@zanii/blackbox 0.16.1 → 0.18.0

package/dist/analysis/faults.js

@@ -232,6 +232,27 @@ export const FAULTS = {
         en: "A tool's definition changed mid-session",
         ar: "تغيّر تعريف أداة أثناء الجلسة",
     },
+    USER_DOWNVOTE: {
+        fault: "BBX-4601",
+        en: "The person served said an answer was wrong",
+        ar: "قال الشخص المخدوم إن الإجابة خاطئة",
+    },
+    SECRET_SENT: {
+        fault: "BBX-9106",
+        en: "A credential was sent to a model or tool",
+        ar: "أُرسلت بيانات اعتماد إلى نموذج أو أداة",
+    },
+    PROMPT_INJECTION: {
+        fault: "BBX-7403",
+        squawk: "HIJACK",
+        en: "Prompt injection reached the model",
+        ar: "وصلت محاولة حقن تعليمات إلى النموذج",
+    },
+    TOOL_DRIFTED: {
+        fault: "BBX-7404",
+        en: "A tool's definition differs from earlier sessions",
+        ar: "يختلف تعريف أداة عمّا رأته الجلسات السابقة",
+    },
     REVOKED_MEMORY_READ: {
         fault: "BBX-7101",
         en: "A revoked memory was used",

package/dist/analysis/grounding.d.ts

@@ -45,6 +45,12 @@ export declare class Evidence {
     private pairSums;
 }
 /** The final answers on a record, each with the evidence it should rest on. */
+/**
+ * spec/findings.md §9: what the answer's own web search returned (Anthropic's server tool): each
+ * result's title, and each citation's quoted text and title. The provider supplies these from the
+ * pages, not the model, so a fact they hold is backed. Never the answer's own words.
+ */
+export declare function webEvidence(c: Call): string;
 export declare function answersOf(lines: readonly string[], bodies: Bodies): Array<{
     seq: number;
     text: string;

package/dist/analysis/grounding.js

@@ -460,6 +460,30 @@ export class Evidence {
     }
 }
 /** The final answers on a record, each with the evidence it should rest on. */
+/**
+ * spec/findings.md §9: what the answer's own web search returned (Anthropic's server tool): each
+ * result's title, and each citation's quoted text and title. The provider supplies these from the
+ * pages, not the model, so a fact they hold is backed. Never the answer's own words.
+ */
+export function webEvidence(c) {
+    const parts = [];
+    const add = (v) => {
+        if (typeof v === "string" && v)
+            parts.push(v);
+    };
+    for (const [, b] of [...c.blocks].sort(([x], [y]) => x - y)) {
+        const block = b;
+        if (block.type === "web_search_tool_result" && Array.isArray(block.content))
+            for (const r of block.content)
+                add(r?.title);
+        if (Array.isArray(block.citations))
+            for (const cit of block.citations) {
+                add(cit?.cited_text);
+                add(cit?.title);
+            }
+    }
+    return parts.join("\n");
+}
 export function answersOf(lines, bodies) {
     const calls = callsOf(lines, bodies);
     const ends = new Set(toolCallsOf(calls).map((t) => t.seq));
@@ -480,9 +504,11 @@ export function answersOf(lines, bodies) {
         const text = answerText(c);
         if (!text)
             continue;
+        const web = webEvidence(c);
         const pieces = [
             { seq: c.requestSeq, text: canonical(c.request) },
             ...results.filter((r) => r.seq < c.endSeq),
+            ...(web ? [{ seq: c.endSeq, text: web }] : []),
         ];
         out.push({
             seq: c.endSeq,

package/dist/analysis/index.d.ts

@@ -82,6 +82,20 @@ export declare function exitDurability(events: Ev[]): Finding[];
  * is the reference; a different one later is a finding, and becomes the new reference.
  */
 export declare function toolChanged(events: Ev[]): Finding[];
+/**
+ * spec/findings.md §1a: a tool's definition differs from the one this tenant's earlier sessions saw
+ * (a rug pull between sessions). The gateway puts the previous hashes next to a `tools/list` answer
+ * (`meta.tool_defs_prev`); a tool listed with another hash is a finding, once per server and tool.
+ */
+export declare function toolDrifted(events: Ev[]): Finding[];
+/**
+ * spec/data.md §6a: a credential left for a model or a tool. The record's own redaction counted it
+ * (`meta.redacted.secrets`); what the model was sent had fewer masked (`meta.outbound_redacted`), or
+ * the call went to an MCP tool. A request refused for it (`outbound_blocked`) sent nothing.
+ */
+export declare function secretSent(events: Ev[]): Finding[];
+/** spec/findings.md §12b: a person the agent served said an answer was wrong (👎), once per answer. */
+export declare function userDownvotes(events: Ev[]): Finding[];
 /** N6 (idea S3): the gateway refused a request that carried the session's own token. */
 export declare function tokenMisuse(events: Ev[]): Finding[];
 /** Stage 2 R3: a `verify` check that passed, then failed later in the run. */

package/dist/analysis/index.js

@@ -14,6 +14,7 @@ import { wallFindings } from "../walls/index.js";
 import { detectors } from "./detectors.js";
 import { groundingFindings, judgeFindings } from "./grounding.js";
 import { toolHallucinations } from "./hallucination.js";
+import { injectionFindings } from "./injection.js";
 import { flightPlan } from "./landing.js";
 import { memoryFindings } from "./memory.js";
 export { detectorAccuracy, wilsonLow } from "./accuracy.js";
@@ -56,6 +57,10 @@ export function analyze(lines, options) {
         ...orphanedToolCalls(events, now),
         ...tokenMisuse(events),
         ...toolChanged(events),
+        ...toolDrifted(events),
+        ...secretSent(events),
+        ...userDownvotes(events),
+        ...injectionFindings(lines, options.bodies),
         ...verifyRegression(events),
         ...falseSuccess(events, now),
         ...toolHallucinations(lines, options.bodies),
@@ -401,6 +406,105 @@ export function toolChanged(events) {
     }
     return out;
 }
+/**
+ * spec/findings.md §1a: a tool's definition differs from the one this tenant's earlier sessions saw
+ * (a rug pull between sessions). The gateway puts the previous hashes next to a `tools/list` answer
+ * (`meta.tool_defs_prev`); a tool listed with another hash is a finding, once per server and tool.
+ */
+export function toolDrifted(events) {
+    const out = [];
+    const done = new Set();
+    for (const e of events) {
+        const { server, tool_defs: defs, tool_defs_prev: prev } = e.meta;
+        if (e.kind !== "tool.result" || typeof server !== "string")
+            continue;
+        if (!defs || typeof defs !== "object" || Array.isArray(defs))
+            continue;
+        if (!prev || typeof prev !== "object" || Array.isArray(prev))
+            continue;
+        for (const tool of Object.keys(defs).sort()) {
+            const after = defs[tool];
+            const before = prev[tool];
+            const key = `${server}\u0000${tool}`;
+            if (typeof after !== "string" || typeof before !== "string" || before === after)
+                continue;
+            if (done.has(key))
+                continue;
+            done.add(key);
+            out.push({
+                code: "TOOL_DRIFTED",
+                source: "detectors",
+                severity: "warning",
+                ref: { seq: e.seq, server, tool, before, after },
+                detail: "A tool's description, schema or annotations differ from what this tenant's earlier sessions saw: the tool was changed between runs.",
+            });
+        }
+    }
+    return out;
+}
+/**
+ * spec/data.md §6a: a credential left for a model or a tool. The record's own redaction counted it
+ * (`meta.redacted.secrets`); what the model was sent had fewer masked (`meta.outbound_redacted`), or
+ * the call went to an MCP tool. A request refused for it (`outbound_blocked`) sent nothing.
+ */
+export function secretSent(events) {
+    const blocked = new Set();
+    for (const e of events)
+        if (e.kind === "llm.incomplete" &&
+            e.meta.reason === "outbound_blocked" &&
+            typeof e.meta.request_seq === "number")
+            blocked.add(e.meta.request_seq);
+    const count = (v) => {
+        const n = v?.secrets;
+        return typeof n === "number" && Number.isSafeInteger(n) && n > 0 ? n : 0;
+    };
+    const out = [];
+    for (const e of events) {
+        let to = null;
+        let n = 0;
+        if (e.kind === "llm.request" && !blocked.has(e.seq)) {
+            n = count(e.meta.redacted) - count(e.meta.outbound_redacted);
+            to = "model";
+        }
+        else if (e.kind === "tool.call" && typeof e.meta.tool === "string") {
+            n = count(e.meta.redacted);
+            to = "tool";
+        }
+        if (!to || n <= 0)
+            continue;
+        out.push({
+            code: "SECRET_SENT",
+            source: "detectors",
+            severity: "warning",
+            ref: { seq: e.seq, to, count: n, ...(to === "tool" ? { tool: e.meta.tool } : {}) },
+            detail: to === "model"
+                ? "A credential (a key, a token, a password) went to the model provider in the request."
+                : "A credential (a key, a token, a password) went to a tool in its arguments; the gateway's credential broker keeps them out of the agent's hands.",
+        });
+    }
+    return out;
+}
+/** spec/findings.md §12b: a person the agent served said an answer was wrong (👎), once per answer. */
+export function userDownvotes(events) {
+    const out = [];
+    const seen = new Set();
+    for (const e of events) {
+        const about = e.meta.about_seq;
+        if (e.kind !== "control" || e.meta.action !== "feedback" || e.meta.rating !== "down")
+            continue;
+        if (typeof about !== "number" || seen.has(about))
+            continue;
+        seen.add(about);
+        out.push({
+            code: "USER_DOWNVOTE",
+            source: "detectors",
+            severity: "advisory",
+            ref: { seq: about, feedback_seq: e.seq },
+            detail: "The person this answer was for said it was wrong.",
+        });
+    }
+    return out;
+}
 /** N6 (idea S3): the gateway refused a request that carried the session's own token. */
 export function tokenMisuse(events) {
     return events

package/dist/analysis/injection.d.ts

@@ -0,0 +1,22 @@
+/** The rules, in the order they're tried. Patterns run on ASCII-lowercased, space-folded text. */
+export declare const INJECTION_RULES: ReadonlyArray<{
+    id: string;
+    re: RegExp;
+}>;
+/** Text no reader sees: Unicode tag characters, bidi overrides, a run of 4+ zero-width characters. */
+export declare function hiddenText(text: string): boolean;
+/** The first rule a text breaks, or null. */
+export declare function injectionRule(text: string): string | null;
+/** spec/findings.md §1b: PROMPT_INJECTION findings over a record. */
+export declare function injectionFindings(lines: readonly string[], bodies: (hash: string) => Uint8Array | undefined): {
+    code: string;
+    source: string;
+    severity: "warning";
+    ref: {
+        seq: number;
+        source: string;
+        rule: string;
+        tool?: string;
+    };
+    detail: string;
+}[];

package/dist/analysis/injection.js

@@ -0,0 +1,173 @@
+// spec/findings.md §1b: prompt injection (PROMPT_INJECTION, squawk HIJACK). What reaches the model
+// from outside the agent's instructions is scanned: each MCP tool result, and the newest turn of
+// each model request (the tool results and the person's words it carries). Instruction overrides,
+// role hijacks, exfiltration asks and hidden text, in English and Arabic. One finding per event and
+// source; the finding names the rule, never the text. Mirrors analysis/injection.py; pinned by
+// spec/vectors/injection.json.
+const decoder = new TextDecoder();
+const MAX_TEXT = 200_000; // characters scanned per event: an injection is near the start or not worth the cost
+/** The rules, in the order they're tried. Patterns run on ASCII-lowercased, space-folded text. */
+export const INJECTION_RULES = [
+    {
+        id: "override",
+        re: /\b(ignore|disregard|forget|override|bypass)( all| any| the| your| these| those| my)* (previous|prior|above|earlier|preceding|system|original|safety)( \w+)? (instructions|prompts?|rules|directions|guidelines|messages|policies)\b/,
+    },
+    { id: "override", re: /(تجاهل|انس|انسى|تخط) (جميع |كل )?(التعليمات|الأوامر|القواعد|ما سبق)/ },
+    {
+        id: "role",
+        re: /(\byou are now\b|\bfrom now on,? you are\b|\bact as\b) (dan|an? unrestricted|a jailbroken|in developer mode)\b|<\|im_start\|>|<\|system\|>|\[system\]|### (system|new instructions)|\bnew instructions:/,
+    },
+    {
+        id: "exfiltrate",
+        re: /\b(send|post|upload|forward|email|exfiltrate|leak|paste)\b.{0,40}\b(system prompt|api keys?|passwords?|credentials|secrets?|conversation history|chat history|access tokens?|private keys?)\b/,
+    },
+    {
+        id: "exfiltrate",
+        re: /\b(reveal|print|repeat|show|output) (me )?(your|the) (system prompt|hidden instructions|initial instructions|original instructions)\b/,
+    },
+    {
+        id: "exfiltrate",
+        re: /(أرسل|ارسل|أفصح عن|اكشف) .{0,40}(كلمة المرور|كلمات المرور|مفتاح|بيانات الدخول|التعليمات المخفية)/,
+    },
+];
+/** Text no reader sees: Unicode tag characters, bidi overrides, a run of 4+ zero-width characters. */
+export function hiddenText(text) {
+    let zw = 0;
+    for (const ch of text) {
+        const c = ch.codePointAt(0);
+        if (c >= 0xe0000 && c <= 0xe007f)
+            return true;
+        if ((c >= 0x202a && c <= 0x202e) || (c >= 0x2066 && c <= 0x2069))
+            return true;
+        if (c === 0x200b || c === 0x200c || c === 0x200d || c === 0x2060 || c === 0xfeff) {
+            zw += 1;
+            if (zw >= 4)
+                return true;
+        }
+        else
+            zw = 0;
+    }
+    return false;
+}
+/** ASCII lowercase; spaces, tabs, newlines and line separators to one space: the same in every language. */
+const fold = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase()).replace(/[ \t\r\n\u2028\u2029]+/g, " ");
+/** The first rule a text breaks, or null. */
+export function injectionRule(text) {
+    const t = Array.from(text).slice(0, MAX_TEXT).join("");
+    if (hiddenText(t))
+        return "hidden";
+    const f = fold(t);
+    for (const r of INJECTION_RULES)
+        if (r.re.test(f))
+            return r.id;
+    return null;
+}
+/** Every string in a JSON value, depth first, in key order. */
+function strings(v, out) {
+    if (typeof v === "string")
+        out.push(v);
+    else if (Array.isArray(v))
+        for (const x of v)
+            strings(x, out);
+    else if (v && typeof v === "object")
+        for (const x of Object.values(v))
+            strings(x, out);
+}
+const textOf = (v) => {
+    const out = [];
+    strings(v, out);
+    return out.join("\n");
+};
+/** The newest turn of a model request: what it adds to the conversation. */
+function newestTurn(body) {
+    const out = [];
+    const messages = body.messages;
+    if (Array.isArray(messages) && messages.length) {
+        // Chat Completions: the trailing tool messages, and the last message itself
+        let i = messages.length - 1;
+        while (i > 0 && messages[i].role === "tool")
+            i -= 1;
+        for (const m of messages.slice(i)) {
+            if (m.role === "tool")
+                out.push({ source: "tool_result", text: textOf(m.content) });
+            else if (m.role === "user") {
+                // Anthropic: a user turn holds the tool results and the person's words
+                const blocks = Array.isArray(m.content) ? m.content : [m.content];
+                const results = blocks.filter((b) => b?.type === "tool_result");
+                const words = blocks.filter((b) => b?.type !== "tool_result");
+                if (results.length)
+                    out.push({ source: "tool_result", text: textOf(results) });
+                if (words.length)
+                    out.push({ source: "user", text: textOf(words) });
+            }
+        }
+        return out;
+    }
+    const input = body.input;
+    if (typeof input === "string")
+        return [{ source: "user", text: input }];
+    if (Array.isArray(input) && input.length) {
+        // Responses: the trailing function_call_output items, then the last item
+        let i = input.length - 1;
+        while (i > 0 && input[i].type === "function_call_output")
+            i -= 1;
+        for (const item of input.slice(i)) {
+            if (item.type === "function_call_output")
+                out.push({ source: "tool_result", text: textOf(item.output) });
+            else if (item.role === "user")
+                out.push({ source: "user", text: textOf(item.content) });
+        }
+    }
+    return out;
+}
+/** spec/findings.md §1b: PROMPT_INJECTION findings over a record. */
+export function injectionFindings(lines, bodies) {
+    const out = [];
+    const add = (seq, source, rule, tool) => out.push({
+        code: "PROMPT_INJECTION",
+        source: "detectors",
+        severity: "warning",
+        ref: { seq, source, rule, ...(tool !== undefined ? { tool } : {}) },
+        detail: rule === "hidden"
+            ? "Text the reader can't see (hidden characters) reached the model: a classic way to smuggle instructions."
+            : "Text that reached the model tries to give it new instructions: an override, a role change, or a request to send out secrets.",
+    });
+    for (const l of lines) {
+        const e = JSON.parse(l);
+        if (e.kind !== "tool.result" && e.kind !== "llm.request")
+            continue;
+        const raw = bodies(e.body_hash);
+        if (!raw || raw.length === 0)
+            continue;
+        let doc;
+        try {
+            doc = JSON.parse(decoder.decode(raw));
+        }
+        catch {
+            continue;
+        }
+        if (e.kind === "tool.result") {
+            const result = doc?.result;
+            if (result === undefined)
+                continue;
+            const rule = injectionRule(textOf(result));
+            const tool = typeof e.meta.tool === "string" ? e.meta.tool : undefined;
+            if (rule)
+                add(e.seq, "tool_result", rule, tool);
+            continue;
+        }
+        if (!doc || typeof doc !== "object" || Array.isArray(doc))
+            continue;
+        const seen = new Set();
+        for (const part of newestTurn(doc)) {
+            if (seen.has(part.source))
+                continue;
+            const rule = injectionRule(part.text);
+            if (rule) {
+                seen.add(part.source);
+                add(e.seq, part.source, rule);
+            }
+        }
+    }
+    return out;
+}

package/dist/analysis/taxonomy.js

@@ -18,6 +18,7 @@ export const MITRE_ATLAS = {
     "AML.T0034.000": "Cost Harvesting: Excessive Queries",
     "AML.T0034.001": "Cost Harvesting: Resource-Intensive Queries",
     "AML.T0034.002": "Cost Harvesting: Agentic Resource Consumption",
+    "AML.T0051": "LLM Prompt Injection",
     "AML.T0053": "AI Agent Tool Invocation",
     "AML.T0057": "LLM Data Leakage",
     "AML.T0080.000": "AI Agent Context Poisoning: Memory",
@@ -53,6 +54,9 @@ export const TAXONOMY = {
     STERILE_VIOLATION: { owasp: ["ASI02", "ASI10"], atlas: ["AML.T0053"] },
     TOKEN_MISUSE: { owasp: ["ASI03"], atlas: ["AML.T0091.000", "AML.T0086"] },
     TOOL_CHANGED: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
+    TOOL_DRIFTED: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
+    PROMPT_INJECTION: { owasp: ["ASI01"], atlas: ["AML.T0051"] },
+    SECRET_SENT: { owasp: ["ASI03"], atlas: ["AML.T0057"] },
     TOOL_OUTPUT_MISMATCH: { owasp: ["ASI04", "ASI06"], atlas: ["AML.T0110.002", "AML.T0099"] },
     TOOL_WITNESS_INVALID: { owasp: ["ASI04"], atlas: ["AML.T0110.002"] },
 };

package/dist/index.d.ts

@@ -2,7 +2,8 @@ export { A2A_STREAMING, type AgentCardReport, a2aMethod, a2aRequestMeta, a2aResp
 export { causality, memoryXray } from "./agents/index.ts";
 export { type DetectorOptions, detectors, fingerprint } from "./analysis/detectors.ts";
 export { FAULTS, type Fault, faultOf } from "./analysis/faults.ts";
-export { type Accuracy, type AnalyzeOptions, type AnswerClaims, analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, type ClaimEntry, type ClaimVerdict, type CriterionResult, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, type Fact, type Finding as AnalysisFinding, factsIn, findingKey, type GroundedClaim, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, type Label as AccuracyLabel, type Landing, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, type Outcome, type OutcomeRollup, packsFor, parseGroundingAnswer, parseJudgeAnswer, type ReferenceFact, type ReferencePack, type ReferenceVerdict, referenceContext, rollup, type Severity, schemaProblem, toolHallucinations, verifyAnswerCredential, type WasteReason, type WasteReport, waste, wilsonLow, } from "./analysis/index.ts";
+export { type Accuracy, type AnalyzeOptions, type AnswerClaims, analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, type ClaimEntry, type ClaimVerdict, type CriterionResult, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, type Fact, type Finding as AnalysisFinding, factsIn, findingKey, type GroundedClaim, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, type Label as AccuracyLabel, type Landing, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, type Outcome, type OutcomeRollup, packsFor, parseGroundingAnswer, parseJudgeAnswer, type ReferenceFact, type ReferencePack, type ReferenceVerdict, referenceContext, rollup, type Severity, schemaProblem, secretSent, toolDrifted, toolHallucinations, userDownvotes, verifyAnswerCredential, type WasteReason, type WasteReport, waste, wilsonLow, } from "./analysis/index.ts";
+export { injectionFindings, injectionRule } from "./analysis/injection.ts";
 export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, type Taxonomy, taxonomyOf, } from "./analysis/taxonomy.ts";
 export { type ApprovalFinding, approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.ts";
 export { textWarnings } from "./approvals/warnings.ts";

package/dist/index.js

@@ -4,7 +4,8 @@ export { A2A_STREAMING, a2aMethod, a2aRequestMeta, a2aResponseMeta, a2aRestMetho
 export { causality, memoryXray } from "./agents/index.js";
 export { detectors, fingerprint } from "./analysis/detectors.js";
 export { FAULTS, faultOf } from "./analysis/faults.js";
-export { analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, factsIn, findingKey, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, packsFor, parseGroundingAnswer, parseJudgeAnswer, referenceContext, rollup, schemaProblem, toolHallucinations, verifyAnswerCredential, waste, wilsonLow, } from "./analysis/index.js";
+export { analyze, answerClaims, answerCredential, answerRisk, answersOf, answerText, canonicalNumber, checkAgainstPacks, checkFlightPlan, checkpointReplay, detectorAccuracy, dualWitness, Evidence, eventsOf, factsIn, findingKey, groundingFindings, groundingRequest, HOLD_TRIGGERS, identifiersIn, judgeFindings, judgeRequest, landing, loadReferencePacks, modelGroundingFindings, normaliseValue, OUTCOMES, packsFor, parseGroundingAnswer, parseJudgeAnswer, referenceContext, rollup, schemaProblem, secretSent, toolDrifted, toolHallucinations, userDownvotes, verifyAnswerCredential, waste, wilsonLow, } from "./analysis/index.js";
+export { injectionFindings, injectionRule } from "./analysis/injection.js";
 export { MITRE_ATLAS, OWASP_ASI, TAXONOMY, taxonomyOf, } from "./analysis/taxonomy.js";
 export { approvalConfirmation, approvalFindings, argsHash, verifyConfirmation, } from "./approvals/index.js";
 export { textWarnings } from "./approvals/warnings.js";

package/dist/reconcile/record.d.ts

@@ -6,6 +6,8 @@ export interface Block {
     id?: string;
     name?: string;
     input?: unknown;
+    /** Anthropic: where a text block's words come from (web search: the page, its title, the quote). */
+    citations?: unknown[];
 }
 export interface Call {
     requestSeq: number;

package/dist/reconcile/record.js

@@ -182,6 +182,10 @@ function rebuild(call, body) {
                 block.thinking = (block.thinking ?? "") + d.thinking;
             else if (d.type === "input_json_delta" && typeof d.partial_json === "string")
                 partial.set(event.index, (partial.get(event.index) ?? "") + d.partial_json);
+            else if (d.type === "citations_delta" && isObj(d.citation)) {
+                block.citations ??= [];
+                block.citations.push(d.citation);
+            }
         }
         else if (type === "content_block_stop" && typeof event.index === "number") {
             const block = call.blocks.get(event.index);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.16.1";
+export declare const VERSION = "0.18.0";

package/dist/version.js

@@ -1,2 +1,2 @@
 // The SDK version, on its own so the CLI can print it without loading the whole SDK.
-export const VERSION = "0.16.1";
+export const VERSION = "0.18.0";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zanii/blackbox",
   "license": "Apache-2.0",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "The flight recorder for AI agents: sessions, a zero-loss spool, framework hooks, approvals, and offline verification of the gateway's hash-chained record.",
   "keywords": [
     "ai-agents",