llm-output-guard 1.4.1 → 1.6.0

package/README.md

@@ -7,12 +7,26 @@
 
 **Detect LLM responses that failed while returning `200 OK`.**
 
+<!--
+  Two rows on purpose: what you are installing, then whether it is looked after.
+
+  Every GitHub-backed badge carries an explicit cacheSeconds. Shields defaults
+  these to max-age=120, which has GitHub's camo proxy refetch 720 times a day
+  and gives 720 daily chances to catch the upstream API rate limited and cache
+  the error for the whole TTL. That is not hypothetical: it happened to the
+  downloads badge, which is why it carries one too.
+-->
 [![npm](https://img.shields.io/npm/v/llm-output-guard?color=0b7285)](https://www.npmjs.com/package/llm-output-guard)
 [![downloads](https://img.shields.io/npm/dm/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://www.npmjs.com/package/llm-output-guard)
 [![minzipped](https://img.shields.io/bundlejs/size/llm-output-guard?color=0b7285&label=min%2Bgzip)](https://bundlejs.com/?q=llm-output-guard)
 [![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](https://github.com/edwinsatya/llm-output-guard/blob/main/package.json)
+[![types](https://img.shields.io/npm/types/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://www.npmjs.com/package/llm-output-guard)
+[![node](https://img.shields.io/node/v/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://nodejs.org)
+
 [![CI](https://github.com/edwinsatya/llm-output-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/edwinsatya/llm-output-guard/actions/workflows/ci.yml)
-[![license](https://img.shields.io/npm/l/llm-output-guard?color=0b7285)](./LICENSE)
+[![last commit](https://img.shields.io/github/last-commit/edwinsatya/llm-output-guard?color=0b7285&cacheSeconds=21600)](https://github.com/edwinsatya/llm-output-guard/commits/main)
+[![commit activity](https://img.shields.io/github/commit-activity/m/edwinsatya/llm-output-guard?color=0b7285&cacheSeconds=86400)](https://github.com/edwinsatya/llm-output-guard/graphs/commit-activity)
+[![license](https://img.shields.io/npm/l/llm-output-guard?color=0b7285&cacheSeconds=86400)](./LICENSE)
 
 Your retry layer watches for `429`, `5xx` and timeouts. It cannot see a model that
 looped until `max_tokens`, returned `{}`, stopped mid-sentence, or answered in the
@@ -56,12 +70,16 @@ every detector, running on your own pasted output. No API key, no request.
 | `LOW_ENTROPY` | Character-level collapse, token artifacts | Compression ratio |
 | `TRUNCATED` | Cut off mid-thought | `finish_reason`, unbalanced fences |
 | `INVALID_JSON` | Prose around the payload, wrong types | Parse + key + schema contract |
-| `SCRIPT_MISMATCH` | Answered in the wrong alphabet | Share of letters outside the expected scripts (opt-in) |
-| `LANG_MISMATCH` | Answered in the wrong language, same alphabet | Function-word profile (opt-in) |
+| `SCRIPT_MISMATCH` | Answered in the wrong alphabet | Share of letters outside expected scripts · opt-in |
+| `LANG_MISMATCH` | Wrong language, same alphabet | Function-word profile · opt-in |
+| `PROMPT_ECHO` | Returned your prompt instead of an answer | Share of output copied from the prompt · opt-in |
 
 Every detector runs even after one fails, so a verdict shows the whole picture
 rather than whichever check happened to be ordered first. Each returns **0–1, not
-a boolean** — you pick the line. Full reference: **[docs/detectors.md](docs/detectors.md)**.
+a boolean** — you pick the line.
+
+**Full reference, with the measurements behind every default:
+[docs/detectors.md](docs/detectors.md)**
 
 ## Guard your provider in one wrap
 
@@ -77,8 +95,12 @@ Adapters for the **OpenAI SDK** (both `chat.completions` and `responses`),
 protocol: Groq, Together, OpenRouter, Fireworks, vLLM, Ollama.
 
 On a stream this **cancels the HTTP request** the moment a loop is detectable, so
-you stop paying for the rest of it. See **[docs/adapters.md](docs/adapters.md)**
-and **[docs/streaming.md](docs/streaming.md)**.
+you stop paying for the rest of it. Two switches worth knowing:
+`checkToolArguments: true` measures the arguments a model passes to a tool, and
+`checkPromptEcho: true` reads the prompt out of each request so a model that
+replays it instead of answering is caught.
+
+**[docs/adapters.md](docs/adapters.md)** · **[docs/streaming.md](docs/streaming.md)**
 
 ## The hard part is not catching loops
 
@@ -86,89 +108,60 @@ A miss is annoying. **A false positive is worse** — a healthy response gets
 discarded and retried against a slower provider for nothing.
 
 So the corpus carries deliberate traps: markdown tables, repeated-prefix lists,
-code blocks, rhetorical refrains, a Chinese poem refrain. All repetitive, all
-fine, all flagged by a naive detector. Paste one into the
+code blocks, rhetorical refrains, a Chinese poem refrain, a Chinese answer
+wrapped around a TypeScript block. All of them look degenerate to a naive
+detector, and all of them are fine. Paste one into the
 [playground](https://edwinsatya.github.io/llm-output-guard/) and watch it pass.
 
 ---
 
-### Structured output
-
-```ts
-const verdict = checkOutput(raw, {
-  ...presets.strictJson,
-  requiredKeys: ['score', 'notes', 'followUp'],
-});
-
-if (verdict.ok) use(verdict.json); // already parsed, fence stripped
-```
+## Common setups
 
-`requiredKeys` only asks whether a name is present. A model returning
-`{ "score": "very good" }` where you wanted a number satisfies it and still
-breaks everything downstream that does arithmetic. Pass a **schema** to check
-the shape rather than the spelling:
+**Structured output** — parse, check keys, and validate against a schema you
+already have:
 
 ```ts
 import { z } from 'zod';
 
-const Review = z.object({
-  score: z.number().min(0).max(10),
-  notes: z.string(),
-  followUp: z.array(z.string()),
+const verdict = checkOutput(raw, {
+  ...presets.strictJson,
+  schema: z.object({ score: z.number(), notes: z.string() }),
 });
 
-const verdict = checkOutput(raw, { ...presets.strictJson, schema: Review });
-
 if (verdict.ok) use(verdict.json); // parsed, validated, defaults applied
 ```
 
-Any [Standard Schema](https://standardschema.dev) validator works — **Zod 4,
-Valibot, ArkType**, or your own. The spec is types-only, so this costs an
-interface and **no dependency**: your validator is one you already have, and
-`llm-output-guard` still installs with nothing behind it.
-
-On success `verdict.json` is the schema's *output*, so defaults, coercions and
-transforms are applied and the value matches the type you declared. On failure
-you get `INVALID_JSON` with the failing path in the message —
-`score: Expected number, received string`. It is the same reason code as a
-missing key or an unparseable payload because it wants the same handling: retry,
-or fall through to another provider.
-
-The two compose, and keys are checked first, so a missing key is still reported
-as a missing key rather than as whatever the schema calls it.
-
-> **The schema must validate synchronously.** `checkOutput` is synchronous by
-> design — that is what makes it safe on a hot path — so a schema carrying an
-> async refinement throws a `TypeError` telling you so, rather than silently
-> passing. Everything Zod, Valibot and ArkType produce otherwise is synchronous.
-> This is the one thing in the package that throws about your configuration; it
-> still never throws about a response.
+Any [Standard Schema](https://standardschema.dev) validator works — Zod 4,
+Valibot, ArkType — and the spec is types-only, so this still costs **no
+dependency**. Details, and the one case that throws:
+[docs/detectors.md](docs/detectors.md#structured-output)
 
-See **[docs/detectors.md](docs/detectors.md)** for arrays of repeated records —
-a JSON array of identical rows reads as a loop under the default scope, and
-`redundancyScope: 'jsonValues'` is the fix.
-
-### Answering in the wrong language
+**Answered in the wrong language** — a model that ignores "answer in English"
+returns fluent Chinese, not broken English:
 
 ```ts
 checkOutput(raw, { ...presets.chat, expectScript: 'latin' });
 ```
 
-A model that ignores "answer in English" does not produce broken English, it
-produces fluent Chinese. That is a `200 OK` your retry layer cannot see, and it
-is detectable by counting characters — no word list, no model, decisive from
-about a dozen letters. A response answered entirely in the wrong script scores
-**1.000**; a healthy response measured against its own script scores
-**0.000–0.028**.
+Detectable by counting characters — no word list, decisive from about a dozen
+letters. A wrong-script answer scores **1.000**; a healthy one measured against
+its own script scores **0.000–0.028**. Pass every script the answer may
+legitimately contain (`['han', 'latin']` for Chinese). Code fences and URLs are
+excluded, so a TypeScript block never counts as answering in English.
+[More →](docs/detectors.md#answering-in-the-wrong-language)
+
+**Returned your prompt instead of an answer** — invisible to every other
+detector here, because such a response is fluent, well-formed and the right
+length:
 
-Pass every script the answer may legitimately contain — `['han', 'latin']` for
-Chinese, `['han', 'kana', 'latin']` for Japanese. `'latin'` belongs in nearly all
-of them, because a Chinese answer about React still contains `useEffect`. Code
-fences, inline code and URLs are removed before measuring, so a TypeScript block
-never counts as answering in English.
+```ts
+checkOutput(raw, { ...presets.chat, prompt });
+// or, from an adapter, which reads the prompt out of the request itself:
+withOutputGuard(new OpenAI(), { ...presets.chat, checkPromptEcho: true });
+```
 
-Same script means no signal: Spanish against English scores 0. That is what
-`expectLang` is for, and the two compose under separate codes.
+Not for rewrite, translate or summarise endpoints, where copying the input is
+the job. [More →](docs/detectors.md#returning-the-prompt-instead-of-an-answer)
 
 ## The verdict
 
@@ -185,71 +178,63 @@ Same script means no signal: Spanish against English scores 0. That is what
 }
 ```
 
-Every detector runs even after one fails, so `reasons` shows the whole picture instead of whichever check happened to be ordered first. `scores` includes passing detectors too — send them to your metrics and you will know your real degeneration rate within a day.
+`reasons` carries every failing signal, not just the first. `scores` includes the
+passing detectors too — send them to your metrics and you will know your real
+degeneration rate within a day.
 
-`modes` says which tokenizer produced a score, for the detectors that have more
-than one. **Log it next to `scores`.** `TAIL_LOOP` measures words on spaced
-scripts and characters on Chinese, Japanese and Thai; those are two
-distributions with different base rates, and aggregating them into one histogram
-gives you a number that describes neither.
+`modes` says which tokenizer produced a score. **Log it next to `scores`:**
+`TAIL_LOOP` measures words on spaced scripts and characters on Chinese, Japanese
+and Thai, and pooling two distributions into one histogram gives you a number
+that describes neither.
 
 ## Presets
 
 `chat` · `strictJson` · `longForm` · `lenient`
 
-They are starting points calibrated against the fixture corpus in this repo — not universal truths. Log your scores for a week, then set your own thresholds.
+Starting points calibrated against this repo's fixture corpus — not universal
+truths.
 
----
-
-## Calibrating against your own traffic
+## Calibrate against your own traffic
 
-The shipped presets are tuned on this repo's fixture corpus, which is **not your
-traffic**. Log your scores for a week, then derive thresholds you can defend:
+The shipped presets are tuned on a corpus that is **not your traffic**. Score the
+responses you already have, then derive thresholds you can defend:
 
 ```bash
-npx llm-output-guard calibrate scores.jsonl --fpr 0.001
+npx llm-output-guard check logs/*.txt --json | npx llm-output-guard calibrate --fpr 0.001
 ```
 
+`check` also works as a CI assertion — it exits 1 when anything is degenerate,
+2 when the input cannot be read.
+
 The report tells you when your sample is too small to support the rate you asked
 for, and distinguishes real separation in your data from a false-positive budget —
-because only one of those is evidence. Full guide:
-**[docs/calibration.md](docs/calibration.md)**.
-
-## Script coverage
-
-Korean, Cyrillic, Greek, Arabic and Devanagari separate words and are handled like
-English. **Chinese, Japanese and Thai do not**, so `TAIL_LOOP` switches to
-character mode and reads its own threshold. `REPETITION` is blind on those scripts —
-a known, measured gap. `SCRIPT_MISMATCH` covers all ten scripts and is the one
-detector these are *not* the weak case for. Numbers behind both in
-**[docs/script-coverage.md](docs/script-coverage.md)**.
+because only one of those is evidence.
+**[docs/calibration.md](docs/calibration.md)**
 
 ## Design notes
 
-- **Zero runtime dependencies**, enforced in CI. Node ≥ 18, works on edge, browser, Deno, Bun.
-- **Hand-rolled LZ77** rather than `node:zlib`, so the package stays runtime-agnostic. It is not a real compressor; it only needs to move monotonically with redundancy.
+- **Zero runtime dependencies**, enforced in CI. Node ≥ 18; works on edge, browser, Deno, Bun.
 - **Pure and synchronous.** No network, no clock, no randomness — safe on a hot path, trivial to test.
 - **Scores, not booleans.** Detectors report 0–1 and leave the threshold decision to you.
 - **Abstains rather than guesses.** Samples too short to judge score 0.
+- **Hand-rolled LZ77** rather than `node:zlib`, so the package stays runtime-agnostic.
+- **Sub-millisecond**, 0.383 ms at 500 B and 1.014 ms at 32 KB, with one detector accounting for most of it. `npm run bench` reproduces it — **[docs/performance.md](docs/performance.md)**
+- **Chinese, Japanese and Thai** are handled where they differ: `TAIL_LOOP` switches to character mode, `REPETITION` is blind and says so — **[docs/script-coverage.md](docs/script-coverage.md)**
 
 ## Stability
 
-What semver means for this package specifically. These rules bind from **1.0.0**
-onward; under `0.x` they described an intent, and the surface was frozen — export
-by export — in the 1.0.0 release.
-
-**The public API is:** everything exported from `llm-output-guard`, plus
-`outputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./ai-sdk`, and
-`withOutputGuard` / `OutputGuardOptions` / `DegenerateAction` from each of
-`./openai` and `./anthropic`. Each subpath is its own contract; the adapters
-share internal base types today and are free to diverge, so an option added to
-one is not a promise about the others. Anything not exported from those four
-entry points is internal, has no stability guarantee, and may move in any release
-— `internal/proxy-guard.ts` and `internal/tool-calls.ts` included, however much
-behaviour they carry. The list is asserted in `test/surface.test.ts`, so an
-export cannot join it by accident.
-
-**Threshold and preset values are behaviour, not implementation.** This is the
+What semver means here specifically. These rules bind from **1.0.0** onward, and
+the public surface was frozen export by export in that release.
+
+**The public API is** everything exported from `llm-output-guard`, plus
+`outputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./ai-sdk` and
+`withOutputGuard` / `OutputGuardOptions` / `DegenerateAction` from `./openai` and
+`./anthropic`. Each subpath is its own contract, so an option added to one is not
+a promise about the others. Anything else is internal and may move in any
+release. The list is asserted in `test/surface.test.ts`, so an export cannot join
+it by accident.
+
+**Threshold and preset values are behaviour, not implementation.** That is the
 interesting case, so it gets a rule of its own:
 
 | Change | Release type |
@@ -259,42 +244,39 @@ interesting case, so it gets a rule of its own:
 | Adding a new *option*, defaulted so nothing changes | minor |
 | Adding a new detector that is opt-in | minor |
 | Making an existing detector strictly more accurate on its own axis | minor |
-| Docs, internals, performance, fixing a detector that was returning a wrong score | patch |
-
-The reasoning: a threshold change does not break your build, it changes which of
-your production responses get discarded and retried. That is a larger event than
-a signature change, and it is invisible until your traffic hits it. A number in
-`presets.chat` is part of the contract in the same way a function name is.
-
-**Semver does not cover:** the exact scores a detector returns (only their
-direction and the thresholds that act on them), the contents of the fixture
-corpus, `message` strings in `Reason`, or the output format of the `calibrate`
-CLI's human-readable report. `--json` output *is* covered.
-
-**Peer ranges** are narrowed only in a major. They are verified rather than
-assumed — `npm run check:peers` installs the packed tarball against each end of
-each declared range and both typechecks and runs the adapter.
-
-**Why this is written down.** Version 0.4.2 shipped the `ai` peer narrowing, the
-new `./openai` subpath, and character-mode `TAIL_LOOP` — one breaking change, one
-feature, and one behaviour change — under a **patch** number, which every default
-version range upgrades into automatically. It was withdrawn from npm within the
-72-hour unpublish window and re-released as 0.5.0, where `^0.4.1` correctly
-resolves away from it. The rule it broke is the one in the table above: threshold
-and preset changes are behaviour changes, and behaviour changes are never
-patches.
+| Docs, internals, performance, fixing a detector that returned a wrong score | patch |
+
+A threshold change does not break your build. It changes which of your production
+responses get discarded and retried, which is a larger event than a signature
+change and invisible until your traffic hits it. A number in `presets.chat` is
+part of the contract in the same way a function name is.
+
+**Not covered:** the exact scores a detector returns (only their direction and
+the thresholds acting on them), the fixture corpus, `message` strings in
+`Reason`, or the human-readable `calibrate` report. `--json` output *is* covered.
+
+**Peer ranges** narrow only in a major, and are verified rather than assumed —
+`npm run check:peers` installs the packed tarball against each end of each
+declared range, then typechecks and runs the adapter.
+
+**Why this is written down:** 0.4.2 shipped a peer narrowing, a new subpath, and
+a behaviour change under a **patch** number, which every default version range
+upgrades into automatically. It was unpublished within the 72-hour window and
+re-released as 0.5.0. The rule it broke is the one in the table above.
 
 ## Limitations
 
 - Not a hallucination detector. It measures *shape*, never truth.
-- Tool *arguments* are not checked, only the prose beside them. A model that loops inside a JSON argument string is invisible here — your provider validates those against the schema you gave it.
-- `openai`'s `responses.stream()` helper is not wrapped. See the note above; `create({ stream: true })` is.
-- `REPETITION` does not work on Chinese, Japanese or Thai. See above — this is a known, measured gap, not an oversight.
-- Language detection is a function-word heuristic covering `id`/`en`/`es`. Opt-in, and unreliable under 25 words. `expectScript` is the stronger check where the languages differ in alphabet, and says nothing where they do not.
-- `SCRIPT_MISMATCH` does not run mid-stream. A mid-stream check reads a trailing window, and the language of a window is not the language of the response — an English answer quoting a Chinese passage measures 0.114 whole and 0.500 over its last 400 characters.
-- Truncation from a missing full stop is weak evidence, scored 0.55 and left below the default thresholds on purpose. Lower `maxTruncation` to ~0.5 to catch it, and expect false positives.
-- A JSON array of repeated identical records reads as a loop under the default scope, and fails from three records up. Set `redundancyScope: 'jsonValues'` — see **Structured output**.
-- Thresholds calibrated on the bundled corpus. Yours will differ — and the word and character thresholds need calibrating **separately**, because they are separate distributions.
+- `REPETITION` does not work on Chinese, Japanese or Thai — a known, measured gap, not an oversight.
+- `LANG_MISMATCH` is a function-word heuristic covering `id`/`en`/`es`/`pt`/`it`/`fr`/`de`/`nl`, and is unreliable under 25 words. `expectScript` is the stronger check wherever the alphabets differ.
+- `expectLang: 'es'` does not reliably catch Portuguese, Italian or French: its profile is built from function words all four share. Measured, and unfixable without a threshold change — see **[docs/detectors.md](docs/detectors.md#answering-in-the-wrong-language)**.
+- `PROMPT_ECHO` cannot tell a degenerate echo from a rewrite or translation — the difference is in what you asked for, not in the text.
+- `SCRIPT_MISMATCH` and `PROMPT_ECHO` do not run mid-stream by default: both measure a property of the whole response, and a mid-stream check reads a trailing window. `earlyDocumentChecks: true` opts in, with a measured false-positive risk — see **[docs/streaming.md](docs/streaming.md)**.
+- Tool *arguments* are measured only with `checkToolArguments: true`, non-streaming responses only.
+- `openai`'s `responses.stream()` helper is not wrapped; `create({ stream: true })` is.
+- Truncation from a missing full stop is weak evidence, scored 0.55 and deliberately left below the defaults. Lower `maxTruncation` to ~0.5 to catch it, and expect false positives.
+- A JSON array of repeated identical records reads as a loop and fails from three records up. Set `redundancyScope: 'jsonValues'`.
+- Thresholds are calibrated on the bundled corpus. Yours will differ — and the word and character thresholds need calibrating **separately**.
 
 ## License
 

package/dist/{adapter-options-CQNPNjES.d.cts → adapter-options-B-fgYd--.d.cts}

@@ -1,4 +1,4 @@
-import { V as Verdict } from './stream-NO-TTGYs.cjs';
+import { V as Verdict } from './stream-BYy6vuGy.cjs';
 
 /**
  * The option surface every provider adapter shares.
@@ -62,6 +62,40 @@ interface AdapterGuardOptions {
     onVerdict?: (verdict: Verdict, context: {
         streaming: boolean;
     }) => void;
+    /**
+     * Also measure the arguments the model passed to a tool. Default `false`.
+     *
+     * A tool-calling turn is judged by its preamble, because the text beside a
+     * tool call is not the answer -- and that leaves the answer itself
+     * unmeasured. Your provider validates arguments against the schema you gave
+     * it, which covers types and not content: `{ "query": "site reliability site
+     * reliability site reliability ..." }` is a schema-valid string, and it is
+     * still a garbage query.
+     *
+     * Switching this on measures each string value of each call's arguments for
+     * redundancy, and folds the result into the same verdict the preamble
+     * produces. Reason codes are unchanged, so existing handling works; the
+     * `message` says the loop was found in an argument.
+     *
+     * **Non-streaming responses only.** Arguments arrive as JSON fragments that
+     * do not parse until the call is complete, so there is nothing meaningful to
+     * measure mid-stream.
+     */
+    checkToolArguments?: boolean;
+    /**
+     * Check the response against the prompt that produced it, so a model that
+     * replays your prompt instead of answering is caught. Default `false`.
+     *
+     * `PROMPT_ECHO` needs the prompt, and a guard is configured once when you
+     * wrap the client while the prompt changes on every call -- so this is a
+     * switch rather than a value. Turn it on and the adapter reads the prompt out
+     * of each request it is already forwarding.
+     *
+     * **Do not enable this on a rewrite, translate, summarise or extract
+     * endpoint.** Copying from the input is the job on those, so a correct answer
+     * scores high and the detector measures the task rather than a failure.
+     */
+    checkPromptEcho?: boolean;
 }
 
 export type { AdapterGuardOptions as A, DegenerateAction as D };

package/dist/{adapter-options-BUOzVp3T.d.ts → adapter-options-DNkMNS92.d.ts}

@@ -1,4 +1,4 @@
-import { V as Verdict } from './stream-NO-TTGYs.js';
+import { V as Verdict } from './stream-BYy6vuGy.js';
 
 /**
  * The option surface every provider adapter shares.
@@ -62,6 +62,40 @@ interface AdapterGuardOptions {
     onVerdict?: (verdict: Verdict, context: {
         streaming: boolean;
     }) => void;
+    /**
+     * Also measure the arguments the model passed to a tool. Default `false`.
+     *
+     * A tool-calling turn is judged by its preamble, because the text beside a
+     * tool call is not the answer -- and that leaves the answer itself
+     * unmeasured. Your provider validates arguments against the schema you gave
+     * it, which covers types and not content: `{ "query": "site reliability site
+     * reliability site reliability ..." }` is a schema-valid string, and it is
+     * still a garbage query.
+     *
+     * Switching this on measures each string value of each call's arguments for
+     * redundancy, and folds the result into the same verdict the preamble
+     * produces. Reason codes are unchanged, so existing handling works; the
+     * `message` says the loop was found in an argument.
+     *
+     * **Non-streaming responses only.** Arguments arrive as JSON fragments that
+     * do not parse until the call is complete, so there is nothing meaningful to
+     * measure mid-stream.
+     */
+    checkToolArguments?: boolean;
+    /**
+     * Check the response against the prompt that produced it, so a model that
+     * replays your prompt instead of answering is caught. Default `false`.
+     *
+     * `PROMPT_ECHO` needs the prompt, and a guard is configured once when you
+     * wrap the client while the prompt changes on every call -- so this is a
+     * switch rather than a value. Turn it on and the adapter reads the prompt out
+     * of each request it is already forwarding.
+     *
+     * **Do not enable this on a rewrite, translate, summarise or extract
+     * endpoint.** Copying from the input is the job on those, so a correct answer
+     * scores high and the detector measures the task rather than a failure.
+     */
+    checkPromptEcho?: boolean;
 }
 
 export type { AdapterGuardOptions as A, DegenerateAction as D };