@theokit/sdk 2.15.0 → 2.15.2

package/dist/index.cjs

@@ -13650,11 +13650,16 @@ function sanitizeToolInput(input, options) {
 // src/internal/llm/hermes-tool-extract.ts
 var HERMES_BLOCK = /<function=\s*([^>\s]+)\s*>([\s\S]*?)<\/tool_call>/g;
 var HERMES_PARAM = /<parameter=\s*([^>\s]+)\s*>([\s\S]*?)<\/parameter>/g;
-function extractHermesToolCalls(content, makeId) {
+function extractHermesToolCalls(content, makeId, allowedToolNames) {
+  const isPromoted = (name) => name.length > 0 && (allowedToolNames === void 0 || allowedToolNames.has(name));
   const toolCalls = [];
+  const droppedNames = [];
   for (const block of content.matchAll(HERMES_BLOCK)) {
     const name = (block[1] ?? "").trim();
-    if (name.length === 0) continue;
+    if (!isPromoted(name)) {
+      if (name.length > 0 && allowedToolNames !== void 0) droppedNames.push(name);
+      continue;
+    }
     toolCalls.push({
       type: "tool_use",
       id: makeId(),
@@ -13662,8 +13667,11 @@ function extractHermesToolCalls(content, makeId) {
       input: parseHermesParams(block[2] ?? "")
     });
   }
-  const residualText = toolCalls.length === 0 ? content : content.replace(HERMES_BLOCK, "").trim();
-  return { toolCalls, residualText };
+  const residualText = toolCalls.length === 0 ? content : content.replace(
+    HERMES_BLOCK,
+    (full, rawName) => isPromoted((rawName ?? "").trim()) ? "" : full
+  ).trim();
+  return { toolCalls, residualText, droppedNames };
 }
 function parseHermesParams(inner) {
   const input = {};
@@ -13675,6 +13683,77 @@ function parseHermesParams(inner) {
   }
   return sanitizeToolInput(input, { trim: true }).value;
 }
+var STREAM_MARKER = "<function=";
+var DEFAULT_STREAM_BUFFER_CAP = 8192;
+var isStreamWs = (c) => c === " " || c === "	" || c === "\n" || c === "\r";
+function streamToolCallBufferState(held, allowedToolNames, cap2 = DEFAULT_STREAM_BUFFER_CAP) {
+  if (allowedToolNames.size === 0) return "impossible";
+  const t = held.trimStart();
+  if (t.length < STREAM_MARKER.length) {
+    return STREAM_MARKER.startsWith(t) ? "possible" : "impossible";
+  }
+  if (!t.startsWith(STREAM_MARKER)) return "impossible";
+  const parsed = parseStreamMarkerName(t);
+  if (parsed === "building") return "possible";
+  if (parsed === "invalid") return "impossible";
+  const nameOk = parsed.complete ? allowedToolNames.has(parsed.name) : someToolNameStartsWith(allowedToolNames, parsed.name);
+  if (!nameOk) return "impossible";
+  return held.length > cap2 ? "impossible" : "possible";
+}
+function parseStreamMarkerName(t) {
+  let cursor = STREAM_MARKER.length;
+  while (cursor < t.length && isStreamWs(t[cursor])) cursor += 1;
+  const nameStart = cursor;
+  while (cursor < t.length && t[cursor] !== ">" && !isStreamWs(t[cursor])) cursor += 1;
+  const name = t.slice(nameStart, cursor);
+  if (name.length === 0) return cursor >= t.length ? "building" : "invalid";
+  return { name, complete: cursor < t.length && t[cursor] === ">" };
+}
+function someToolNameStartsWith(allowedToolNames, prefix) {
+  for (const name of allowedToolNames) {
+    if (name.startsWith(prefix)) return true;
+  }
+  return false;
+}
+function firstPossibleMarkerStart(held, allowedToolNames) {
+  for (let i = held.indexOf("<"); i !== -1; i = held.indexOf("<", i + 1)) {
+    if (streamToolCallBufferState(held.slice(i), allowedToolNames) === "possible") return i;
+  }
+  return -1;
+}
+var StreamSuppressionBuffer = class {
+  constructor(allowedToolNames) {
+    this.allowedToolNames = allowedToolNames;
+  }
+  allowedToolNames;
+  #held = "";
+  /** Feed a content delta; returns the text to emit as a `text_delta` now, or `undefined` to hold. */
+  push(content) {
+    this.#held += content;
+    if (streamToolCallBufferState(this.#held, this.allowedToolNames) === "possible")
+      return void 0;
+    const holdStart = firstPossibleMarkerStart(this.#held, this.allowedToolNames);
+    if (holdStart > 0) {
+      const flush2 = this.#held.slice(0, holdStart);
+      this.#held = this.#held.slice(holdStart);
+      return flush2;
+    }
+    const flush = this.#held;
+    this.#held = "";
+    return flush;
+  }
+  /** Drain the held buffer at stream end. `hasNativeCalls` mirrors `finish()`'s size-guard: when
+   *  native `tool_calls` exist, `finish()` won't strip the leaked block, so stream the held text WHOLE
+   *  (keeping `accumulatedText == finish.text`); otherwise strip the recoverable blocks. Idempotent. */
+  drain(hasNativeCalls) {
+    if (this.#held.length === 0) return void 0;
+    const held = this.#held;
+    this.#held = "";
+    if (hasNativeCalls) return held;
+    const residual = extractHermesToolCalls(held, () => "held", this.allowedToolNames).residualText;
+    return residual.length > 0 ? residual : void 0;
+  }
+};
 
 // src/internal/llm/openai.ts
 var OpenAIClient = class {
@@ -13747,7 +13826,10 @@ var OpenAIClient = class {
     }
     const accumulator = new OpenAIStreamAccumulator(
       this.options.extractToolCallsFromContent ?? false,
-      providerId
+      providerId,
+      // R5: request-scoped allowlist — leaked recovery only promotes a block whose name is a tool the
+      // model was actually given. Empty set (no tools) recovers nothing.
+      new Set(request.tools?.map((tool) => tool.name) ?? [])
     );
     for await (const record of parseSseStream(response.body, signal)) {
       if (record.data === "[DONE]") break;
@@ -13770,6 +13852,8 @@ var OpenAIClient = class {
       const events = accumulator.consume(chunk);
       for (const event of events) yield event;
     }
+    const drainEvent = accumulator.finalizeHeldText();
+    if (drainEvent !== void 0) yield drainEvent;
     return accumulator.finish();
   }
 };
@@ -13777,13 +13861,19 @@ var OpenAIStreamAccumulator = class {
   /**
    * @param extractFromContent opt-in leaked-dialect safe-parse (theokit#58). Default false.
    * @param providerName provider id, used only to label the recovery log line.
+   * @param allowedToolNames R5 request-scoped allowlist — built from `request.tools` at `stream()`;
+   *   leaked recovery in `finish()` only promotes a block whose name is in this set. `undefined`
+   *   (direct construction) recovers all (back-compat); an empty set recovers nothing.
    */
-  constructor(extractFromContent = false, providerName = "openai") {
+  constructor(extractFromContent = false, providerName = "openai", allowedToolNames) {
     this.extractFromContent = extractFromContent;
     this.providerName = providerName;
+    this.allowedToolNames = allowedToolNames;
+    this.suppress = extractFromContent && allowedToolNames !== void 0 && allowedToolNames.size > 0 ? new StreamSuppressionBuffer(allowedToolNames) : void 0;
   }
   extractFromContent;
   providerName;
+  allowedToolNames;
   text = "";
   stopReason = "end_turn";
   inputTokens;
@@ -13792,18 +13882,30 @@ var OpenAIStreamAccumulator = class {
   cacheWriteTokens;
   reasoningTokens;
   toolCalls = /* @__PURE__ */ new Map();
+  /** R7: present only when recovery is enabled AND the request declares tools — holds suspected
+   *  leaked-dialect content back from the `text_delta` stream. `undefined` ⇒ stream immediately. */
+  suppress;
   consume(chunk) {
     const events = [];
     this.applyUsage(chunk.usage);
     for (const choice of chunk.choices ?? []) {
-      const reasoningEvent = this.applyReasoningDelta(
-        choice.delta?.reasoning ?? choice.delta?.reasoning_content
-      );
-      if (reasoningEvent !== void 0) events.push(reasoningEvent);
-      const textEvent = this.applyContentDelta(choice.delta?.content);
-      if (textEvent !== void 0) events.push(textEvent);
-      this.mergeToolCallDeltas(choice.delta?.tool_calls);
-      this.applyFinishReason(choice.finish_reason);
+      events.push(...this.applyChoice(choice));
+    }
+    return events;
+  }
+  applyChoice(choice) {
+    const events = [];
+    const reasoningEvent = this.applyReasoningDelta(
+      choice.delta?.reasoning ?? choice.delta?.reasoning_content
+    );
+    if (reasoningEvent !== void 0) events.push(reasoningEvent);
+    const textEvent = this.applyContentDelta(choice.delta?.content);
+    if (textEvent !== void 0) events.push(textEvent);
+    this.mergeToolCallDeltas(choice.delta?.tool_calls);
+    this.applyFinishReason(choice.finish_reason);
+    if (choice.finish_reason !== void 0 && choice.finish_reason !== null) {
+      const flushEvent = this.finalizeHeldText();
+      if (flushEvent !== void 0) events.push(flushEvent);
     }
     return events;
   }
@@ -13828,7 +13930,17 @@ var OpenAIStreamAccumulator = class {
   applyContentDelta(content) {
     if (typeof content !== "string" || content.length === 0) return void 0;
     this.text += content;
-    return { type: "text_delta", text: content };
+    if (this.suppress === void 0) return { type: "text_delta", text: content };
+    const emit2 = this.suppress.push(content);
+    return emit2 !== void 0 ? { type: "text_delta", text: emit2 } : void 0;
+  }
+  /** R7 held-buffer finalizer, called at the `finish_reason` chunk (in `applyChoice`) AND after the
+   *  SSE loop in `stream()` — so a stream that omits a `finish_reason` terminal never silently drops
+   *  held text. `toolCalls.size > 0` (native calls present) makes `finish()` skip recovery, so the
+   *  buffer streams the held text whole. Idempotent once drained. */
+  finalizeHeldText() {
+    const emit2 = this.suppress?.drain(this.toolCalls.size > 0);
+    return emit2 !== void 0 ? { type: "text_delta", text: emit2 } : void 0;
   }
   mergeToolCallDeltas(deltas) {
     for (const call of deltas ?? []) {
@@ -13854,7 +13966,8 @@ var OpenAIStreamAccumulator = class {
     if (this.extractFromContent && toolCalls.length === 0) {
       const recovered = extractHermesToolCalls(
         this.text,
-        () => `hermes-${globalThis.crypto.randomUUID()}`
+        () => `hermes-${globalThis.crypto.randomUUID()}`,
+        this.allowedToolNames
       );
       if (recovered.toolCalls.length > 0) {
         toolCalls.push(...recovered.toolCalls);
@@ -13862,6 +13975,12 @@ var OpenAIStreamAccumulator = class {
         stopReason = "tool_use";
         process.stderr.write(
           `[theokit-sdk] recovered ${recovered.toolCalls.length} leaked tool call(s) from assistant content (provider="${this.providerName}", names=${recovered.toolCalls.map((c) => c.name).join(",")})
+`
+        );
+      }
+      if (recovered.droppedNames.length > 0) {
+        process.stderr.write(
+          `[theokit-sdk] dropped ${recovered.droppedNames.length} leaked block(s) whose name is not a tool in the request (provider="${this.providerName}", names=${recovered.droppedNames.join(",")})
 `
         );
       }