@theokit/sdk 2.15.0 → 2.15.1

package/dist/internal/llm/hermes-tool-extract.d.ts

@@ -2,6 +2,10 @@ import type { LlmToolCallPart } from "./types.js";
 export interface HermesExtractResult {
     /** Recovered tool calls (empty when none matched). */
     toolCalls: LlmToolCallPart[];
-    /** Content with every recovered block removed + trimmed; original content when nothing matched. */
+    /** Content with every PROMOTED block removed + trimmed; gated-out and unmatched blocks stay visible. */
     residualText: string;
+    /** Names of well-formed leaked blocks that WERE dropped by the request-scoped allowlist (R5) — a
+     *  block whose name is not a tool in the current request. Empty when no allowlist was applied or
+     *  nothing was gated out. The caller logs these so a guard firing is observable in production. */
+    droppedNames: string[];
 }

package/dist/internal/llm/openai.d.ts

@@ -66,6 +66,7 @@ export declare class OpenAIClient implements LlmClient {
 declare class OpenAIStreamAccumulator {
     private readonly extractFromContent;
     private readonly providerName;
+    private readonly allowedToolNames?;
     private text;
     private stopReason;
     private inputTokens?;
@@ -77,8 +78,11 @@ declare class OpenAIStreamAccumulator {
     /**
      * @param extractFromContent opt-in leaked-dialect safe-parse (theokit#58). Default false.
      * @param providerName provider id, used only to label the recovery log line.
+     * @param allowedToolNames R5 request-scoped allowlist — built from `request.tools` at `stream()`;
+     *   leaked recovery in `finish()` only promotes a block whose name is in this set. `undefined`
+     *   (direct construction) recovers all (back-compat); an empty set recovers nothing.
      */
-    constructor(extractFromContent?: boolean, providerName?: string);
+    constructor(extractFromContent?: boolean, providerName?: string, allowedToolNames?: ReadonlySet<string> | undefined);
     consume(chunk: OpenAIDeltaChunk): LlmEvent[];
     private applyReasoningDelta;
     private applyUsage;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theokit/sdk",
-  "version": "2.15.0",
+  "version": "2.15.1",
   "description": "TypeScript SDK for the Theo agent harness — same surface, local or cloud.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/usetheo/theokit-sdk#readme",