@livx.cc/agentx 0.99.36 → 0.99.38

package/dist/{Agent-Fr8uwN_l.d.ts → Agent-DJwg1g8V.d.ts}

@@ -199,10 +199,15 @@ interface RunResult {
     };
     /** True if ANY turn's usage was estimated (provider gave none) rather than exact — lets the UI mark cost `~`. */
     usageEstimated?: boolean;
-    /** Advertised tools the model NAMED in its own prose while the run's invocation ledger shows zero calls
-     *  to them — a fabricated tool use, proven against ground truth rather than guessed from phrasing.
-     *  Present even when the recovery nudge succeeded (it records that the turn needed rescuing); a host
-     *  can use it to tell the user plainly instead of shipping the model's invented result. */
+    /** Advertised tools the model NAMED in the reply it is handing back while the run's invocation ledger
+     *  shows zero calls to them — a fabricated tool use, proven against ground truth rather than guessed
+     *  from phrasing. A host can use it to tell the user plainly instead of shipping the invented result.
+     *
+     *  Re-evaluated at RETURN time, not frozen at detection: a claim the recovery nudge rescued (the model
+     *  went and made the real call) is dropped. It used to survive, on the reading that the field recorded
+     *  "this turn needed rescuing" — but the only consumer turns it into a sentence for the user ("I never
+     *  ran it"), and on the guard's own success path that sentence is false. Whether a turn needed rescuing
+     *  is a telemetry question, and the `log.warn` at the nudge already answers it. */
     fabricatedToolClaims?: string[];
     error?: unknown;
 }
@@ -532,8 +537,25 @@ declare class Agent {
      *  - only against the ledger for the WHOLE run, so referring back to a call it genuinely made earlier
      *    ("the screenshot showed an empty grid") is honest and stays silent;
      *  - only on a turn that made no tool calls of its own — a turn that DID call tools is closing normally.
+     *    (That is the enclosing `toolCalls.length === 0` branch. It is NOT extended to delegated activity:
+     *    a `cursor/*` turn runs its own tools and then fabricates in the SAME response, which is the exact
+     *    reported defect — see the call site.)
+     *
+     * What it deliberately does NOT catch, both verified:
+     *  - a fabrication that names no tool at all ("Let me take a look at the running app. The app view did
+     *    not respond in time.") — there is nothing to prove it against. Only prose matching could reach it,
+     *    and ungating `endsOnAnnouncedAction` for that was tried and reverted (it fires on ordinary English).
+     *  - a SECOND invented result for a tool the run genuinely called earlier. The ledger is per-run by
+     *    design, because that is the same fact that keeps an honest back-reference ("the screenshot showed
+     *    an empty grid") silent. Distinguishing them would need per-claim positional accounting, which buys
+     *    a rarer case at the cost of the common honest one.
      */
     private fabricatedToolNames;
+    /** The claims still standing at return time: named in this run's prose, and STILL absent from the
+     *  invocation ledger. Re-checked here rather than trusted from detection because the ledger moves —
+     *  the recovery nudge can succeed, and then the host would tell the user "I never ran it" about a
+     *  call that demonstrably ran. See `RunResult.fabricatedToolClaims`. */
+    private survivingClaims;
     private dispatch;
     /** `/compact` aims to land the transcript at this fraction of the context window. */
     private static readonly COMPACT_TARGET;

package/dist/cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-Fr8uwN_l.js';
+import { H as Hooks, i as RunResult, R as ReasoningEffort, A as Agent } from './Agent-DJwg1g8V.js';
 import { IFilesystem } from '@livx.cc/wcli/core';
 import { M as Message, U as UserQuestion, H as HostBridge, c as ContentPart, g as MessageContent } from './tools-Byyh_bae.js';
 

package/dist/cli.js

@@ -4099,7 +4099,8 @@ var Agent = class _Agent {
     const kill = (finishReason) => {
       log6.warn(`kill-switch: ${finishReason} (steps=${steps}, tokens=${usage.totalTokens}, budgetTokens=${Math.round(usage.totalTokens - 0.9 * usage.cacheReadTokens)}, ms=${Date.now() - start - this.parkedMs}${finishReason === "timeout" ? `, idle=${Date.now() - lastProgressAt - this.parkedMs}ms` : ""}${this.parkedMs ? ` +${this.parkedMs} parked` : ""})`);
       this.ctx.jobs?.killAll();
-      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
+      const claims = this.survivingClaims();
+      return { text: lastAssistantText(this.transcript), steps, finishReason, messages: this.transcript, usage, usageEstimated, ...claims.length ? { fabricatedToolClaims: claims } : {} };
     };
     while (true) {
       if (o.signal?.aborted) return kill("aborted");
@@ -4238,7 +4239,7 @@ var Agent = class _Agent {
       }
       if (toolCalls.length === 0) {
         if (this.drainInjections()) continue;
-        const fabricated = o.catchFabricatedToolUse && !closureNudged && delegatedTools.length === 0 ? this.fabricatedToolNames(contentText(res.content ?? "")) : [];
+        const fabricated = o.catchFabricatedToolUse && !closureNudged ? this.fabricatedToolNames(contentText(res.content ?? "")) : [];
         for (const n of fabricated) this.fabricatedClaims.add(n);
         if (fabricated.length && steps < o.maxSteps) {
           closureNudged = true;
@@ -4262,7 +4263,8 @@ var Agent = class _Agent {
         await this.ctx.jobs?.drain();
         this.releaseStaleImages();
         await this.activeHooks?.onStop?.(res.content ?? "");
-        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated, ...this.fabricatedClaims.size ? { fabricatedToolClaims: [...this.fabricatedClaims] } : {} };
+        const claims = this.survivingClaims();
+        return { text: res.content ?? "", steps, finishReason: "stop", messages: this.transcript, usage, usageEstimated, ...claims.length ? { fabricatedToolClaims: claims } : {} };
       }
       const fp = toolCalls.map((tc) => tc.function.name + ":" + (tc.function.arguments ?? "")).join("|");
       repeats = fp === lastFp ? repeats + 1 : 1;
@@ -4414,6 +4416,18 @@ var Agent = class _Agent {
    *  - only against the ledger for the WHOLE run, so referring back to a call it genuinely made earlier
    *    ("the screenshot showed an empty grid") is honest and stays silent;
    *  - only on a turn that made no tool calls of its own — a turn that DID call tools is closing normally.
+   *    (That is the enclosing `toolCalls.length === 0` branch. It is NOT extended to delegated activity:
+   *    a `cursor/*` turn runs its own tools and then fabricates in the SAME response, which is the exact
+   *    reported defect — see the call site.)
+   *
+   * What it deliberately does NOT catch, both verified:
+   *  - a fabrication that names no tool at all ("Let me take a look at the running app. The app view did
+   *    not respond in time.") — there is nothing to prove it against. Only prose matching could reach it,
+   *    and ungating `endsOnAnnouncedAction` for that was tried and reverted (it fires on ordinary English).
+   *  - a SECOND invented result for a tool the run genuinely called earlier. The ledger is per-run by
+   *    design, because that is the same fact that keeps an honest back-reference ("the screenshot showed
+   *    an empty grid") silent. Distinguishing them would need per-claim positional accounting, which buys
+   *    a rarer case at the cost of the common honest one.
    */
   fabricatedToolNames(text) {
     const out = [];
@@ -4425,6 +4439,14 @@ var Agent = class _Agent {
     }
     return out;
   }
+  /** The claims still standing at return time: named in this run's prose, and STILL absent from the
+   *  invocation ledger. Re-checked here rather than trusted from detection because the ledger moves —
+   *  the recovery nudge can succeed, and then the host would tell the user "I never ran it" about a
+   *  call that demonstrably ran. See `RunResult.fabricatedToolClaims`. */
+  survivingClaims() {
+    if (!this.fabricatedClaims.size) return [];
+    return [...this.fabricatedClaims].filter((n) => !this.invokedTools.has(n));
+  }
   async dispatch(tc) {
     this.invokedTools.add(tc.function.name);
     const tool = this.activeTools.find((t) => t.name === tc.function.name);