Note

High Risk
Changes core interception-server request/response paths and streaming behavior for all harnesses; incorrect handling could block legitimate tool use or alter provider traffic silently.

Overview
Introduces task-authored interception at the single model-traffic choke point (the interception server), via a new @vf.intercept decorator parallel to @vf.stop / @vf.reward.

Handlers run on every exchange in priority order on both request (mutate wire JSON before upstream) and response (before the turn commits). They can return a Message to block tool calls and answer the model in text, Terminate to end the rollout (optional negative reward), or mutate exchange.raw in place (rewrites are auto-logged). Actions are stored on trace.interceptions.

The interception server wires this through RolloutSession.run_intercepts: request-side termination refuses the turn; response-side blocking drops tool calls via dialect-aware wire helpers. Streaming buffers the full SSE when handlers exist, then replays original chunks or dialect.stream_events after mutations. Parsers now attach response.raw for in-place edits.

Prebuilt helpers (match_tool, judge_tools, strip_provider_tools) cover fuzzy tool names, LLM judge gating, and stripping provider-side web search across chat / Anthropic / Responses shapes.

Adds intercept-v1 (four demo rows: terminate on answer-file reads, block git, judge gate, strip web search) and registers it in the repo examples / uv workspace.

^{Reviewed by Cursor Bugbot for commit 601abec. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add @vf.intercept decorator for task-authored interception of model exchanges

• Introduces a new @vf.intercept decorator in decorators.py that tasks can use to register handler functions with an optional priority, discovered at rollout time and passed into RolloutSession.
• RolloutSession.run_intercepts in session.py runs handlers in priority order on each request/response exchange; handlers can silently mutate the wire payload, return a Message to block a tool call, or return Terminate to end the rollout with an optional reward.
• Each dialect (anthropic.py, chat.py, responses.py) now stores the native response on Response.raw and implements stream_events to re-synthesize SSE from a mutated raw object for replay.
• The interception server in server.py buffers streaming responses when intercepts are registered, runs handlers after the full response is assembled, and either replays buffered events or synthesizes new SSE from mutated raw; non-streaming paths run intercepts before forwarding and after receiving.
• Helper utilities in verifiers/v1/intercepts/ provide tool name matching (match_tool, TOOL_SYNONYMS), provider tool stripping (strip_provider_tools), and an LLM-based tool-call gate (judge_tools/ToolCallJudge).
• A reference implementation in environments/intercept_v1/ demonstrates block, judge-gate, strip, and terminate intercept patterns.
• Risk: streaming responses are fully buffered when any intercept handler is registered, bypassing live relay to the client.

^{Macroscope summarized 601abec.}