@theokit/sdk 2.15.0 → 2.15.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.15.1
+
+### Patch Changes
+
+- bec2077: Make the leaked-dialect recovery **request-scoped (R5)**. The opt-in `extractToolCallsFromContent` recovery previously promoted ANY `<function=NAME>` block leaked into assistant text on an enabled route, so a code assistant printing a literal `<function=example>` in a fenced code block could be wrongly turned into a tool call. Recovery now gates on an exact, case-sensitive allowlist derived automatically from the current request's declared tools (`request.tools`): the per-route flag stays the coarse enable, and the allowlist is the precise false-positive guard. A request with no tools recovers nothing; a gated-out block keeps its text visible (it is not silently deleted). No public API change — the allowlist is derived from the tools you already pass. Mirrors openclaw's `@openclaw/tool-call-repair` allowlist.
+
 ## 2.15.0
 
 ### Minor Changes

package/dist/a2a/index.cjs

@@ -10332,11 +10332,16 @@ var init_sanitize_tool_input = __esm({
 });
 
 // src/internal/llm/hermes-tool-extract.ts
-function extractHermesToolCalls(content, makeId) {
+function extractHermesToolCalls(content, makeId, allowedToolNames) {
+  const isPromoted = (name) => name.length > 0 && (allowedToolNames === void 0 || allowedToolNames.has(name));
   const toolCalls = [];
+  const droppedNames = [];
   for (const block of content.matchAll(HERMES_BLOCK)) {
     const name = (block[1] ?? "").trim();
-    if (name.length === 0) continue;
+    if (!isPromoted(name)) {
+      if (name.length > 0 && allowedToolNames !== void 0) droppedNames.push(name);
+      continue;
+    }
     toolCalls.push({
       type: "tool_use",
       id: makeId(),
@@ -10344,8 +10349,11 @@ function extractHermesToolCalls(content, makeId) {
       input: parseHermesParams(block[2] ?? "")
     });
   }
-  const residualText = toolCalls.length === 0 ? content : content.replace(HERMES_BLOCK, "").trim();
-  return { toolCalls, residualText };
+  const residualText = toolCalls.length === 0 ? content : content.replace(
+    HERMES_BLOCK,
+    (full, rawName) => isPromoted((rawName ?? "").trim()) ? "" : full
+  ).trim();
+  return { toolCalls, residualText, droppedNames };
 }
 function parseHermesParams(inner) {
   const input = {};
@@ -10550,7 +10558,10 @@ var init_openai2 = __esm({
         }
         const accumulator = new OpenAIStreamAccumulator(
           this.options.extractToolCallsFromContent ?? false,
-          providerId
+          providerId,
+          // R5: request-scoped allowlist — leaked recovery only promotes a block whose name is a tool the
+          // model was actually given. Empty set (no tools) recovers nothing.
+          new Set(request.tools?.map((tool) => tool.name) ?? [])
         );
         for await (const record of parseSseStream(response.body, signal)) {
           if (record.data === "[DONE]") break;
@@ -10580,13 +10591,18 @@ var init_openai2 = __esm({
       /**
        * @param extractFromContent opt-in leaked-dialect safe-parse (theokit#58). Default false.
        * @param providerName provider id, used only to label the recovery log line.
+       * @param allowedToolNames R5 request-scoped allowlist — built from `request.tools` at `stream()`;
+       *   leaked recovery in `finish()` only promotes a block whose name is in this set. `undefined`
+       *   (direct construction) recovers all (back-compat); an empty set recovers nothing.
        */
-      constructor(extractFromContent = false, providerName = "openai") {
+      constructor(extractFromContent = false, providerName = "openai", allowedToolNames) {
         this.extractFromContent = extractFromContent;
         this.providerName = providerName;
+        this.allowedToolNames = allowedToolNames;
       }
       extractFromContent;
       providerName;
+      allowedToolNames;
       text = "";
       stopReason = "end_turn";
       inputTokens;
@@ -10657,7 +10673,8 @@ var init_openai2 = __esm({
         if (this.extractFromContent && toolCalls.length === 0) {
           const recovered = extractHermesToolCalls(
             this.text,
-            () => `hermes-${globalThis.crypto.randomUUID()}`
+            () => `hermes-${globalThis.crypto.randomUUID()}`,
+            this.allowedToolNames
           );
           if (recovered.toolCalls.length > 0) {
             toolCalls.push(...recovered.toolCalls);
@@ -10665,6 +10682,12 @@ var init_openai2 = __esm({
             stopReason = "tool_use";
             process.stderr.write(
               `[theokit-sdk] recovered ${recovered.toolCalls.length} leaked tool call(s) from assistant content (provider="${this.providerName}", names=${recovered.toolCalls.map((c) => c.name).join(",")})
+`
+            );
+          }
+          if (recovered.droppedNames.length > 0) {
+            process.stderr.write(
+              `[theokit-sdk] dropped ${recovered.droppedNames.length} leaked block(s) whose name is not a tool in the request (provider="${this.providerName}", names=${recovered.droppedNames.join(",")})
 `
             );
           }