llm-output-guard 1.4.0 → 1.5.0

package/README.md

@@ -7,12 +7,26 @@
 
 **Detect LLM responses that failed while returning `200 OK`.**
 
+<!--
+  Two rows on purpose: what you are installing, then whether it is looked after.
+
+  Every GitHub-backed badge carries an explicit cacheSeconds. Shields defaults
+  these to max-age=120, which has GitHub's camo proxy refetch 720 times a day
+  and gives 720 daily chances to catch the upstream API rate limited and cache
+  the error for the whole TTL. That is not hypothetical: it happened to the
+  downloads badge, which is why it carries one too.
+-->
 [![npm](https://img.shields.io/npm/v/llm-output-guard?color=0b7285)](https://www.npmjs.com/package/llm-output-guard)
-[![downloads](https://img.shields.io/npm/dm/llm-output-guard?color=0b7285)](https://www.npmjs.com/package/llm-output-guard)
+[![downloads](https://img.shields.io/npm/dm/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://www.npmjs.com/package/llm-output-guard)
 [![minzipped](https://img.shields.io/bundlejs/size/llm-output-guard?color=0b7285&label=min%2Bgzip)](https://bundlejs.com/?q=llm-output-guard)
 [![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](https://github.com/edwinsatya/llm-output-guard/blob/main/package.json)
+[![types](https://img.shields.io/npm/types/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://www.npmjs.com/package/llm-output-guard)
+[![node](https://img.shields.io/node/v/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://nodejs.org)
+
 [![CI](https://github.com/edwinsatya/llm-output-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/edwinsatya/llm-output-guard/actions/workflows/ci.yml)
-[![license](https://img.shields.io/npm/l/llm-output-guard?color=0b7285)](./LICENSE)
+[![last commit](https://img.shields.io/github/last-commit/edwinsatya/llm-output-guard?color=0b7285&cacheSeconds=21600)](https://github.com/edwinsatya/llm-output-guard/commits/main)
+[![commit activity](https://img.shields.io/github/commit-activity/m/edwinsatya/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://github.com/edwinsatya/llm-output-guard/graphs/commit-activity)
+[![license](https://img.shields.io/npm/l/llm-output-guard?color=0b7285&cacheSeconds=86400)](./LICENSE)
 
 Your retry layer watches for `429`, `5xx` and timeouts. It cannot see a model that
 looped until `max_tokens`, returned `{}`, stopped mid-sentence, or answered in the
@@ -56,12 +70,16 @@ every detector, running on your own pasted output. No API key, no request.
 | `LOW_ENTROPY` | Character-level collapse, token artifacts | Compression ratio |
 | `TRUNCATED` | Cut off mid-thought | `finish_reason`, unbalanced fences |
 | `INVALID_JSON` | Prose around the payload, wrong types | Parse + key + schema contract |
-| `SCRIPT_MISMATCH` | Answered in the wrong alphabet | Share of letters outside the expected scripts (opt-in) |
-| `LANG_MISMATCH` | Answered in the wrong language, same alphabet | Function-word profile (opt-in) |
+| `SCRIPT_MISMATCH` | Answered in the wrong alphabet | Share of letters outside expected scripts · opt-in |
+| `LANG_MISMATCH` | Wrong language, same alphabet | Function-word profile · opt-in |
+| `PROMPT_ECHO` | Returned your prompt instead of an answer | Share of output copied from the prompt · opt-in |
 
 Every detector runs even after one fails, so a verdict shows the whole picture
 rather than whichever check happened to be ordered first. Each returns **0–1, not
-a boolean** — you pick the line. Full reference: **[docs/detectors.md](docs/detectors.md)**.
+a boolean** — you pick the line.
+
+**Full reference, with the measurements behind every default:
+[docs/detectors.md](docs/detectors.md)**
 
 ## Guard your provider in one wrap
 
@@ -77,8 +95,10 @@ Adapters for the **OpenAI SDK** (both `chat.completions` and `responses`),
 protocol: Groq, Together, OpenRouter, Fireworks, vLLM, Ollama.
 
 On a stream this **cancels the HTTP request** the moment a loop is detectable, so
-you stop paying for the rest of it. See **[docs/adapters.md](docs/adapters.md)**
-and **[docs/streaming.md](docs/streaming.md)**.
+you stop paying for the rest of it. Running agents? Add `checkToolArguments: true`
+to measure the arguments as well as the prose beside them.
+
+**[docs/adapters.md](docs/adapters.md)** · **[docs/streaming.md](docs/streaming.md)**
 
 ## The hard part is not catching loops
 
@@ -86,89 +106,58 @@ A miss is annoying. **A false positive is worse** — a healthy response gets
 discarded and retried against a slower provider for nothing.
 
 So the corpus carries deliberate traps: markdown tables, repeated-prefix lists,
-code blocks, rhetorical refrains, a Chinese poem refrain. All repetitive, all
-fine, all flagged by a naive detector. Paste one into the
+code blocks, rhetorical refrains, a Chinese poem refrain, a Chinese answer
+wrapped around a TypeScript block. All of them look degenerate to a naive
+detector, and all of them are fine. Paste one into the
 [playground](https://edwinsatya.github.io/llm-output-guard/) and watch it pass.
 
 ---
 
-### Structured output
+## Common setups
 
-```ts
-const verdict = checkOutput(raw, {
-  ...presets.strictJson,
-  requiredKeys: ['score', 'notes', 'followUp'],
-});
-
-if (verdict.ok) use(verdict.json); // already parsed, fence stripped
-```
-
-`requiredKeys` only asks whether a name is present. A model returning
-`{ "score": "very good" }` where you wanted a number satisfies it and still
-breaks everything downstream that does arithmetic. Pass a **schema** to check
-the shape rather than the spelling:
+**Structured output** — parse, check keys, and validate against a schema you
+already have:
 
 ```ts
 import { z } from 'zod';
 
-const Review = z.object({
-  score: z.number().min(0).max(10),
-  notes: z.string(),
-  followUp: z.array(z.string()),
+const verdict = checkOutput(raw, {
+  ...presets.strictJson,
+  schema: z.object({ score: z.number(), notes: z.string() }),
 });
 
-const verdict = checkOutput(raw, { ...presets.strictJson, schema: Review });
-
 if (verdict.ok) use(verdict.json); // parsed, validated, defaults applied
 ```
 
-Any [Standard Schema](https://standardschema.dev) validator works — **Zod 4,
-Valibot, ArkType**, or your own. The spec is types-only, so this costs an
-interface and **no dependency**: your validator is one you already have, and
-`llm-output-guard` still installs with nothing behind it.
-
-On success `verdict.json` is the schema's *output*, so defaults, coercions and
-transforms are applied and the value matches the type you declared. On failure
-you get `INVALID_JSON` with the failing path in the message —
-`score: Expected number, received string`. It is the same reason code as a
-missing key or an unparseable payload because it wants the same handling: retry,
-or fall through to another provider.
-
-The two compose, and keys are checked first, so a missing key is still reported
-as a missing key rather than as whatever the schema calls it.
+Any [Standard Schema](https://standardschema.dev) validator works — Zod 4,
+Valibot, ArkType — and the spec is types-only, so this still costs **no
+dependency**. Details, and the one case that throws:
+[docs/detectors.md](docs/detectors.md#structured-output)
 
-> **The schema must validate synchronously.** `checkOutput` is synchronous by
-> design — that is what makes it safe on a hot path — so a schema carrying an
-> async refinement throws a `TypeError` telling you so, rather than silently
-> passing. Everything Zod, Valibot and ArkType produce otherwise is synchronous.
-> This is the one thing in the package that throws about your configuration; it
-> still never throws about a response.
-
-See **[docs/detectors.md](docs/detectors.md)** for arrays of repeated records —
-a JSON array of identical rows reads as a loop under the default scope, and
-`redundancyScope: 'jsonValues'` is the fix.
-
-### Answering in the wrong language
+**Answered in the wrong language** — a model that ignores "answer in English"
+returns fluent Chinese, not broken English:
 
 ```ts
 checkOutput(raw, { ...presets.chat, expectScript: 'latin' });
 ```
 
-A model that ignores "answer in English" does not produce broken English, it
-produces fluent Chinese. That is a `200 OK` your retry layer cannot see, and it
-is detectable by counting characters — no word list, no model, decisive from
-about a dozen letters. A response answered entirely in the wrong script scores
-**1.000**; a healthy response measured against its own script scores
-**0.000–0.028**.
+Detectable by counting characters — no word list, decisive from about a dozen
+letters. A wrong-script answer scores **1.000**; a healthy one measured against
+its own script scores **0.000–0.028**. Pass every script the answer may
+legitimately contain (`['han', 'latin']` for Chinese). Code fences and URLs are
+excluded, so a TypeScript block never counts as answering in English.
+[More →](docs/detectors.md#answering-in-the-wrong-language)
 
-Pass every script the answer may legitimately contain — `['han', 'latin']` for
-Chinese, `['han', 'kana', 'latin']` for Japanese. `'latin'` belongs in nearly all
-of them, because a Chinese answer about React still contains `useEffect`. Code
-fences, inline code and URLs are removed before measuring, so a TypeScript block
-never counts as answering in English.
+**Returned your prompt instead of an answer** — invisible to every other
+detector here, because such a response is fluent, well-formed and the right
+length:
+
+```ts
+checkOutput(raw, { ...presets.chat, prompt });
+```
 
-Same script means no signal: Spanish against English scores 0. That is what
-`expectLang` is for, and the two compose under separate codes.
+Not for rewrite, translate or summarise endpoints, where copying the input is
+the job. [More →](docs/detectors.md#returning-the-prompt-instead-of-an-answer)
 
 ## The verdict
 
@@ -185,26 +174,26 @@ Same script means no signal: Spanish against English scores 0. That is what
 }
 ```
 
-Every detector runs even after one fails, so `reasons` shows the whole picture instead of whichever check happened to be ordered first. `scores` includes passing detectors too — send them to your metrics and you will know your real degeneration rate within a day.
+`reasons` carries every failing signal, not just the first. `scores` includes the
+passing detectors too — send them to your metrics and you will know your real
+degeneration rate within a day.
 
-`modes` says which tokenizer produced a score, for the detectors that have more
-than one. **Log it next to `scores`.** `TAIL_LOOP` measures words on spaced
-scripts and characters on Chinese, Japanese and Thai; those are two
-distributions with different base rates, and aggregating them into one histogram
-gives you a number that describes neither.
+`modes` says which tokenizer produced a score. **Log it next to `scores`:**
+`TAIL_LOOP` measures words on spaced scripts and characters on Chinese, Japanese
+and Thai, and pooling two distributions into one histogram gives you a number
+that describes neither.
 
 ## Presets
 
 `chat` · `strictJson` · `longForm` · `lenient`
 
-They are starting points calibrated against the fixture corpus in this repo — not universal truths. Log your scores for a week, then set your own thresholds.
-
----
+Starting points calibrated against this repo's fixture corpus — not universal
+truths.
 
-## Calibrating against your own traffic
+## Calibrate against your own traffic
 
-The shipped presets are tuned on this repo's fixture corpus, which is **not your
-traffic**. Log your scores for a week, then derive thresholds you can defend:
+The shipped presets are tuned on a corpus that is **not your traffic**. Log your
+scores for a week, then derive thresholds you can defend:
 
 ```bash
 npx llm-output-guard calibrate scores.jsonl --fpr 0.001
@@ -212,44 +201,33 @@ npx llm-output-guard calibrate scores.jsonl --fpr 0.001
 
 The report tells you when your sample is too small to support the rate you asked
 for, and distinguishes real separation in your data from a false-positive budget —
-because only one of those is evidence. Full guide:
-**[docs/calibration.md](docs/calibration.md)**.
-
-## Script coverage
-
-Korean, Cyrillic, Greek, Arabic and Devanagari separate words and are handled like
-English. **Chinese, Japanese and Thai do not**, so `TAIL_LOOP` switches to
-character mode and reads its own threshold. `REPETITION` is blind on those scripts —
-a known, measured gap. `SCRIPT_MISMATCH` covers all ten scripts and is the one
-detector these are *not* the weak case for. Numbers behind both in
-**[docs/script-coverage.md](docs/script-coverage.md)**.
+because only one of those is evidence.
+**[docs/calibration.md](docs/calibration.md)**
 
 ## Design notes
 
-- **Zero runtime dependencies**, enforced in CI. Node ≥ 18, works on edge, browser, Deno, Bun.
-- **Hand-rolled LZ77** rather than `node:zlib`, so the package stays runtime-agnostic. It is not a real compressor; it only needs to move monotonically with redundancy.
+- **Zero runtime dependencies**, enforced in CI. Node ≥ 18; works on edge, browser, Deno, Bun.
 - **Pure and synchronous.** No network, no clock, no randomness — safe on a hot path, trivial to test.
 - **Scores, not booleans.** Detectors report 0–1 and leave the threshold decision to you.
 - **Abstains rather than guesses.** Samples too short to judge score 0.
+- **Hand-rolled LZ77** rather than `node:zlib`, so the package stays runtime-agnostic.
+- **Sub-millisecond**, 0.383 ms at 500 B and 1.014 ms at 32 KB, with one detector accounting for most of it. `npm run bench` reproduces it — **[docs/performance.md](docs/performance.md)**
+- **Chinese, Japanese and Thai** are handled where they differ: `TAIL_LOOP` switches to character mode, `REPETITION` is blind and says so — **[docs/script-coverage.md](docs/script-coverage.md)**
 
 ## Stability
 
-What semver means for this package specifically. These rules bind from **1.0.0**
-onward; under `0.x` they described an intent, and the surface was frozen — export
-by export — in the 1.0.0 release.
-
-**The public API is:** everything exported from `llm-output-guard`, plus
-`outputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./ai-sdk`, and
-`withOutputGuard` / `OutputGuardOptions` / `DegenerateAction` from each of
-`./openai` and `./anthropic`. Each subpath is its own contract; the adapters
-share internal base types today and are free to diverge, so an option added to
-one is not a promise about the others. Anything not exported from those four
-entry points is internal, has no stability guarantee, and may move in any release
-— `internal/proxy-guard.ts` and `internal/tool-calls.ts` included, however much
-behaviour they carry. The list is asserted in `test/surface.test.ts`, so an
-export cannot join it by accident.
-
-**Threshold and preset values are behaviour, not implementation.** This is the
+What semver means here specifically. These rules bind from **1.0.0** onward, and
+the public surface was frozen export by export in that release.
+
+**The public API is** everything exported from `llm-output-guard`, plus
+`outputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./ai-sdk` and
+`withOutputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./openai` and
+`./anthropic`. Each subpath is its own contract, so an option added to one is not
+a promise about the others. Anything else is internal and may move in any
+release. The list is asserted in `test/surface.test.ts`, so an export cannot join
+it by accident.
+
+**Threshold and preset values are behaviour, not implementation.** That is the
 interesting case, so it gets a rule of its own:
 
 | Change | Release type |
@@ -259,42 +237,38 @@ interesting case, so it gets a rule of its own:
 | Adding a new *option*, defaulted so nothing changes | minor |
 | Adding a new detector that is opt-in | minor |
 | Making an existing detector strictly more accurate on its own axis | minor |
-| Docs, internals, performance, fixing a detector that was returning a wrong score | patch |
-
-The reasoning: a threshold change does not break your build, it changes which of
-your production responses get discarded and retried. That is a larger event than
-a signature change, and it is invisible until your traffic hits it. A number in
-`presets.chat` is part of the contract in the same way a function name is.
-
-**Semver does not cover:** the exact scores a detector returns (only their
-direction and the thresholds that act on them), the contents of the fixture
-corpus, `message` strings in `Reason`, or the output format of the `calibrate`
-CLI's human-readable report. `--json` output *is* covered.
-
-**Peer ranges** are narrowed only in a major. They are verified rather than
-assumed — `npm run check:peers` installs the packed tarball against each end of
-each declared range and both typechecks and runs the adapter.
-
-**Why this is written down.** Version 0.4.2 shipped the `ai` peer narrowing, the
-new `./openai` subpath, and character-mode `TAIL_LOOP` — one breaking change, one
-feature, and one behaviour change — under a **patch** number, which every default
-version range upgrades into automatically. It was withdrawn from npm within the
-72-hour unpublish window and re-released as 0.5.0, where `^0.4.1` correctly
-resolves away from it. The rule it broke is the one in the table above: threshold
-and preset changes are behaviour changes, and behaviour changes are never
-patches.
+| Docs, internals, performance, fixing a detector that returned a wrong score | patch |
+
+A threshold change does not break your build. It changes which of your production
+responses get discarded and retried, which is a larger event than a signature
+change and invisible until your traffic hits it. A number in `presets.chat` is
+part of the contract in the same way a function name is.
+
+**Not covered:** the exact scores a detector returns (only their direction and
+the thresholds acting on them), the fixture corpus, `message` strings in
+`Reason`, or the human-readable `calibrate` report. `--json` output *is* covered.
+
+**Peer ranges** narrow only in a major, and are verified rather than assumed —
+`npm run check:peers` installs the packed tarball against each end of each
+declared range, then typechecks and runs the adapter.
+
+**Why this is written down:** 0.4.2 shipped a peer narrowing, a new subpath, and
+a behaviour change under a **patch** number, which every default version range
+upgrades into automatically. It was unpublished within the 72-hour window and
+re-released as 0.5.0. The rule it broke is the one in the table above.
 
 ## Limitations
 
 - Not a hallucination detector. It measures *shape*, never truth.
-- Tool *arguments* are not checked, only the prose beside them. A model that loops inside a JSON argument string is invisible here — your provider validates those against the schema you gave it.
-- `openai`'s `responses.stream()` helper is not wrapped. See the note above; `create({ stream: true })` is.
-- `REPETITION` does not work on Chinese, Japanese or Thai. See above — this is a known, measured gap, not an oversight.
-- Language detection is a function-word heuristic covering `id`/`en`/`es`. Opt-in, and unreliable under 25 words. `expectScript` is the stronger check where the languages differ in alphabet, and says nothing where they do not.
-- `SCRIPT_MISMATCH` does not run mid-stream. A mid-stream check reads a trailing window, and the language of a window is not the language of the response — an English answer quoting a Chinese passage measures 0.114 whole and 0.500 over its last 400 characters.
-- Truncation from a missing full stop is weak evidence, scored 0.55 and left below the default thresholds on purpose. Lower `maxTruncation` to ~0.5 to catch it, and expect false positives.
-- A JSON array of repeated identical records reads as a loop under the default scope, and fails from three records up. Set `redundancyScope: 'jsonValues'` — see **Structured output**.
-- Thresholds calibrated on the bundled corpus. Yours will differ — and the word and character thresholds need calibrating **separately**, because they are separate distributions.
+- `REPETITION` does not work on Chinese, Japanese or Thai — a known, measured gap, not an oversight.
+- `LANG_MISMATCH` is a function-word heuristic covering `id`/`en`/`es`, and is unreliable under 25 words. `expectScript` is the stronger check wherever the alphabets differ.
+- `PROMPT_ECHO` cannot tell a degenerate echo from a rewrite or translation — the difference is in what you asked for, not in the text.
+- `SCRIPT_MISMATCH` and `PROMPT_ECHO` do not run mid-stream: both measure a property of the whole response, and a mid-stream check reads a trailing window.
+- Tool *arguments* are measured only with `checkToolArguments: true`, non-streaming responses only.
+- `openai`'s `responses.stream()` helper is not wrapped; `create({ stream: true })` is.
+- Truncation from a missing full stop is weak evidence, scored 0.55 and deliberately left below the defaults. Lower `maxTruncation` to ~0.5 to catch it, and expect false positives.
+- A JSON array of repeated identical records reads as a loop and fails from three records up. Set `redundancyScope: 'jsonValues'`.
+- Thresholds are calibrated on the bundled corpus. Yours will differ — and the word and character thresholds need calibrating **separately**.
 
 ## License
 

package/dist/{adapter-options-CQNPNjES.d.cts → adapter-options-h2gysBrj.d.cts}

@@ -1,4 +1,4 @@
-import { V as Verdict } from './stream-NO-TTGYs.cjs';
+import { V as Verdict } from './stream-BSCIXfIH.cjs';
 
 /**
  * The option surface every provider adapter shares.
@@ -62,6 +62,26 @@ interface AdapterGuardOptions {
     onVerdict?: (verdict: Verdict, context: {
         streaming: boolean;
     }) => void;
+    /**
+     * Also measure the arguments the model passed to a tool. Default `false`.
+     *
+     * A tool-calling turn is judged by its preamble, because the text beside a
+     * tool call is not the answer -- and that leaves the answer itself
+     * unmeasured. Your provider validates arguments against the schema you gave
+     * it, which covers types and not content: `{ "query": "site reliability site
+     * reliability site reliability ..." }` is a schema-valid string, and it is
+     * still a garbage query.
+     *
+     * Switching this on measures each string value of each call's arguments for
+     * redundancy, and folds the result into the same verdict the preamble
+     * produces. Reason codes are unchanged, so existing handling works; the
+     * `message` says the loop was found in an argument.
+     *
+     * **Non-streaming responses only.** Arguments arrive as JSON fragments that
+     * do not parse until the call is complete, so there is nothing meaningful to
+     * measure mid-stream.
+     */
+    checkToolArguments?: boolean;
 }
 
 export type { AdapterGuardOptions as A, DegenerateAction as D };

package/dist/{adapter-options-BUOzVp3T.d.ts → adapter-options-v9jM76u7.d.ts}

@@ -1,4 +1,4 @@
-import { V as Verdict } from './stream-NO-TTGYs.js';
+import { V as Verdict } from './stream-BSCIXfIH.js';
 
 /**
  * The option surface every provider adapter shares.
@@ -62,6 +62,26 @@ interface AdapterGuardOptions {
     onVerdict?: (verdict: Verdict, context: {
         streaming: boolean;
     }) => void;
+    /**
+     * Also measure the arguments the model passed to a tool. Default `false`.
+     *
+     * A tool-calling turn is judged by its preamble, because the text beside a
+     * tool call is not the answer -- and that leaves the answer itself
+     * unmeasured. Your provider validates arguments against the schema you gave
+     * it, which covers types and not content: `{ "query": "site reliability site
+     * reliability site reliability ..." }` is a schema-valid string, and it is
+     * still a garbage query.
+     *
+     * Switching this on measures each string value of each call's arguments for
+     * redundancy, and folds the result into the same verdict the preamble
+     * produces. Reason codes are unchanged, so existing handling works; the
+     * `message` says the loop was found in an argument.
+     *
+     * **Non-streaming responses only.** Arguments arrive as JSON fragments that
+     * do not parse until the call is complete, so there is nothing meaningful to
+     * measure mid-stream.
+     */
+    checkToolArguments?: boolean;
 }
 
 export type { AdapterGuardOptions as A, DegenerateAction as D };

package/dist/ai-sdk.cjs

@@ -282,6 +282,37 @@ function judgeableLetters(text, options) {
   return found.filter((ch) => !SCRIPT_NEUTRAL.test(ch));
 }
 
+// src/detectors/prompt-echo.ts
+function promptEchoDetail(text, prompt, options = {}) {
+  const {
+    n = 5,
+    charN = 12,
+    minTokens = 40,
+    nonSpacedCutoff = 0.5,
+    maxSample = 8e3
+  } = options;
+  const output = text.slice(0, maxSample);
+  const mode = options.mode ?? tokenModeOf(output, nonSpacedCutoff);
+  if (typeof prompt !== "string" || prompt.length === 0) return { score: 0, mode };
+  const tokenize = mode === "char" ? chars : words;
+  const run = mode === "char" ? charN : n;
+  const out = tokenize(output);
+  const src = tokenize(prompt.slice(0, maxSample));
+  if (out.length < minTokens) return { score: 0, mode };
+  if (out.length < run || src.length < run) return { score: 0, mode };
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i + run <= src.length; i++) {
+    seen.add(src.slice(i, i + run).join(" "));
+  }
+  let matched = 0;
+  let total = 0;
+  for (let i = 0; i + run <= out.length; i++) {
+    if (seen.has(out.slice(i, i + run).join(" "))) matched++;
+    total++;
+  }
+  return { score: total === 0 ? 0 : clamp01(matched / total), mode };
+}
+
 // src/internal/json-scope.ts
 function stringValues(value, out = []) {
   if (typeof value === "string") out.push(value);
@@ -316,6 +347,7 @@ var DEFAULTS = {
   allowJsonFence: true,
   maxLangMismatch: 0.6,
   maxScriptMismatch: 0.5,
+  maxPromptEcho: 0.6,
   ngram: 3,
   redundancyScope: "document"
 };
@@ -423,6 +455,18 @@ function checkOutput(text, options = {}) {
       `${Math.round(s * 100)}% of letters are not in ${wanted.join(" or ")}.`
     );
   }
+  if (opts.prompt) {
+    const { score, mode } = promptEchoDetail(text, opts.prompt, {
+      nonSpacedCutoff: opts.nonSpacedCutoff
+    });
+    add(
+      "PROMPT_ECHO",
+      score,
+      opts.maxPromptEcho,
+      `${Math.round(score * 100)}% of the response is copied from the prompt.`,
+      mode
+    );
+  }
   if (opts.expectLang) {
     const s = languageMismatchScore(text, opts.expectLang);
     add(
@@ -482,6 +526,19 @@ var DEFERRED_TO_END = {
    * and this is one line for the callers who need it.
    */
   expectScript: null,
+  /*
+   * PROMPT_ECHO is deferred for the same reason as SCRIPT_MISMATCH, and it
+   * bites harder. The score is the share of the *whole* output copied from the
+   * prompt, so a trailing window measures the share of that window -- and a
+   * response that opens by echoing the system prompt and then answers properly
+   * reads as 1.000 over its first window and 0.000 over its last. Neither
+   * number describes the response.
+   *
+   * Dilution is the point of the measure: an output that is 10% leaked prompt
+   * and 90% answer should score 0.1, and only the finished response knows what
+   * that ratio is.
+   */
+  prompt: null,
   /*
    * LOW_ENTROPY is deferred for a second reason: cost. The LZ77 pass is
    * 0.4ms at 500 characters and 11ms at its 4000-character sample cap, which
@@ -557,6 +614,60 @@ function checkPreamble(text, options) {
   return checkOutput(text, { ...options, ...TOOL_CALL_PREAMBLE });
 }
 
+// src/internal/tool-arguments.ts
+var ARGUMENT_SCOPE = {
+  minLength: 0,
+  maxTruncation: null,
+  maxCompressibility: null,
+  expectJson: false,
+  expectLang: null,
+  expectScript: null,
+  finishReason: void 0,
+  redundancyScope: "jsonValues"
+};
+function argumentsToText(args) {
+  if (typeof args === "string") return args;
+  if (args === null || args === void 0) return "";
+  try {
+    return JSON.stringify(args) ?? "";
+  } catch {
+    return "";
+  }
+}
+function checkArguments(calls, options) {
+  const texts = calls.map(argumentsToText).filter(hasMeasurableContent);
+  if (texts.length === 0) return null;
+  let worst = null;
+  for (const text of texts) {
+    const verdict = checkOutput(text, { ...options, ...ARGUMENT_SCOPE });
+    if (!worst || worst.ok && !verdict.ok) worst = verdict;
+    else if (!verdict.ok && !worst.ok && maxScore(verdict) > maxScore(worst)) worst = verdict;
+  }
+  return worst;
+}
+var maxScore = (verdict) => verdict.reasons.reduce((hi, reason) => Math.max(hi, reason.score), 0);
+var hasMeasurableContent = (text) => redundancySpans(text, "jsonValues").some((span) => span.trim().length > 0);
+function mergeVerdicts(preamble, args) {
+  if (!args) return preamble;
+  const labelled = args.reasons.map((reason) => ({
+    ...reason,
+    message: `In a tool call argument: ${reason.message}`
+  }));
+  if (!preamble) return { ...args, reasons: labelled };
+  const scores = { ...preamble.scores };
+  for (const [code, score] of Object.entries(args.scores)) {
+    const key = code;
+    if (scores[key] === void 0 || score > scores[key]) scores[key] = score;
+  }
+  const reasons = [...preamble.reasons, ...labelled];
+  return {
+    ...preamble,
+    ok: reasons.length === 0,
+    reasons,
+    scores
+  };
+}
+
 // src/ai-sdk.ts
 var isToolPart = (part) => part.type.startsWith("tool-");
 function finishReasonOf(value) {
@@ -565,7 +676,7 @@ function finishReasonOf(value) {
   return void 0;
 }
 function outputGuard(options = {}) {
-  const { onDegenerate = "throw", onVerdict, ...guardOptions } = options;
+  const { onDegenerate = "throw", onVerdict, checkToolArguments = false, ...guardOptions } = options;
   const act = (verdict, streaming) => {
     onVerdict?.(verdict, { streaming });
     if (verdict.ok || onDegenerate === "ignore") return;
@@ -599,7 +710,12 @@ function outputGuard(options = {}) {
       const content = result.content ?? [];
       const text = content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("");
       if (content.some(isToolPart)) {
-        const verdict = checkPreamble(text, guardOptions);
+        const preamble = checkPreamble(text, guardOptions);
+        const args = checkToolArguments ? checkArguments(
+          content.filter((part) => part.type === "tool-call").map((part) => part.input ?? part.args),
+          guardOptions
+        ) : null;
+        const verdict = mergeVerdicts(preamble, args);
         if (verdict) act(verdict, false);
         return result;
       }