@kernel.chat/kbot 3.99.28 → 3.99.29

package/dist/agent.js

@@ -172,6 +172,25 @@ async function tryLocalFirst(message) {
     if (lower === 'pwd' || lower === 'where am i') {
         return process.cwd();
     }
+    // Open-source / license short-circuit. Discovered by the eval harness on
+    // 2026-04-20: gemma4:latest confidently answered "No, I'm proprietary" to
+    // "Are you open source?". kbot is MIT — this is a trust-damaging
+    // confabulation. Answer deterministically from the license field.
+    if (/\b(open\s+source|open-source|proprietary|closed\s+source|license)\b/i.test(lower)
+        && message.length < 120) {
+        return 'Yes — kbot is open source under the MIT License. Source: https://github.com/isaacsight/kernel';
+    }
+    // Fake-tool lookup. "Do you have a tool called X?" should be answered
+    // against the tool registry, not the LLM's priors. Probe-flake ("No" →
+    // "Yes" on the same question) observed on 2026-04-20.
+    const toolQuery = message.match(/do\s+you\s+have\s+a\s+tool\s+(?:called|named)?\s*['"]?([\w-]+)['"]?\??/i);
+    if (toolQuery) {
+        const name = toolQuery[1];
+        const exists = !!getTool(name);
+        return exists
+            ? `Yes — "${name}" is a registered tool.`
+            : `No — "${name}" is not a registered kbot tool.`;
+    }
     // Identity short-circuit — deterministic answers for self-queries that
     // small models confabulate on. Eval 2026-04-20 showed gemma4:latest
     // answering "v3.99.14" for "what version are you" even with the IDENTITY

package/dist/math-guard.js

@@ -15,6 +15,13 @@
  * No eval(), no Function(). Pure regex + arithmetic.
  */
 const EXPR_RE = /(?<!\w)(-?\d+(?:\.\d+)?)\s*([+\-*×/÷%])\s*(-?\d+(?:\.\d+)?)(?!\w)/g;
+const WORD_OPS = [
+    { re: /\b(-?\d+(?:\.\d+)?)\s+(?:times|multiplied\s+by)\s+(-?\d+(?:\.\d+)?)\b/gi, op: '*' },
+    { re: /\b(-?\d+(?:\.\d+)?)\s+plus\s+(-?\d+(?:\.\d+)?)\b/gi, op: '+' },
+    { re: /\b(-?\d+(?:\.\d+)?)\s+minus\s+(-?\d+(?:\.\d+)?)\b/gi, op: '-' },
+    { re: /\b(-?\d+(?:\.\d+)?)\s+(?:divided\s+by|over)\s+(-?\d+(?:\.\d+)?)\b/gi, op: '/' },
+    { re: /\b(-?\d+(?:\.\d+)?)\s+mod\s+(-?\d+(?:\.\d+)?)\b/gi, op: '%' },
+];
 function normalizeOp(op) {
     switch (op) {
         case '+': return '+';
@@ -72,6 +79,25 @@ export function extractArithmetic(message) {
         if (out.length >= 10)
             break;
     }
+    // Word-form operators — "847 times 239", "3 plus 4", "10 divided by 2".
+    for (const { re, op } of WORD_OPS) {
+        for (const m of message.matchAll(re)) {
+            const a = Number.parseFloat(m[1]);
+            const b = Number.parseFloat(m[2]);
+            const r = compute(a, op, b);
+            if (r === null || !Number.isFinite(r))
+                continue;
+            const canonical = `${m[1]} ${op} ${m[2]}`;
+            if (seen.has(canonical))
+                continue;
+            seen.add(canonical);
+            out.push({ expression: canonical, result: r });
+            if (out.length >= 10)
+                break;
+        }
+        if (out.length >= 10)
+            break;
+    }
     return out;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernel.chat/kbot",
-  "version": "3.99.28",
+  "version": "3.99.29",
   "description": "Open-source terminal AI agent. 787+ tools, 35 agents, 20 providers. Dreams, learns, watches your system. Controls your phone. Fully local, fully sovereign. MIT.",
   "type": "module",
   "repository": {