Module harmony 

GPT-5 Harmony protocol leak detection and replay escaping.

Harmony-dialect models wrap tool calls in routing envelopes: <|start|>assistant<|channel|>commentary to=functions.NAME<|message|>…<|call|>

Constrained decoding typically masks those control-token IDs inside tool arguments, so probability mass shifts onto un-bracketed shadows (analysis to=functions.edit code …). JSON parsers accept the junk and write tools (edit / apply_patch) would commit it. Detection requires the to=functions. marker and a co-signal; a bare mention is not enough. Fenced / quoted examples are ignored.

Structs

Hit

A confirmed Harmony-shadow leak.

Enums

CoSignal

Constants

MARKER

to=functions. — the routing marker Harmony models emit as a shadow.

Functions

escape_replay

Escape reserved <|…|> spellings so untrusted tool results cannot inject routing headers on the next Harmony-dialect request.

last_hunk_start

Byte offset of the last @@ hunk header in a unified diff.

leak_is_after_last_hunk

True when a leak at at sits on its own line after the last @@ hunk (optional truncate-and-apply). Mid-hunk leaks are not recoverable.

scan_json

Walk JSON string leaves for a leak.

scan_text

Scan a finalized visible / thinking / argument string.

scan_text_with_boundary

trusted_end is a byte offset where a structurally valid parse ended (completed JSON value / last valid patch hunk). When omitted, that co-signal stays inert so legitimate diffs that discuss the protocol do not false-abort.

truncate_at_line

Drop the contaminated line and everything after it.