blun-king-cli 9.1.456 → 9.1.458

package/bin/cognitive-action-checkpoint.cjs

@@ -316,7 +316,18 @@ function externalReportOriginFromRuntimeSource(input) {
   });
 }
 
-function resolveExternalReportOrigin(selectorInput, runtimeExternalReports) {
+function assertExternalReportChecksumClaims(report, claimText) {
+  const claims = extractChecksumClaims(claimText);
+  if (claims.length === 0) return;
+  const reportClaims = new Set(report.claimTokens ?? []);
+  for (const claim of claims) {
+    if (!reportClaims.has(claim)) {
+      throw new TypeError(`checksum claim ${claim} is absent from the selected external report`);
+    }
+  }
+}
+
+function resolveExternalReportOrigin(selectorInput, runtimeExternalReports, claimText) {
   const selector = normalizeExternalReportSelector(selectorInput);
   const reports = Array.isArray(runtimeExternalReports)
     ? runtimeExternalReports.map(normalizeRuntimeExternalReportSource)
@@ -327,6 +338,7 @@ function resolveExternalReportOrigin(selectorInput, runtimeExternalReports) {
   if (report === undefined) {
     throw new TypeError('externalReportSource does not match a trusted external report in the current turn');
   }
+  assertExternalReportChecksumClaims(report, claimText);
   return externalReportOriginFromRuntimeSource(report);
 }
 
@@ -911,7 +923,7 @@ function assertActionCheckpointEvidenceBasis(current, input, runtimeEvidence, ru
       throw new TypeError('external_report evidenceBasis cannot claim verified epistemicState');
     }
     if (runtimeExternalReports !== undefined) {
-      resolveExternalReportOrigin(input?.externalReportSource, runtimeExternalReports);
+      resolveExternalReportOrigin(input?.externalReportSource, runtimeExternalReports, input?.lastVerified);
     }
   } else if (input?.externalReportSource !== undefined) {
     throw new TypeError('externalReportSource requires external_report evidenceBasis');
@@ -972,6 +984,7 @@ function normalizeActionCheckpoint(input, options = {}) {
     checkpoint.externalReportOrigin = resolveExternalReportOrigin(
       input.externalReportSource,
       options.runtimeExternalReports,
+      input.lastVerified,
     );
   } else if (replay && input.externalReportOrigin !== undefined) {
     checkpoint.externalReportOrigin = normalizeExternalReportOrigin(input.externalReportOrigin);

package/bin/outbound-claim-provenance.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 const MAX_CLAIMS = 32;
+const MAX_CONFLICT_ORIGINS = 8;
 const CHECKSUM_CLAIM_RE = /(?<![A-Za-z0-9])[A-Fa-f0-9]{16,128}(?![A-Za-z0-9])/gu;
 const TELEGRAM_MESSAGE_TOOL_RE = /^mcp__[^\s]*telegram[^\s]*__(?:reply|edit_message)$/iu;
 const REF_RE = /^[a-f0-9]{16}$/u;
@@ -56,12 +57,22 @@ function normalizedExternalReports(value) {
   return reports;
 }
 
+function externalClaimOrigin(report) {
+  return Object.freeze({
+    reporter: report.reporter,
+    ...(report.reporterRef !== undefined ? { reporterRef: report.reporterRef } : {}),
+    eventRef: report.eventRef,
+    occurredAt: report.occurredAt,
+  });
+}
+
 function assessOutboundClaimProvenance({ text, localClaims = [], externalReports = [] } = {}) {
   const claims = extractChecksumClaims(text);
   const local = new Set(extractChecksumClaims(Array.isArray(localClaims) ? localClaims.join(' ') : ''));
   const reports = normalizedExternalReports(externalReports);
   const localMatches = [];
   const externalMatches = [];
+  const conflicted = [];
   const unattributed = [];
 
   for (const value of claims) {
@@ -69,17 +80,31 @@ function assessOutboundClaimProvenance({ text, localClaims = [], externalReports
       localMatches.push(value);
       continue;
     }
-    const report = reports.find((candidate) => candidate.claimTokens.includes(value));
-    if (report === undefined) {
+    const matchingByEvent = new Map();
+    for (const report of reports) {
+      if (report.claimTokens.includes(value) && !matchingByEvent.has(report.eventRef)) {
+        matchingByEvent.set(report.eventRef, report);
+      }
+    }
+    const matchingReports = [...matchingByEvent.values()];
+    if (matchingReports.length === 0) {
       unattributed.push(value);
       continue;
     }
+    if (matchingReports.length > 1) {
+      conflicted.push(Object.freeze({
+        value,
+        totalOrigins: matchingReports.length,
+        reports: Object.freeze(
+          matchingReports.slice(0, MAX_CONFLICT_ORIGINS).map(externalClaimOrigin),
+        ),
+      }));
+      continue;
+    }
+    const [report] = matchingReports;
     const external = {
       value,
-      reporter: report.reporter,
-      ...(report.reporterRef !== undefined ? { reporterRef: report.reporterRef } : {}),
-      eventRef: report.eventRef,
-      occurredAt: report.occurredAt,
+      ...externalClaimOrigin(report),
     };
     externalMatches.push(Object.freeze(external));
   }
@@ -87,6 +112,7 @@ function assessOutboundClaimProvenance({ text, localClaims = [], externalReports
   return Object.freeze({
     local: Object.freeze(localMatches),
     external: Object.freeze(externalMatches),
+    conflicted: Object.freeze(conflicted),
     unattributed: Object.freeze(unattributed),
   });
 }
@@ -111,7 +137,9 @@ function provenanceAdvisoryForToolCall({ toolName, toolArgs, localClaims, extern
     localClaims,
     externalReports,
   });
-  if (assessment.external.length === 0 && assessment.unattributed.length === 0) return null;
+  if (assessment.external.length === 0
+      && assessment.conflicted.length === 0
+      && assessment.unattributed.length === 0) return null;
   return Object.freeze({ ...assessment, blocked: false });
 }
 

package/blun.mjs

@@ -261955,15 +261955,21 @@ var init_turn = __esmMin((() => {
 				});
 				if (provenanceAdvisory === null) return;
 				const external = provenanceAdvisory.external.map((entry) => `${entry.value} (${entry.reporter}; ${entry.eventRef}; ${entry.occurredAt})`).join(", ") || "-";
+				const conflicted = provenanceAdvisory.conflicted.map((entry) => `${entry.value} (${entry.reports.map((report) => `${report.reporter}; ${report.eventRef}; ${report.occurredAt}`).join(" | ")})`).join(", ") || "-";
 				const unattributed = provenanceAdvisory.unattributed.join(", ") || "-";
 				this.agent.emitEvent({
 					type: "warning",
 					code: "OUTBOUND_CLAIM_PROVENANCE",
-					message: uiText("sessionEvent.provenance.advisory", { external, unattributed }),
+					message: uiText("sessionEvent.provenance.advisory", {
+						external,
+						conflicted,
+						unattributed
+					}),
 					blocked: false,
 					details: {
 						blocked: false,
 						external: provenanceAdvisory.external,
+						conflicted: provenanceAdvisory.conflicted,
 						unattributed: provenanceAdvisory.unattributed
 					}
 				});
@@ -506466,7 +506472,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Goal blocked.",
 		"sessionEvent.goalQueue.blockedDetail": "The next queued goal will start only after this goal is complete.",
 		"sessionEvent.warning": "Warning: {message}",
-		"sessionEvent.provenance.advisory": "Source check before sending; the message was not blocked. Forwarded report: {external}. Not found in this turn's tool output or a source event: {unattributed}. Forwarding is allowed, but do not present these values as your own measurement.",
+		"sessionEvent.provenance.advisory": "Source check before sending; the message was not blocked. Forwarded report: {external}. Ambiguous source events: {conflicted}. Not found in this turn's tool output or a source event: {unattributed}. Forwarding is allowed, but do not present these values as your own measurement.",
 		"sessionEvent.mcp.tool.one": "{count} tool",
 		"sessionEvent.mcp.tool.other": "{count} tools",
 		"sessionEvent.mcp.connected": "MCP server \"{name}\" connected · {tools} ({transport})",
@@ -506497,7 +506503,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Ziel blockiert.",
 		"sessionEvent.goalQueue.blockedDetail": "Das nächste vorgemerkte Ziel startet erst, wenn dieses Ziel abgeschlossen ist.",
 		"sessionEvent.warning": "Warnung: {message}",
-		"sessionEvent.provenance.advisory": "Herkunftsprüfung vor dem Senden; die Nachricht wurde nicht blockiert. Weitergeleiteter Bericht: {external}. Weder in einer Werkzeugausgabe dieses Durchlaufs noch in einem Quellereignis gefunden: {unattributed}. Die Weitergabe ist erlaubt, diese Werte dürfen jedoch nicht als eigene Messung dargestellt werden.",
+		"sessionEvent.provenance.advisory": "Herkunftsprüfung vor dem Senden; die Nachricht wurde nicht blockiert. Weitergeleiteter Bericht: {external}. Mehrdeutige Quellereignisse: {conflicted}. Weder in einer Werkzeugausgabe dieses Durchlaufs noch in einem Quellereignis gefunden: {unattributed}. Die Weitergabe ist erlaubt, diese Werte dürfen jedoch nicht als eigene Messung dargestellt werden.",
 		"sessionEvent.mcp.tool.one": "{count} Tool",
 		"sessionEvent.mcp.tool.other": "{count} Tools",
 		"sessionEvent.mcp.connected": "MCP-Server „{name}“ verbunden · {tools} ({transport})",
@@ -506528,7 +506534,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Objetivo bloqueado.",
 		"sessionEvent.goalQueue.blockedDetail": "El siguiente objetivo en cola no se iniciará hasta que este objetivo se complete.",
 		"sessionEvent.warning": "Advertencia: {message}",
-		"sessionEvent.provenance.advisory": "Comprobación de procedencia antes de enviar; el mensaje no se bloqueó. Informe reenviado: {external}. No se encontraron en la salida de las herramientas de este turno ni en un evento de origen: {unattributed}. Se permite reenviar estos valores, pero no presentarlos como mediciones propias.",
+		"sessionEvent.provenance.advisory": "Comprobación de procedencia antes de enviar; el mensaje no se bloqueó. Informe reenviado: {external}. Eventos de origen ambiguos: {conflicted}. No se encontraron en la salida de las herramientas de este turno ni en un evento de origen: {unattributed}. Se permite reenviar estos valores, pero no presentarlos como mediciones propias.",
 		"sessionEvent.mcp.tool.one": "{count} herramienta",
 		"sessionEvent.mcp.tool.other": "{count} herramientas",
 		"sessionEvent.mcp.connected": "Servidor MCP «{name}» conectado · {tools} ({transport})",
@@ -506559,7 +506565,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Objectif bloqué.",
 		"sessionEvent.goalQueue.blockedDetail": "L’objectif suivant ne démarrera qu’une fois cet objectif terminé.",
 		"sessionEvent.warning": "Avertissement : {message}",
-		"sessionEvent.provenance.advisory": "Vérification de la provenance avant l’envoi ; le message n’a pas été bloqué. Rapport transmis : {external}. Valeurs introuvables dans la sortie des outils de ce tour et dans les événements source : {unattributed}. Leur transmission est autorisée, mais ne les présentez pas comme vos propres mesures.",
+		"sessionEvent.provenance.advisory": "Vérification de la provenance avant l’envoi ; le message n’a pas été bloqué. Rapport transmis : {external}. Événements source ambigus : {conflicted}. Valeurs introuvables dans la sortie des outils de ce tour et dans les événements source : {unattributed}. Leur transmission est autorisée, mais ne les présentez pas comme vos propres mesures.",
 		"sessionEvent.mcp.tool.one": "{count} outil",
 		"sessionEvent.mcp.tool.other": "{count} outils",
 		"sessionEvent.mcp.connected": "Serveur MCP « {name} » connecté · {tools} ({transport})",
@@ -506590,7 +506596,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Målet är blockerat.",
 		"sessionEvent.goalQueue.blockedDetail": "Nästa köade mål startar först när det här målet är slutfört.",
 		"sessionEvent.warning": "Varning: {message}",
-		"sessionEvent.provenance.advisory": "Ursprungskontroll före sändning; meddelandet blockerades inte. Vidarebefordrad rapport: {external}. Hittades varken i verktygsutdata från den här körningen eller i en källhändelse: {unattributed}. Värdena får vidarebefordras, men framställ dem inte som egna mätningar.",
+		"sessionEvent.provenance.advisory": "Ursprungskontroll före sändning; meddelandet blockerades inte. Vidarebefordrad rapport: {external}. Tvetydiga källhändelser: {conflicted}. Hittades varken i verktygsutdata från den här körningen eller i en källhändelse: {unattributed}. Värdena får vidarebefordras, men framställ dem inte som egna mätningar.",
 		"sessionEvent.mcp.tool.one": "{count} verktyg",
 		"sessionEvent.mcp.tool.other": "{count} verktyg",
 		"sessionEvent.mcp.connected": "MCP-servern ”{name}” är ansluten · {tools} ({transport})",
@@ -506621,7 +506627,7 @@ registerUiCatalogFragment({
 		"sessionEvent.goalQueue.blockedTitle": "Cíl je blokován.",
 		"sessionEvent.goalQueue.blockedDetail": "Další cíl ve frontě se spustí pouze po dokončení tohoto cíle.",
 		"sessionEvent.warning": "Upozornění: {message}",
-		"sessionEvent.provenance.advisory": "Kontrola původu před odesláním; zpráva nebyla zablokována. Předaný report: {external}. Nenalezeno ve výstupu nástrojů tohoto kola ani ve zdrojové události: {unattributed}. Tyto hodnoty lze předat dál, ale neuvádějte je jako vlastní měření.",
+		"sessionEvent.provenance.advisory": "Kontrola původu před odesláním; zpráva nebyla zablokována. Předaný report: {external}. Nejednoznačné zdrojové události: {conflicted}. Nenalezeno ve výstupu nástrojů tohoto kola ani ve zdrojové události: {unattributed}. Tyto hodnoty lze předat dál, ale neuvádějte je jako vlastní měření.",
 		"sessionEvent.mcp.tool.one": "Nástroje: {count}",
 		"sessionEvent.mcp.tool.other": "Nástroje: {count}",
 		"sessionEvent.mcp.connected": "Server MCP \"{name}\" připojen · {tools} ({transport})",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blun-king-cli",
-  "version": "9.1.456",
+  "version": "9.1.458",
   "description": "BLUN CLI - your own AI agent with a Telegram channel. Get it done. With BLUN.",
   "license": "MIT",
   "bin": {