@livx.cc/agentx 0.99.35 → 0.99.36

package/dist/{Agent-USp7SIao.d.ts → Agent-Fr8uwN_l.d.ts}

@@ -199,6 +199,11 @@ interface RunResult {
     };
     /** True if ANY turn's usage was estimated (provider gave none) rather than exact — lets the UI mark cost `~`. */
     usageEstimated?: boolean;
+    /** Advertised tools the model NAMED in its own prose while the run's invocation ledger shows zero calls
+     *  to them — a fabricated tool use, proven against ground truth rather than guessed from phrasing.
+     *  Present even when the recovery nudge succeeded (it records that the turn needed rescuing); a host
+     *  can use it to tell the user plainly instead of shipping the model's invented result. */
+    fabricatedToolClaims?: string[];
     error?: unknown;
 }
 /** What a manual `/compact` actually freed (token estimates, ~4 chars/token). */
@@ -333,6 +338,13 @@ declare class AgentOptions {
      *  permission-asking instead of answers (see the nudge text in runLoop).
      *  Fires at most once per run and only for delegated runtimes (native turns never emit the trigger). */
     closeDelegatedTurns: boolean;
+    /** Catch a FABRICATED tool use: a turn that emits no tool call at all, yet whose text names an advertised
+     *  tool this run has never actually invoked — the model announcing `look_at_app` and then writing its own
+     *  "it didn't respond in time" result. No call-reactive layer can see it (there IS no call), and to every
+     *  surface it is indistinguishable from a real failure. The discriminator is the per-run invocation ledger,
+     *  not prose: a named tool with zero invocations is provable. On detection the loop nudges ONCE for a real
+     *  call, and records the names in `RunResult.fabricatedToolClaims` either way. */
+    catchFabricatedToolUse: boolean;
     /** Fold the dropped middle of an over-long transcript into a synthetic summary (edge-safe, no LLM). Off => drop-oldest. */
     compaction?: {
         maxMessages: number;
@@ -389,6 +401,11 @@ declare class Agent {
     private ctx;
     private lastTrimNotified;
     private activeTools;
+    /** Per-run ground truth: every tool name actually INVOKED this run (native dispatch + delegated
+     *  runtime activity). The ledger that makes a fabricated tool claim provable. Reset per run. */
+    private invokedTools;
+    /** Advertised tools this run's text claimed to have used while the ledger showed zero calls. */
+    private fabricatedClaims;
     private activeHooks?;
     private prepared;
     private systemPromptCache;
@@ -495,6 +512,28 @@ declare class Agent {
      *  non-result the model produced by going silent. Callers retry it rather than report "done". */
     private isEmptyStop;
     private consumeStream;
+    /**
+     * FABRICATED TOOL USE — the failure no call-reactive layer can see, because there IS no call.
+     *
+     * The model announces a tool ("I'll take a look with look_at_app"), emits no tool_use block at all, and
+     * then writes a plausible RESULT for the call it never made ("the app view didn't respond in time"). To
+     * every surface that turn is indistinguishable from a genuine timeout: the user reads a credible failure
+     * sentence, the logs show no tool call because none was made, and nothing errors. Malformed-call handling
+     * (dispatch's earlyError) cannot reach it — that path needs a tool_use block to exist.
+     *
+     * The discriminator is NOT prose. It is the per-run invocation ledger, which is ground truth: an advertised
+     * tool NAMED in the model's own text while `invokedTools` holds zero calls to it is a provable claim about
+     * an event that did not happen, not a guess about phrasing. Matching is on the exact registered tool name
+     * at word boundaries, so it cannot fire on ordinary English the way `endsOnAnnouncedAction` can.
+     *
+     * Deliberately narrow, because a false positive costs a metered step:
+     *  - only tools with a distinctive name (>= 4 chars, containing `_`, `-` or a capital) — a tool named `run`
+     *    or `web` would match half of English prose;
+     *  - only against the ledger for the WHOLE run, so referring back to a call it genuinely made earlier
+     *    ("the screenshot showed an empty grid") is honest and stays silent;
+     *  - only on a turn that made no tool calls of its own — a turn that DID call tools is closing normally.
+     */
+    private fabricatedToolNames;
     private dispatch;
     /** `/compact` aims to land the transcript at this fraction of the context window. */
     private static readonly COMPACT_TARGET;

package/dist/cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-USp7SIao.js';
+import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-Fr8uwN_l.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
 import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, g as MessageContent } from './tools-Byyh_bae.js';
 

package/dist/cli.js

@@ -261,10 +261,10 @@ function stripContent(content, stub) {
 function endsOnAnnouncedAction(text) {
   const sentences = text.split(/(?<=[.!?])\s+|\n+/).map((s) => s.trim()).filter(Boolean);
   const last = sentences[sentences.length - 1];
-  if (!last || NEXT_STEP.test(last)) return false;
+  if (!last || NEXT_STEP.test(last) || SIGN_OFF.test(last)) return false;
   return ANNOUNCED_ACTION.test(last);
 }
-var log2, p_sep, IMAGE_ELIDE_STUB, IMAGE_REF_SCHEME, REF_REGISTRY_MAX, refRegistry, isImageRefUrl, bearsImage, ANNOUNCED_ACTION, NEXT_STEP;
+var log2, p_sep, IMAGE_ELIDE_STUB, IMAGE_REF_SCHEME, REF_REGISTRY_MAX, refRegistry, isImageRefUrl, bearsImage, ANNOUNCED_ACTION, NEXT_STEP, SIGN_OFF;
 var init_llm = __esm({
   "src/llm.ts"() {
     "use strict";
@@ -279,6 +279,7 @@ var init_llm = __esm({
     bearsImage = (m) => messageHasImage(m.content) || toolImageRef(m.content) != null;
     ANNOUNCED_ACTION = /^(?:also\s+|now\s+|then\s+)*(?:let me\b|i'?ll\b|i will\b|i'?m going to\b|(?:re-?)?(?:check|search|scan|read|verify|run|inspect|expand|look|examin|continu|proceed|try|fetch|load|open|test|build|grep|find|review|trac|dig|explor)\w*ing\b)/i;
     NEXT_STEP = /^next (?:step|run|up)\b/i;
+    SIGN_OFF = /^let me know\b/i;
   }
 });
 
@@ -3727,6 +3728,13 @@ var AgentOptions = class {
    *  permission-asking instead of answers (see the nudge text in runLoop).
    *  Fires at most once per run and only for delegated runtimes (native turns never emit the trigger). */
   closeDelegatedTurns = true;
+  /** Catch a FABRICATED tool use: a turn that emits no tool call at all, yet whose text names an advertised
+   *  tool this run has never actually invoked — the model announcing `look_at_app` and then writing its own
+   *  "it didn't respond in time" result. No call-reactive layer can see it (there IS no call), and to every
+   *  surface it is indistinguishable from a real failure. The discriminator is the per-run invocation ledger,
+   *  not prose: a named tool with zero invocations is provable. On detection the loop nudges ONCE for a real
+   *  call, and records the names in `RunResult.fabricatedToolClaims` either way. */
+  catchFabricatedToolUse = true;
   /** Fold the dropped middle of an over-long transcript into a synthetic summary (edge-safe, no LLM). Off => drop-oldest. */
   compaction;
   /** Add `Checkpoint`/`Rollback` tools (requires the fs to be an OverlayFilesystem). */
@@ -3793,6 +3801,11 @@ var Agent = class _Agent {
   lastTrimNotified = 0;
   // last auto-trim drop count surfaced via host.notify (dedup)
   activeTools = [];
+  /** Per-run ground truth: every tool name actually INVOKED this run (native dispatch + delegated
+   *  runtime activity). The ledger that makes a fabricated tool claim provable. Reset per run. */
+  invokedTools = /* @__PURE__ */ new Set();
+  /** Advertised tools this run's text claimed to have used while the ledger showed zero calls. */
+  fabricatedClaims = /* @__PURE__ */ new Set();
   activeHooks;
   // composed: user hooks + plan-mode + permissions
   prepared = false;
@@ -3984,6 +3997,8 @@ var Agent = class _Agent {
     await this.ensureFs();
     this.prepared = false;
     this.started = false;
+    this.invokedTools.clear();
+    this.fabricatedClaims.clear();
     const systemPrompt = await this.prepare(contentText(task));
     const startCtx = await this.fireSessionStart();
     const userContent = await this.applyPromptSubmit(task);
@@ -4084,7 +4099,7 @@ var Agent = class _Agent {
     const kill = (finishReason) => {
       log6.warn(`kill-switch: ${finishReason} (steps=${steps}, tokens=${usage.totalTokens}, budgetTokens=${Math.round(usage.totalTokens - 0.9 * usage.cacheReadTokens)}, ms=${Date.now() - start - this.parkedMs}${finishReason === "timeout" ? `, idle=${Date.now() - lastProgressAt - this.parkedMs}ms` : ""}${this.parkedMs ? ` +${this.parkedMs} parked` : ""})`);
       this.ctx.jobs?.killAll();
-      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated };
+      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
     };
     while (true) {
       if (o.signal?.aborted) return kill("aborted");
@@ -4223,6 +4238,17 @@ var Agent = class _Agent {
       }
       if (toolCalls.length === 0) {
         if (this.drainInjections()) continue;
+        const fabricated = o.catchFabricatedToolUse && !closureNudged && delegatedTools.length === 0 ? this.fabricatedToolNames(contentText(res.content ?? "")) : [];
+        for (const n of fabricated) this.fabricatedClaims.add(n);
+        if (fabricated.length && steps < o.maxSteps) {
+          closureNudged = true;
+          log6.warn(`fabricated tool use: text names ${fabricated.join(", ")} but the run invoked ${this.invokedTools.size ? [...this.invokedTools].join(", ") : "nothing"} \u2014 demanding the real call`);
+          this.transcript.push({
+            role: "user",
+            content: `You referred to ${fabricated.map((n) => `\`${n}\``).join(", ")} in your reply, but you never actually called ${fabricated.length > 1 ? "those tools" : "that tool"} \u2014 no tool call was made, so any result you reported for ${fabricated.length > 1 ? "them" : "it"} was invented. Either call ${fabricated.length > 1 ? "them" : "it"} for real now, or answer without ${fabricated.length > 1 ? "them" : "it"} and do NOT claim any outcome \u2014 including a failure or a timeout \u2014 for a call you did not make.`
+          });
+          continue;
+        }
         if (o.closeDelegatedTurns && res.endedWithoutClosing && !closureNudged && steps < o.maxSteps) {
           closureNudged = true;
           log6.verbose("delegated turn went silent after a tool \u2014 nudging a closing answer");
@@ -4236,7 +4262,7 @@ var Agent = class _Agent {
         await this.ctx.jobs?.drain();
         this.releaseStaleImages();
         await this.activeHooks?.onStop?.(res.content ?? "");
-        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated };
+        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
       }
       const fp = toolCalls.map((tc) => tc.function.name + ":" + (tc.function.arguments ?? "")).join("|");
       repeats = fp === lastFp ? repeats + 1 : 1;
@@ -4352,6 +4378,7 @@ var Agent = class _Agent {
           prev.status = a.status;
         }
         sawTool = true;
+        this.invokedTools.add(a.name);
         trailing = "";
       }
       if (chunk.content) {
@@ -4367,7 +4394,39 @@ var Agent = class _Agent {
     const endedWithoutClosing = sawTool && (!trailing.trim() || endsOnAnnouncedAction(trailing));
     return { content, ...finishReason ? { finishReason } : {}, ...toolCalls ? { toolCalls } : {}, ...usage ? { usage } : {}, ...delegatedTools.length ? { delegatedTools } : {}, ...endedWithoutClosing ? { endedWithoutClosing: true } : {} };
   }
+  /**
+   * FABRICATED TOOL USE — the failure no call-reactive layer can see, because there IS no call.
+   *
+   * The model announces a tool ("I'll take a look with look_at_app"), emits no tool_use block at all, and
+   * then writes a plausible RESULT for the call it never made ("the app view didn't respond in time"). To
+   * every surface that turn is indistinguishable from a genuine timeout: the user reads a credible failure
+   * sentence, the logs show no tool call because none was made, and nothing errors. Malformed-call handling
+   * (dispatch's earlyError) cannot reach it — that path needs a tool_use block to exist.
+   *
+   * The discriminator is NOT prose. It is the per-run invocation ledger, which is ground truth: an advertised
+   * tool NAMED in the model's own text while `invokedTools` holds zero calls to it is a provable claim about
+   * an event that did not happen, not a guess about phrasing. Matching is on the exact registered tool name
+   * at word boundaries, so it cannot fire on ordinary English the way `endsOnAnnouncedAction` can.
+   *
+   * Deliberately narrow, because a false positive costs a metered step:
+   *  - only tools with a distinctive name (>= 4 chars, containing `_`, `-` or a capital) — a tool named `run`
+   *    or `web` would match half of English prose;
+   *  - only against the ledger for the WHOLE run, so referring back to a call it genuinely made earlier
+   *    ("the screenshot showed an empty grid") is honest and stays silent;
+   *  - only on a turn that made no tool calls of its own — a turn that DID call tools is closing normally.
+   */
+  fabricatedToolNames(text) {
+    const out = [];
+    for (const t of this.activeTools) {
+      if (this.invokedTools.has(t.name)) continue;
+      if (t.name.length < 4 || !/[_\-A-Z]/.test(t.name)) continue;
+      const re = new RegExp(`(?:^|[^\\w])${t.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^\\w]|$)`);
+      if (re.test(text)) out.push(t.name);
+    }
+    return out;
+  }
   async dispatch(tc) {
+    this.invokedTools.add(tc.function.name);
     const tool = this.activeTools.find((t) => t.name === tc.function.name);
     let args = {};
     let earlyError;