-call regions from assistant text, preserving the
+* surrounding natural-language on both sides.
+*/
+function stripLeakedToolCalls(text) {
+	if (!text.includes("invoke")) return text;
+	const stripped = text.replaceAll(LEAKED_REGION_RE, "");
+	if (stripped === text) return text;
+	return stripped.replace(/[ \t\n]+$/, "");
+}
+/**
+* Declared CLIENT tool names for a payload. Server-side tools are excluded (they
+* are not client-executable, so a leaked server-tool invoke must not become a
+* client tool_use). Always returns a set — an empty set means "no declared
+* tools", which correctly drops every leaked invoke rather than trusting it.
+*/
+function toolNameSet(tools) {
+	return new Set((tools ?? []).filter((tool) => !isServerToolType(tool.type)).map((tool) => tool.name));
+}
+const EMPTIED_ASSISTANT_PLACEHOLDER = "[malformed tool call removed by proxy]";
+function historyHasLeak(text) {
+	if (!text.includes("invoke")) return false;
+	return containsLeakedToolCall(text) || INCOMPLETE_LEAK_TAIL_RE.test(text);
+}
+function scrubHistoryText(text) {
+	const stripped = stripLeakedToolCalls(text);
+	const final = stripped.replace(INCOMPLETE_LEAK_TAIL_RE, "");
+	return final === stripped ? stripped : final.replace(/[ \t\n]+$/, "");
+}
+/**
+* Request-side de-poison. Strips leaked tool-call markup (complete and truncated)
+* from assistant text in the inbound history so the model never sees a
+* text-format exemplar to imitate — breaking the self-reinforcing poisoning
+* loop. When stripping empties an assistant message, the message is kept with a
+* short placeholder rather than dropped, so role alternation is preserved.
+*/
+function dePoisonAssistantMessages(payload) {
+	if (!payload.messages.some((m) => m.role === "assistant" && (typeof m.content === "string" ? m.content.includes("invoke") : m.content.some((b) => b.type === "text" && b.text.includes("invoke"))))) return payload;
+	let changed = false;
+	const messages = [];
+	for (const msg of payload.messages) {
+		if (msg.role !== "assistant") {
+			messages.push(msg);
+			continue;
+		}
+		if (typeof msg.content === "string") {
+			if (!historyHasLeak(msg.content)) {
+				messages.push(msg);
+				continue;
+			}
+			changed = true;
+			const cleaned = scrubHistoryText(msg.content);
+			messages.push({
+				...msg,
+				content: cleaned.trim() === "" ? EMPTIED_ASSISTANT_PLACEHOLDER : cleaned
+			});
+			continue;
+		}
+		if (!msg.content.some((b) => b.type === "text" && historyHasLeak(b.text))) {
+			messages.push(msg);
+			continue;
+		}
+		changed = true;
+		const content = msg.content.flatMap((b) => {
+			if (b.type !== "text" || !historyHasLeak(b.text)) return [b];
+			const cleaned = scrubHistoryText(b.text);
+			return cleaned.trim() === "" ? [] : [{
+				...b,
+				text: cleaned
+			}];
+		});
+		messages.push(content.length > 0 ? {
+			...msg,
+			content
+		} : {
+			...msg,
+			content: EMPTIED_ASSISTANT_PLACEHOLDER
+		});
+	}
+	return changed ? {
+		...payload,
+		messages
+	} : payload;
+}
+let recoveryCounter = 0;
+function nextToolUseId() {
+	recoveryCounter += 1;
+	return `toolu_recovered_${Date.now().toString(36)}_${recoveryCounter}`;
+}
+/**
+* Non-streaming recovery: rewrites any assistant text block that contains a
+* leaked tool call into ordered [pre-text, tool_use(s), post-text] blocks,
+* dropping the leak markup and undeclared-tool invokes. stop_reason is flipped to
+* tool_use only when a real call was recovered AND upstream reported a plain
+* end-of-turn (so max_tokens / refusal / pause_turn survive).
+*/
+function recoverLeakedToolCallsInResponse(response, knownTools) {
+	let changed = false;
+	let recoveredCall = false;
+	const content = [];
+	for (const block of response.content) {
+		if (block.type !== "text" || !containsLeakedToolCall(block.text)) {
+			content.push(block);
+			continue;
+		}
+		changed = true;
+		for (const segment of recoverSegments(block.text, knownTools)) if (segment.kind === "text") content.push({
+			type: "text",
+			text: segment.text
+		});
+		else {
+			recoveredCall = true;
+			content.push({
+				type: "tool_use",
+				id: nextToolUseId(),
+				name: segment.call.name,
+				input: segment.call.input
+			});
+		}
+	}
+	if (!changed) return response;
+	const flip = recoveredCall && (response.stop_reason === "end_turn" || response.stop_reason === null);
+	return {
+		...response,
+		content,
+		stop_reason: flip ? "tool_use" : response.stop_reason
+	};
+}
+function out(event) {
+	return {
+		event,
+		data: JSON.stringify(event)
+	};
+}
+const TAIL_GUARD = 48;
+const MAX_CAPTURE = 65536;
+/**
+* Per-response streaming transformer. Feed it each parsed upstream Anthropic
+* event (plus the original `data` string); forward whatever it returns; call
+* `flush()` once the upstream stream ends.
+*
+* Identity passthrough until an envelope appears in a text block; from there it
+* suppresses the leaked markup, emits structured tool_use block(s) (declared
+* tools only) plus any trailing prose, shifts the indices of later blocks, and
+* flips a plain end-of-turn stop_reason to tool_use.
+*/
+var LeakedToolCallStreamRecovery = class {
+	extraBlocks = 0;
+	text = null;
+	converted = false;
+	knownTools;
+	constructor(knownTools) {
+		this.knownTools = knownTools;
+	}
+	process(event, rawData) {
+		switch (event.type) {
+			case "content_block_start": return this.onBlockStart(event, rawData);
+			case "content_block_delta": return this.onBlockDelta(event, rawData);
+			case "content_block_stop": return this.onBlockStop(event, rawData);
+			case "message_delta": return this.onMessageDelta(event, rawData);
+			default: return [{
+				event,
+				data: rawData
+			}];
+		}
+	}
+	/** Flush any pending (buffered/capturing) text block at end of stream. */
+	flush() {
+		return this.flushPending();
+	}
+	reindexed(event, rawData) {
+		if (this.extraBlocks === 0) return {
+			event,
+			data: rawData
+		};
+		const shifted = {
+			...event,
+			index: event.index + this.extraBlocks
+		};
+		return {
+			event: shifted,
+			data: JSON.stringify(shifted)
+		};
+	}
+	onBlockStart(event, rawData) {
+		if (event.content_block.type === "text") {
+			this.text = {
+				upstreamIndex: event.index,
+				opened: false,
+				buffer: "",
+				forwarded: 0,
+				capturing: false,
+				captureStart: 0,
+				abandoned: false
+			};
+			return [];
+		}
+		return [this.reindexed(event, rawData)];
+	}
+	onBlockDelta(event, rawData) {
+		const t = this.text;
+		if (!t || event.index !== t.upstreamIndex || event.delta.type !== "text_delta") return [this.reindexed(event, rawData)];
+		t.buffer += event.delta.text;
+		if (t.capturing) {
+			if (t.buffer.length - t.captureStart > MAX_CAPTURE) return this.abandonCapture(t);
+			return [];
+		}
+		if (!t.abandoned) {
+			const open = LEAK_OPEN_RE.exec(t.buffer);
+			if (open) return this.beginCapture(t, open.index);
+		}
+		return this.flushSafe(t);
+	}
+	onBlockStop(event, rawData) {
+		const t = this.text;
+		if (!t || event.index !== t.upstreamIndex) return [this.reindexed(event, rawData)];
+		return this.flushPending();
+	}
+	onMessageDelta(event, rawData) {
+		const flushed = this.flushPending();
+		const isNaturalEnd = event.delta.stop_reason === "end_turn" || event.delta.stop_reason === null;
+		if (!this.converted || !isNaturalEnd) return [...flushed, {
+			event,
+			data: rawData
+		}];
+		const rewritten = {
+			...event,
+			delta: {
+				...event.delta,
+				stop_reason: "tool_use"
+			}
+		};
+		return [...flushed, out(rewritten)];
+	}
+	emitText(t, chunk) {
+		const idx = t.upstreamIndex + this.extraBlocks;
+		const events = [];
+		if (!t.opened) {
+			events.push(out({
+				type: "content_block_start",
+				index: idx,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}));
+			t.opened = true;
+		}
+		events.push(out({
+			type: "content_block_delta",
+			index: idx,
+			delta: {
+				type: "text_delta",
+				text: chunk
+			}
+		}));
+		return events;
+	}
+	flushSafe(t) {
+		const safeEnd = t.buffer.length - TAIL_GUARD;
+		if (safeEnd <= t.forwarded) return [];
+		const chunk = t.buffer.slice(t.forwarded, safeEnd);
+		t.forwarded = safeEnd;
+		return this.emitText(t, chunk);
+	}
+	beginCapture(t, start) {
+		t.captureStart = start;
+		t.capturing = true;
+		if (start > t.forwarded) {
+			const preamble = t.buffer.slice(t.forwarded, start);
+			t.forwarded = start;
+			return this.emitText(t, preamble);
+		}
+		return [];
+	}
+	abandonCapture(t) {
+		t.capturing = false;
+		t.abandoned = true;
+		const events = this.emitText(t, t.buffer.slice(t.forwarded));
+		t.forwarded = t.buffer.length;
+		return events;
+	}
+	emitTextBlock(index, text) {
+		return [
+			out({
+				type: "content_block_start",
+				index,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}),
+			out({
+				type: "content_block_delta",
+				index,
+				delta: {
+					type: "text_delta",
+					text
+				}
+			}),
+			out({
+				type: "content_block_stop",
+				index
+			})
+		];
+	}
+	emitToolBlock(index, call) {
+		return [
+			out({
+				type: "content_block_start",
+				index,
+				content_block: {
+					type: "tool_use",
+					id: nextToolUseId(),
+					name: call.name,
+					input: {}
+				}
+			}),
+			out({
+				type: "content_block_delta",
+				index,
+				delta: {
+					type: "input_json_delta",
+					partial_json: JSON.stringify(call.input)
+				}
+			}),
+			out({
+				type: "content_block_stop",
+				index
+			})
+		];
+	}
+	flushPending() {
+		const t = this.text;
+		if (!t) return [];
+		this.text = null;
+		if (t.capturing) return this.finishCapture(t);
+		const events = [];
+		if (t.buffer.length > t.forwarded) events.push(...this.emitText(t, t.buffer.slice(t.forwarded)));
+		const idx = t.upstreamIndex + this.extraBlocks;
+		if (!t.opened) {
+			events.push(out({
+				type: "content_block_start",
+				index: idx,
+				content_block: {
+					type: "text",
+					text: ""
+				}
+			}));
+			t.opened = true;
+		}
+		events.push(out({
+			type: "content_block_stop",
+			index: idx
+		}));
+		return events;
+	}
+	finishCapture(t) {
+		const segments = recoverSegments(t.buffer.slice(t.captureStart), this.knownTools);
+		const hasTool = segments.some((s) => s.kind === "tool");
+		const base = t.upstreamIndex + this.extraBlocks;
+		const events = [];
+		if (!hasTool) {
+			const text = segments.map((s) => s.kind === "text" ? s.text : "").join("");
+			if (text !== "") events.push(...this.emitText(t, text), out({
+				type: "content_block_stop",
+				index: base
+			}));
+			else if (t.opened) events.push(out({
+				type: "content_block_stop",
+				index: base
+			}));
+			else this.extraBlocks -= 1;
+			return events;
+		}
+		this.converted = true;
+		let cursor = base;
+		if (t.opened) {
+			events.push(out({
+				type: "content_block_stop",
+				index: base
+			}));
+			cursor = base + 1;
+		}
+		for (const [i, segment] of segments.entries()) {
+			const idx = cursor + i;
+			events.push(...segment.kind === "text" ? this.emitTextBlock(idx, segment.text) : this.emitToolBlock(idx, segment.call));
+		}
+		const clientBlocks = (t.opened ? 1 : 0) + segments.length;
+		this.extraBlocks += clientBlocks - 1;
+		return events;
+	}
+};
+
 //#endregion
 //#region src/routes/messages/direct-anthropic-handler.ts
 /**
@@ -8069,7 +8535,7 @@ async function handleDirectAnthropicCompletion(c, anthropicPayload, ctx, initiat
 				});
 			});
 		}
-		return handleDirectAnthropicNonStreamingResponse(c, response, ctx, truncateResult, effectivePayload);
+		return handleDirectAnthropicNonStreamingResponse(c, recoverLeakedToolCallsInResponse(response, toolNameSet(effectivePayload.tools)), ctx, truncateResult, effectivePayload);
 	} catch (error) {
 		if (error instanceof HTTPError && error.status === 413) logPayloadSizeInfoAnthropic(effectivePayload, selectedModel);
 		recordErrorResponse(ctx, anthropicPayload.model, error, "messages", anthropicPayload.stream ?? false);
@@ -8187,6 +8653,19 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 	const acc = createAnthropicStreamAccumulator();
 	const checkRepetition = createStreamRepetitionChecker(`anthropic:${anthropicPayload.model}`);
 	const serverToolFilter = createServerToolBlockFilter();
+	const recovery = new LeakedToolCallStreamRecovery(toolNameSet(anthropicPayload.tools));
+	const forward = async (recovered) => {
+		const outEvent = recovered.event;
+		processAnthropicEvent(outEvent, acc);
+		if (outEvent.type === "content_block_start") logServerToolBlock(outEvent.content_block);
+		const forwardData = serverToolFilter.rewriteEvent(outEvent, recovered.data);
+		if (forwardData === null) return;
+		const echoedData = echoForwardData(forwardData, outEvent.type, ctx);
+		await stream.writeSSE({
+			event: outEvent.type,
+			data: echoedData
+		});
+	};
 	try {
 		for await (const rawEvent of response) {
 			consola.debug("Direct Anthropic raw stream event:", JSON.stringify(rawEvent));
@@ -8199,17 +8678,10 @@ async function handleDirectAnthropicStreamingResponse(opts) {
 				consola.error("Failed to parse Anthropic stream event:", parseError, rawEvent.data);
 				continue;
 			}
-			processAnthropicEvent(event, acc);
-			if (event.type === "content_block_start") logServerToolBlock(event.content_block);
 			if (event.type === "content_block_delta" && event.delta.type === "text_delta") checkRepetition(event.delta.text);
-			const forwardData = serverToolFilter.rewriteEvent(event, rawEvent.data);
-			if (forwardData === null) continue;
-			const echoedData = echoForwardData(forwardData, event.type, ctx);
-			await stream.writeSSE({
-				event: rawEvent.event || event.type,
-				data: echoedData
-			});
+			for (const recovered of recovery.process(event, rawEvent.data)) await forward(recovered);
 		}
+		for (const recovered of recovery.flush()) await forward(recovered);
 		recordAnthropicStreamingResponse(acc, anthropicPayload.model, ctx);
 		completeTracking(ctx.trackingId, acc.inputTokens, acc.outputTokens, ctx.queueWaitMs, void 0, {
 			model: acc.model || anthropicPayload.model,
@@ -8536,12 +9008,13 @@ async function handleCompletion(c) {
 			system: extractSystemPrompt(p.system)
 		})
 	});
-	logToolInfo(anthropicPayload);
-	const subagentMarker = parseSubagentMarkerFromFirstUser(anthropicPayload);
+	const sanitizedPayload = dePoisonAssistantMessages(anthropicPayload);
+	logToolInfo(sanitizedPayload);
+	const subagentMarker = parseSubagentMarkerFromFirstUser(sanitizedPayload);
 	const initiatorOverride = subagentMarker ? "agent" : void 0;
 	if (subagentMarker) consola.debug("Detected Subagent marker:", JSON.stringify(subagentMarker));
-	if (supportsDirectAnthropicApi(anthropicPayload.model)) return handleDirectAnthropicCompletion(c, anthropicPayload, ctx, initiatorOverride);
-	return handleTranslatedCompletion(c, anthropicPayload, ctx, initiatorOverride);
+	if (supportsDirectAnthropicApi(sanitizedPayload.model)) return handleDirectAnthropicCompletion(c, sanitizedPayload, ctx, initiatorOverride);
+	return handleTranslatedCompletion(c, sanitizedPayload, ctx, initiatorOverride);
 }
 /**
 * Log tool-related information for debugging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dianshuv/copilot-api",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code!",
   "author": "dianshuv",
   "type": "module",