@gajae-code/agent-core 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## [Unreleased]
 
+## [0.7.3] - 2026-06-25
+### Added
+
+- Added Composer evidence publication gates in the agent loop, so Composer-harness turns emit structured evidence under defined publication conditions (#1106).
+
+### Fixed
+
+- Wired the previously-dead GPT-5 harmony-leak detector into the streamed assistant-message path for openai-codex turns: recoverable tool-argument leaks are now recovered and everything else is routed through the existing abort-retry/audit loop, and the contaminated streamed message is removed (abort-retry) or replaced (truncate-resume) from working context so the model does not replay its own leak as history. Added detection of the leaked Anthropic-style `<invoke name="…">` envelope dialect that gpt-5.5 intermittently emits as visible assistant text instead of a native function call (#1069).
+- Detect proxy-level context overflow from empty responses: some proxies (notably LiteLLM) return an empty `content: []` with `stopReason: "stop"` and fabricated near-zero usage when the upstream context window is exceeded; the agent loop now recognizes this pattern and promotes it to an error so the existing overflow/compaction recovery path fires instead of freezing the session as a clean completion (#1102).
+- Hardened the Composer trace mutation classifier and its recovery-target guard (#1105).
+
 ## [0.7.2] - 2026-06-24
 
 ### Fixed

package/dist/types/harmony-leak.d.ts

@@ -9,7 +9,7 @@
  */
 import type { AssistantMessage, Model } from "@gajae-code/ai";
 declare const SIGNAL_ORDER: readonly ["M", "C", "G", "S", "B", "R", "T"];
-export type HarmonySignalClass = "H" | (typeof SIGNAL_ORDER)[number];
+export type HarmonySignalClass = "H" | "I" | (typeof SIGNAL_ORDER)[number];
 export type HarmonySurface = "assistant_text" | "assistant_thinking" | "tool_arg";
 export interface HarmonySignal {
     classes: HarmonySignalClass[];

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/agent-core",
-	"version": "0.7.2",
+	"version": "0.7.3",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://gaebal-gajae.dev",
 	"author": "Yeachan-Heo",
@@ -35,9 +35,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@gajae-code/ai": "0.7.2",
-		"@gajae-code/natives": "0.7.2",
-		"@gajae-code/utils": "0.7.2",
+		"@gajae-code/ai": "0.7.3",
+		"@gajae-code/natives": "0.7.3",
+		"@gajae-code/utils": "0.7.3",
 		"@opentelemetry/api": "^1.9.0"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -7,6 +7,7 @@ import {
 	type AssistantMessageEvent,
 	type Context,
 	EventStream,
+	isContextOverflow,
 	isZodSchema,
 	streamSimple,
 	type ToolResultMessage,
@@ -17,9 +18,12 @@ import {
 import { sanitizeText } from "@gajae-code/utils";
 import {
 	createHarmonyAuditEvent,
+	detectHarmonyLeakInAssistantMessage,
+	extractHarmonyRemoved,
 	type HarmonyDetection,
 	type HarmonyRecoveredToolCall,
 	isHarmonyLeakMitigationTarget,
+	recoverHarmonyToolCall,
 	signalListLabel,
 } from "./harmony-leak";
 import { type AgentRunCoverage, type AgentRunSummary, ToolCallBlockedError } from "./run-collector";
@@ -51,6 +55,15 @@ import type {
 
 /** Sentinel returned by the abort race in `streamAssistantResponse`. */
 const ABORTED: unique symbol = Symbol("agent-loop-aborted");
+/**
+ * Detect empty "successful" responses that indicate a proxy-level context
+ * overflow (e.g. LiteLLM returning `content: []`, `stopReason: "stop"`, and a
+ * fabricated near-zero usage). We delegate to {@link isContextOverflow} which
+ * has the threshold constant, so the detection logic stays in one place.
+ */
+function isEmptyResponseOverflow(message: AssistantMessage): boolean {
+	return isContextOverflow(message);
+}
 
 class HarmonyLeakInterruption extends Error {
 	constructor(
@@ -502,6 +515,20 @@ async function runLoopBody(
 					streamFn,
 					harmonyRetryAttempt,
 				);
+				// Post-stream harmony-leak detection. The mitigation scaffolding
+				// below (HarmonyLeakInterruption catch + retry/recover/audit,
+				// plus harmonyAbortController) existed but nothing invoked the
+				// detector, so leaks on openai-codex models were never caught.
+				// Detect on the completed message and route recoverable tool-arg
+				// leaks through recovery, everything else through abort-retry.
+				if (isHarmonyLeakMitigationTarget(config.model)) {
+					const detection = detectHarmonyLeakInAssistantMessage(message);
+					if (detection) {
+						const rec = recoverHarmonyToolCall(message, detection);
+						const removed = rec ? rec.removed : extractHarmonyRemoved(message, detection);
+						throw new HarmonyLeakInterruption(detection, removed, rec);
+					}
+				}
 				harmonyRetryAttempt = 0;
 				harmonyTruncateResumeCount = 0;
 			} catch (err) {
@@ -516,6 +543,15 @@ async function runLoopBody(
 					harmonyTruncateResumeCount++;
 					recovered = err.recovered;
 					message = recovered.message;
+					// Replace the contaminated assistant message committed during
+					// streaming with the recovered (truncated) one so the retry
+					// sees clean history.
+					{
+						const idx = currentContext.messages.length - 1;
+						if (idx >= 0 && currentContext.messages[idx]?.role === "assistant") {
+							currentContext.messages[idx] = recovered.message;
+						}
+					}
 					await emitHarmonyAudit(config, err, "truncate_resume", harmonyRetryAttempt);
 				} else {
 					if (harmonyRetryAttempt >= 2) {
@@ -526,12 +562,34 @@ async function runLoopBody(
 					}
 					await emitHarmonyAudit(config, err, "abort_retry", harmonyRetryAttempt);
 					harmonyRetryAttempt++;
+					// Drop the contaminated assistant message committed during
+					// streaming so the retry does not replay the model's own leak
+					// back to it as history.
+					{
+						const idx = currentContext.messages.length - 1;
+						if (idx >= 0 && currentContext.messages[idx]?.role === "assistant") {
+							currentContext.messages.splice(idx, 1);
+						}
+					}
 					continue;
 				}
 			}
 			newMessages.push(message);
 			let steeringMessagesFromExecution: AgentMessage[] | undefined;
 
+			// Detect empty "successful" responses (stopReason "stop" + empty content).
+			// Some proxies (e.g. LiteLLM) return this when the upstream model's context
+			// window is exceeded, fabricating a near-zero usage instead of surfacing an
+			// error. Without this guard the agent loop treats the empty response as a
+			// natural turn completion and stops, leaving the user with a frozen session.
+			// Promote it to an error so the overflow/compaction recovery path can fire.
+			if (message.stopReason === "stop" && message.content.length === 0 && isEmptyResponseOverflow(message)) {
+				message.stopReason = "error";
+				message.errorMessage = message.errorMessage
+					? `${message.errorMessage} | Provider returned an empty response with anomalously low token usage (possible context overflow via proxy)`
+					: "Provider returned an empty response with anomalously low token usage (possible context overflow via proxy)";
+			}
+
 			if (message.stopReason === "error" || message.stopReason === "aborted") {
 				// Create placeholder tool results for any tool calls in the aborted message
 				// This maintains the tool_use/tool_result pairing that the API requires

package/src/harmony-leak.ts

@@ -14,6 +14,19 @@ import type { AssistantMessage, Model, ToolCall } from "@gajae-code/ai";
 const MARKER_RE = /\bto=functions\.[A-Za-z_]\w*/g;
 const HARMONY_RE = /<\|(start|end|channel|message|call|return)\|>/g;
 
+// Leaked tool-call envelope (`I`): a structurally-committed Anthropic-style
+// invoke block (an opening tag carrying a name attribute). openai-codex models
+// use native function calling, so such an envelope appearing as visible
+// assistant text / thinking is always a leaked tool call — a different dialect
+// of the §1 phenomenon where the tool-call intent collapses into the content
+// channel (frequently prefixed by a glitch token such as a bare `court` line).
+// High precision: requires the opening tag AND a committed body (a parameter
+// tag or a closing invoke tag) within a short window, so prose that merely
+// mentions the tag does not trip. Like `H`, it trips on its own (outside code
+// fences). Source spelled with `\s` so this module does not self-trip.
+const INVOKE_OPEN_RE = /<invoke\s+name="[^"]+"\s*>/g;
+const INVOKE_BODY_RE = /<parameter\s+name="|<\/invoke>/;
+
 // Channel-word adjacency (`C`): channel/role name appearing immediately before the marker.
 const CHANNEL_WORD_RE = /\b(?:analysis|commentary|assistant|user|system|developer|tool)\s+to=functions\./;
 
@@ -66,7 +79,7 @@ const RECOVERY_REGISTRY: Record<string, RecoveryConfig> = {
 
 const SIGNAL_ORDER = ["M", "C", "G", "S", "B", "R", "T"] as const;
 
-export type HarmonySignalClass = "H" | (typeof SIGNAL_ORDER)[number];
+export type HarmonySignalClass = "H" | "I" | (typeof SIGNAL_ORDER)[number];
 
 export type HarmonySurface = "assistant_text" | "assistant_thinking" | "tool_arg";
 
@@ -154,6 +167,17 @@ export function detectHarmonyLeak(
 		signals.push(makeSignal(["H"], start, start + match[0].length, match[0]));
 	}
 
+	for (const match of text.matchAll(INVOKE_OPEN_RE)) {
+		const start = match.index ?? 0;
+		if (isInsideFence(fences, start)) continue;
+		// Require a committed body nearby so a bare mention of the tag in prose
+		// does not trip; a real leaked envelope continues into parameters or a
+		// close tag.
+		const forward = text.slice(start, Math.min(text.length, start + 400));
+		if (!INVOKE_BODY_RE.test(forward)) continue;
+		signals.push(makeSignal(["I"], start, start + match[0].length, match[0]));
+	}
+
 	for (const match of text.matchAll(MARKER_RE)) {
 		const start = match.index ?? 0;
 		if (isInsideFence(fences, start)) continue;
@@ -306,7 +330,7 @@ export function createHarmonyAuditEvent(params: {
 // ─── internals ──────────────────────────────────────────────────────────────
 
 function makeSignal(classes: HarmonySignalClass[], start: number, end: number, text: string): HarmonySignal {
-	if (classes[0] === "H") return { classes: ["H"], start, end, text };
+	if (classes[0] === "H" || classes[0] === "I") return { classes: [classes[0]], start, end, text };
 	const sorted: HarmonySignalClass[] = [];
 	for (const cls of SIGNAL_ORDER) {
 		if (classes.includes(cls)) sorted.push(cls);
@@ -402,7 +426,7 @@ function sha8(text: string): string {
 
 const PREVIEW_KEEP_RE = new RegExp(`[${SCRIPT_CLASS}\\s】【”“…」「、。]`, "u");
 const PREVIEW_TOKEN_RE =
-	/^(?:to=functions\.[A-Za-z_]\w*|analysis|commentary|assistant|user|system|developer|tool|changedFiles|RTLU|Jsii(?:_commentary)?|\x4aapgolly)/;
+	/^(?:to=functions\.[A-Za-z_]\w*|<\/?invoke\b[^>]*>|<parameter\b[^>]*>|analysis|commentary|assistant|user|system|developer|tool|changedFiles|RTLU|Jsii(?:_commentary)?|\x4aapgolly)/;
 
 /**
  * Privacy-safe preview for the audit log: keeps marker/channel/glitch tokens,