@sayknow-cli/agent-core 0.3.1 → 0.3.4

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 ## [Unreleased]
 
+## [0.7.7] - 2026-06-28
+
+### Fixed
+
+- Mitigate leaked Anthropic-style `<invoke name="…">` tool-call envelopes across providers, not only `openai-codex`, while keeping Codex `to=functions.*` harmony-header mitigation provider-scoped.
+
+## [0.7.4] - 2026-06-27
+
+### Added
+
+- Added `pruneAssistantToolArguments`: an isolated pre-compaction pruning pass that redacts stale `edit`/`write`/`apply_patch`/`ast_edit` tool-call argument payloads only when every touched path group has a later successful mutation, preserving tool-call identity (id/name/customWireName/signatures/intent/path hints), protecting latest/failed/ambiguous calls, and reporting separate stats from tool-result pruning. Reduces pre-compaction context pressure and the resident footprint of superseded large edit arguments.
+
+## [0.7.3] - 2026-06-25
+### Added
+
+- Added Composer evidence publication gates in the agent loop, so Composer-harness turns emit structured evidence under defined publication conditions (#1106).
+
+### Fixed
+
+- Wired the previously-dead GPT-5 harmony-leak detector into the streamed assistant-message path for openai-codex turns: recoverable tool-argument leaks are now recovered and everything else is routed through the existing abort-retry/audit loop, and the contaminated streamed message is removed (abort-retry) or replaced (truncate-resume) from working context so the model does not replay its own leak as history. Added detection of the leaked Anthropic-style `<invoke name="…">` envelope dialect that gpt-5.5 intermittently emits as visible assistant text instead of a native function call (#1069).
+- Detect proxy-level context overflow from empty responses: some proxies (notably LiteLLM) return an empty `content: []` with `stopReason: "stop"` and fabricated near-zero usage when the upstream context window is exceeded; the agent loop now recognizes this pattern and promotes it to an error so the existing overflow/compaction recovery path fires instead of freezing the session as a clean completion (#1102).
+- Hardened the Composer trace mutation classifier and its recovery-target guard (#1105).
+
 ## [0.7.2] - 2026-06-24
 
 ### Fixed

package/dist/types/compaction/pruning.d.ts

@@ -34,4 +34,14 @@ export interface PruneResult {
      */
     prunedEntries: SessionMessageEntry[];
 }
+export interface AssistantArgumentPruneResult {
+    argumentPrunedCount: number;
+    argumentTokensSaved: number;
+    /**
+     * The mutated assistant message entries. Callers whose entry source returns
+     * materialized copies must write these back into their canonical store by id.
+     */
+    prunedEntries: SessionMessageEntry[];
+}
+export declare function pruneAssistantToolArguments(entries: SessionEntry[], config?: PruneConfig): AssistantArgumentPruneResult;
 export declare function pruneToolOutputs(entries: SessionEntry[], config?: PruneConfig): PruneResult;

package/dist/types/harmony-leak.d.ts

@@ -9,7 +9,7 @@
  */
 import type { AssistantMessage, Model } from "@sayknow-cli/ai";
 declare const SIGNAL_ORDER: readonly ["M", "C", "G", "S", "B", "R", "T"];
-export type HarmonySignalClass = "H" | (typeof SIGNAL_ORDER)[number];
+export type HarmonySignalClass = "H" | "I" | (typeof SIGNAL_ORDER)[number];
 export type HarmonySurface = "assistant_text" | "assistant_thinking" | "tool_arg";
 export interface HarmonySignal {
     classes: HarmonySignalClass[];
@@ -48,6 +48,7 @@ export interface HarmonyRecoveredToolCall {
  * itself is cheap; the cost of missing a leak on a new model is not.
  */
 export declare function isHarmonyLeakMitigationTarget(model: Model): boolean;
+export declare function shouldMitigateHarmonyLeak(model: Model, detection: HarmonyDetection): boolean;
 export declare function signalListLabel(signals: readonly HarmonySignal[]): string;
 /**
  * Detect harmony-protocol leakage in `text`. Returns undefined if clean.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/agent-core",
-	"version": "0.3.1",
+	"version": "0.3.4",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://github.com/jaybeyond/Sayknow_CLI",
 	"author": "jaybeyond",
@@ -35,9 +35,9 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@sayknow-cli/ai": "0.3.1",
-		"@sayknow-cli/natives": "0.3.1",
-		"@sayknow-cli/utils": "0.3.1",
+		"@sayknow-cli/ai": "0.3.4",
+		"@sayknow-cli/natives": "0.3.4",
+		"@sayknow-cli/utils": "0.3.4",
 		"@opentelemetry/api": "^1.9.0"
 	},
 	"devDependencies": {

package/src/agent-loop.ts

@@ -7,6 +7,7 @@ import {
 	type AssistantMessageEvent,
 	type Context,
 	EventStream,
+	isContextOverflow,
 	isZodSchema,
 	streamSimple,
 	type ToolResultMessage,
@@ -17,9 +18,13 @@ import {
 import { sanitizeText } from "@sayknow-cli/utils";
 import {
 	createHarmonyAuditEvent,
+	detectHarmonyLeakInAssistantMessage,
+	extractHarmonyRemoved,
 	type HarmonyDetection,
 	type HarmonyRecoveredToolCall,
 	isHarmonyLeakMitigationTarget,
+	recoverHarmonyToolCall,
+	shouldMitigateHarmonyLeak,
 	signalListLabel,
 } from "./harmony-leak";
 import { type AgentRunCoverage, type AgentRunSummary, ToolCallBlockedError } from "./run-collector";
@@ -51,6 +56,15 @@ import type {
 
 /** Sentinel returned by the abort race in `streamAssistantResponse`. */
 const ABORTED: unique symbol = Symbol("agent-loop-aborted");
+/**
+ * Detect empty "successful" responses that indicate a proxy-level context
+ * overflow (e.g. LiteLLM returning `content: []`, `stopReason: "stop"`, and a
+ * fabricated near-zero usage). We delegate to {@link isContextOverflow} which
+ * has the threshold constant, so the detection logic stays in one place.
+ */
+function isEmptyResponseOverflow(message: AssistantMessage): boolean {
+	return isContextOverflow(message);
+}
 
 class HarmonyLeakInterruption extends Error {
 	constructor(
@@ -502,6 +516,12 @@ async function runLoopBody(
 					streamFn,
 					harmonyRetryAttempt,
 				);
+				const detection = detectHarmonyLeakInAssistantMessage(message);
+				if (detection && shouldMitigateHarmonyLeak(config.model, detection)) {
+					const rec = recoverHarmonyToolCall(message, detection);
+					const removed = rec ? rec.removed : extractHarmonyRemoved(message, detection);
+					throw new HarmonyLeakInterruption(detection, removed, rec);
+				}
 				harmonyRetryAttempt = 0;
 				harmonyTruncateResumeCount = 0;
 			} catch (err) {
@@ -516,6 +536,15 @@ async function runLoopBody(
 					harmonyTruncateResumeCount++;
 					recovered = err.recovered;
 					message = recovered.message;
+					// Replace the contaminated assistant message committed during
+					// streaming with the recovered (truncated) one so the retry
+					// sees clean history.
+					{
+						const idx = currentContext.messages.length - 1;
+						if (idx >= 0 && currentContext.messages[idx]?.role === "assistant") {
+							currentContext.messages[idx] = recovered.message;
+						}
+					}
 					await emitHarmonyAudit(config, err, "truncate_resume", harmonyRetryAttempt);
 				} else {
 					if (harmonyRetryAttempt >= 2) {
@@ -526,12 +555,34 @@ async function runLoopBody(
 					}
 					await emitHarmonyAudit(config, err, "abort_retry", harmonyRetryAttempt);
 					harmonyRetryAttempt++;
+					// Drop the contaminated assistant message committed during
+					// streaming so the retry does not replay the model's own leak
+					// back to it as history.
+					{
+						const idx = currentContext.messages.length - 1;
+						if (idx >= 0 && currentContext.messages[idx]?.role === "assistant") {
+							currentContext.messages.splice(idx, 1);
+						}
+					}
 					continue;
 				}
 			}
 			newMessages.push(message);
 			let steeringMessagesFromExecution: AgentMessage[] | undefined;
 
+			// Detect empty "successful" responses (stopReason "stop" + empty content).
+			// Some proxies (e.g. LiteLLM) return this when the upstream model's context
+			// window is exceeded, fabricating a near-zero usage instead of surfacing an
+			// error. Without this guard the agent loop treats the empty response as a
+			// natural turn completion and stops, leaving the user with a frozen session.
+			// Promote it to an error so the overflow/compaction recovery path can fire.
+			if (message.stopReason === "stop" && message.content.length === 0 && isEmptyResponseOverflow(message)) {
+				message.stopReason = "error";
+				message.errorMessage = message.errorMessage
+					? `${message.errorMessage} | Provider returned an empty response with anomalously low token usage (possible context overflow via proxy)`
+					: "Provider returned an empty response with anomalously low token usage (possible context overflow via proxy)";
+			}
+
 			if (message.stopReason === "error" || message.stopReason === "aborted") {
 				// Create placeholder tool results for any tool calls in the aborted message
 				// This maintains the tool_use/tool_result pairing that the API requires

package/src/compaction/pruning.ts

@@ -126,6 +126,24 @@ function estimatePrunedSavings(tokens: number, notice: string): number {
 	return Math.max(0, tokens - noticeTokens);
 }
 
+export interface AssistantArgumentPruneResult {
+	argumentPrunedCount: number;
+	argumentTokensSaved: number;
+	/**
+	 * The mutated assistant message entries. Callers whose entry source returns
+	 * materialized copies must write these back into their canonical store by id.
+	 */
+	prunedEntries: SessionMessageEntry[];
+}
+
+interface PrunedToolArgumentsSentinel {
+	pruned: true;
+	reason: "stale_tool_arguments";
+	pathHints: string[];
+	originalChars: number;
+	prunedAt: number;
+}
+
 const EDIT_TOOL_NAMES = new Set(["edit", "write", "apply_patch", "ast_edit"]);
 
 /** Extract the file-path argument from a tool call, when the tool has one. */
@@ -170,6 +188,68 @@ function editToolPathGroups(call: ToolCall): string[][] {
 	}
 	return groups;
 }
+function pathGroupKey(group: string[]): string {
+	return JSON.stringify([...group].sort());
+}
+
+function pathHintsForGroups(groups: string[][]): string[] {
+	return [...new Set(groups.flat())].sort();
+}
+
+function isPrunedToolArgumentsSentinel(value: unknown): value is PrunedToolArgumentsSentinel {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		(value as { pruned?: unknown; reason?: unknown }).pruned === true &&
+		(value as { pruned?: unknown; reason?: unknown }).reason === "stale_tool_arguments"
+	);
+}
+
+function isEditToolCall(call: ToolCall): boolean {
+	return EDIT_TOOL_NAMES.has(call.name) || call.customWireName === "apply_patch";
+}
+
+interface AssistantArgumentStalenessIndex {
+	latestSuccessfulMutationByPathGroup: Map<string, { index: number; callId: string }>;
+	failedCallIds: Set<string>;
+}
+
+function buildAssistantArgumentStalenessIndex(entries: SessionEntry[]): AssistantArgumentStalenessIndex {
+	const callsById = new Map<string, ToolCall>();
+	for (const entry of entries) {
+		if (entry.type !== "message") continue;
+		const message = entry.message as AgentMessage;
+		if (message.role !== "assistant") continue;
+		for (const content of message.content) {
+			if (content.type === "toolCall") callsById.set(content.id, content);
+		}
+	}
+
+	const latestSuccessfulMutationByPathGroup = new Map<string, { index: number; callId: string }>();
+	const failedCallIds = new Set<string>();
+	for (let i = 0; i < entries.length; i++) {
+		const message = getToolResultMessage(entries[i]);
+		if (!message) continue;
+		const call = callsById.get(message.toolCallId);
+		if (!call || !isEditToolCall(call)) continue;
+		const detailFiles = call.name === "ast_edit" ? resultDetailFiles(message) : [];
+		const groups = detailFiles.length > 0 ? detailFiles.map(file => [file]) : editToolPathGroups(call);
+		if (groups.length === 0) continue;
+		if (message.isError) {
+			failedCallIds.add(call.id);
+			continue;
+		}
+		const failed = failedEditPaths(message);
+		let mutated = false;
+		for (const group of groups) {
+			if (group.some(groupPath => failed.has(groupPath))) continue;
+			latestSuccessfulMutationByPathGroup.set(pathGroupKey(group), { index: i, callId: call.id });
+			mutated = true;
+		}
+		if (!mutated) failedCallIds.add(call.id);
+	}
+	return { latestSuccessfulMutationByPathGroup, failedCallIds };
+}
 
 /**
  * Trailing read selectors (`:50`, `:50-200`, `:50+150`, `:5-16,960-973`,
@@ -361,6 +441,91 @@ function buildStalenessIndex(entries: SessionEntry[]): StalenessIndex {
 
 	return { staleResultIndices };
 }
+export function pruneAssistantToolArguments(
+	entries: SessionEntry[],
+	config: PruneConfig = DEFAULT_PRUNE_CONFIG,
+): AssistantArgumentPruneResult {
+	let accumulatedTokens = 0;
+	let argumentTokensSaved = 0;
+	const { latestSuccessfulMutationByPathGroup, failedCallIds } = buildAssistantArgumentStalenessIndex(entries);
+	const candidates: Array<{
+		entry: SessionMessageEntry;
+		call: ToolCall;
+		pathHints: string[];
+		originalChars: number;
+		savings: number;
+	}> = [];
+
+	for (let i = entries.length - 1; i >= 0; i--) {
+		const entry = entries[i];
+		if (entry.type !== "message") continue;
+		const message = entry.message as AgentMessage;
+		if (message.role !== "assistant") continue;
+		const entryTokens = estimateEntryTokens(entry);
+		const insideProtectWindow = accumulatedTokens < config.protectTokens;
+		accumulatedTokens += entryTokens;
+		for (const content of message.content) {
+			if (content.type !== "toolCall" || !isEditToolCall(content)) continue;
+			const argumentJson = JSON.stringify(content.arguments);
+			if (argumentJson === undefined) continue;
+			const originalChars = argumentJson.length;
+			if (isPrunedToolArgumentsSentinel(content.arguments)) continue;
+			if (insideProtectWindow || failedCallIds.has(content.id)) continue;
+			const groups = editToolPathGroups(content);
+			if (groups.length === 0) continue;
+			// Arguments are pruned as one indivisible payload, so require EVERY
+			// concrete path group to be stale from a later successful mutation.
+			// A group with no later success (failed/unknown/ambiguous) protects the
+			// whole call rather than dropping non-stale multi-file patch evidence.
+			const isStale =
+				groups.length > 0 &&
+				groups.every(group => {
+					const latest = latestSuccessfulMutationByPathGroup.get(pathGroupKey(group));
+					return latest !== undefined && latest.index > i && latest.callId !== content.id;
+				});
+			if (!isStale) continue;
+			const sentinelChars = JSON.stringify({
+				pruned: true,
+				reason: "stale_tool_arguments",
+				pathHints: pathHintsForGroups(groups),
+				originalChars,
+				prunedAt: 0,
+			} satisfies PrunedToolArgumentsSentinel).length;
+			candidates.push({
+				entry: entry as SessionMessageEntry,
+				call: content,
+				pathHints: pathHintsForGroups(groups),
+				originalChars,
+				savings: Math.max(0, Math.ceil((originalChars - sentinelChars) / 4)),
+			});
+		}
+	}
+
+	for (const candidate of candidates) {
+		argumentTokensSaved += candidate.savings;
+	}
+	if (argumentTokensSaved < config.minimumSavings || candidates.length === 0) {
+		return { argumentPrunedCount: 0, argumentTokensSaved: 0, prunedEntries: [] };
+	}
+
+	const prunedAt = Date.now();
+	const prunedEntries: SessionMessageEntry[] = [];
+	const prunedEntryIds = new Set<string>();
+	for (const candidate of candidates) {
+		candidate.call.arguments = {
+			pruned: true,
+			reason: "stale_tool_arguments",
+			pathHints: candidate.pathHints,
+			originalChars: candidate.originalChars,
+			prunedAt,
+		};
+		if (!prunedEntryIds.has(candidate.entry.id)) {
+			prunedEntries.push(candidate.entry);
+			prunedEntryIds.add(candidate.entry.id);
+		}
+	}
+	return { argumentPrunedCount: candidates.length, argumentTokensSaved, prunedEntries };
+}
 
 export function pruneToolOutputs(entries: SessionEntry[], config: PruneConfig = DEFAULT_PRUNE_CONFIG): PruneResult {
 	let accumulatedTokens = 0;

package/src/harmony-leak.ts

@@ -14,6 +14,19 @@ import type { AssistantMessage, Model, ToolCall } from "@sayknow-cli/ai";
 const MARKER_RE = /\bto=functions\.[A-Za-z_]\w*/g;
 const HARMONY_RE = /<\|(start|end|channel|message|call|return)\|>/g;
 
+// Leaked tool-call envelope (`I`): a structurally-committed Anthropic-style
+// invoke block (an opening tag carrying a name attribute). openai-codex models
+// use native function calling, so such an envelope appearing as visible
+// assistant text / thinking is always a leaked tool call — a different dialect
+// of the §1 phenomenon where the tool-call intent collapses into the content
+// channel (frequently prefixed by a glitch token such as a bare `court` line).
+// High precision: requires the opening tag AND a committed body (a parameter
+// tag or a closing invoke tag) within a short window, so prose that merely
+// mentions the tag does not trip. Like `H`, it trips on its own (outside code
+// fences). Source spelled with `\s` so this module does not self-trip.
+const INVOKE_OPEN_RE = /<invoke\s+name="[^"]+"\s*>/g;
+const INVOKE_BODY_RE = /<parameter\s+name="|<\/invoke>/;
+
 // Channel-word adjacency (`C`): channel/role name appearing immediately before the marker.
 const CHANNEL_WORD_RE = /\b(?:analysis|commentary|assistant|user|system|developer|tool)\s+to=functions\./;
 
@@ -66,7 +79,7 @@ const RECOVERY_REGISTRY: Record<string, RecoveryConfig> = {
 
 const SIGNAL_ORDER = ["M", "C", "G", "S", "B", "R", "T"] as const;
 
-export type HarmonySignalClass = "H" | (typeof SIGNAL_ORDER)[number];
+export type HarmonySignalClass = "H" | "I" | (typeof SIGNAL_ORDER)[number];
 
 export type HarmonySurface = "assistant_text" | "assistant_thinking" | "tool_arg";
 
@@ -114,6 +127,11 @@ export function isHarmonyLeakMitigationTarget(model: Model): boolean {
 	return model.provider === "openai-codex";
 }
 
+export function shouldMitigateHarmonyLeak(model: Model, detection: HarmonyDetection): boolean {
+	if (isHarmonyLeakMitigationTarget(model)) return true;
+	return detection.signals.some(signal => signal.classes.includes("I"));
+}
+
 export function signalListLabel(signals: readonly HarmonySignal[]): string {
 	const seen: string[] = [];
 	for (const signal of signals) {
@@ -154,6 +172,17 @@ export function detectHarmonyLeak(
 		signals.push(makeSignal(["H"], start, start + match[0].length, match[0]));
 	}
 
+	for (const match of text.matchAll(INVOKE_OPEN_RE)) {
+		const start = match.index ?? 0;
+		if (isInsideFence(fences, start)) continue;
+		// Require a committed body nearby so a bare mention of the tag in prose
+		// does not trip; a real leaked envelope continues into parameters or a
+		// close tag.
+		const forward = text.slice(start, Math.min(text.length, start + 400));
+		if (!INVOKE_BODY_RE.test(forward)) continue;
+		signals.push(makeSignal(["I"], start, start + match[0].length, match[0]));
+	}
+
 	for (const match of text.matchAll(MARKER_RE)) {
 		const start = match.index ?? 0;
 		if (isInsideFence(fences, start)) continue;
@@ -306,7 +335,7 @@ export function createHarmonyAuditEvent(params: {
 // ─── internals ──────────────────────────────────────────────────────────────
 
 function makeSignal(classes: HarmonySignalClass[], start: number, end: number, text: string): HarmonySignal {
-	if (classes[0] === "H") return { classes: ["H"], start, end, text };
+	if (classes[0] === "H" || classes[0] === "I") return { classes: [classes[0]], start, end, text };
 	const sorted: HarmonySignalClass[] = [];
 	for (const cls of SIGNAL_ORDER) {
 		if (classes.includes(cls)) sorted.push(cls);
@@ -402,7 +431,7 @@ function sha8(text: string): string {
 
 const PREVIEW_KEEP_RE = new RegExp(`[${SCRIPT_CLASS}\\s】【”“…」「、。]`, "u");
 const PREVIEW_TOKEN_RE =
-	/^(?:to=functions\.[A-Za-z_]\w*|analysis|commentary|assistant|user|system|developer|tool|changedFiles|RTLU|Jsii(?:_commentary)?|\x4aapgolly)/;
+	/^(?:to=functions\.[A-Za-z_]\w*|<\/?invoke\b[^>]*>|<parameter\b[^>]*>|analysis|commentary|assistant|user|system|developer|tool|changedFiles|RTLU|Jsii(?:_commentary)?|\x4aapgolly)/;
 
 /**
  * Privacy-safe preview for the audit log: keeps marker/channel/glitch tokens,