@anvia/core 0.11.2 → 0.12.0

package/dist/{chunk-SISUMRUX.js → chunk-KTTIPWE7.js}

@@ -4,28 +4,37 @@ import {
 import {
   parseToolArgs,
   toolResultContentToText
-} from "./chunk-X3SWV6W6.js";
+} from "./chunk-R7F2JF7J.js";
 import {
-  mapWithConcurrency
-} from "./chunk-OIMLU4SF.js";
+  runControl,
+  toolCallControl
+} from "./chunk-NPZDYOE6.js";
+import {
+  compact
+} from "./chunk-MMHG7WAM.js";
 import {
   CompletionRequestBuilder,
   isStreamingCompletionModel
-} from "./chunk-5G3VME2D.js";
+} from "./chunk-SRBW3LD7.js";
 import {
+  AssistantContent,
   Message,
   ToolContent,
   Usage,
   assertCompletionRequestSupported,
   textFromAssistantContent
-} from "./chunk-WJO6NVE2.js";
+} from "./chunk-5LFGEMIW.js";
 import {
-  runControl,
-  toolCallControl
-} from "./chunk-NPZDYOE6.js";
+  mapWithConcurrency
+} from "./chunk-OIMLU4SF.js";
 import {
-  compact
-} from "./chunk-MMHG7WAM.js";
+  appendGuardrailPolicies,
+  hasEnforcedOutputGuardrails,
+  runInputGuardrails,
+  runOutputGuardrails,
+  runToolGuardrails,
+  runToolResultGuardrails
+} from "./chunk-YRERPIA5.js";
 
 // src/request/errors.ts
 var MaxTurnsError = class extends Error {
@@ -540,22 +549,26 @@ function isGenerationDeltaEvent(type) {
 // src/internal/prompt-runtime/tool-execution.ts
 var MCP_TOOL_METADATA_KEY = /* @__PURE__ */ Symbol.for("anvia.mcp.tool.metadata");
 var ToolCallExecutor = class {
-  constructor(agent, activeHook, approvals, runContext, concurrency, requestMiddlewares, cancel) {
+  constructor(agent, activeHook, approvals, guardrails, runContext, concurrency, requestMiddlewares, cancel, onGuardrailDecision) {
     this.agent = agent;
     this.activeHook = activeHook;
     this.approvals = approvals;
+    this.guardrails = guardrails;
     this.runContext = runContext;
     this.concurrency = concurrency;
     this.requestMiddlewares = requestMiddlewares;
     this.cancel = cancel;
+    this.onGuardrailDecision = onGuardrailDecision;
   }
   agent;
   activeHook;
   approvals;
+  guardrails;
   runContext;
   concurrency;
   requestMiddlewares;
   cancel;
+  onGuardrailDecision;
   async execute(toolCalls, onResult, onStreamEvent, observation) {
     return mapWithConcurrency(toolCalls, this.concurrency, async (toolCall) => {
       const args = JSON.stringify(toolCall.function.arguments ?? {});
@@ -585,6 +598,9 @@ var ToolCallExecutor = class {
           toolMetadata
         })
       );
+      let output;
+      let skipped = false;
+      let effectiveArgs = args;
       const callAction = await this.activeHook?.onToolCall?.({
         ...hookArgs,
         tool: toolCallControl
@@ -595,14 +611,11 @@ var ToolCallExecutor = class {
           observation?.turn,
           toolCall,
           internalCallId,
-          args,
+          effectiveArgs,
           callAction.reason
         );
         throw this.cancel(callAction.reason);
       }
-      let output;
-      let skipped = false;
-      let effectiveArgs = args;
       if (callAction?.type === "skip") {
         output = callAction.reason;
         skipped = true;
@@ -614,8 +627,50 @@ var ToolCallExecutor = class {
             turn: observation?.turn ?? 0,
             originalArgs: args
           });
-          const effectiveHookArgs = { ...hookArgs, args: effectiveArgs };
-          approvalDecision = callAction?.type === "approval_request" ? await this.requestApproval(tool, effectiveHookArgs, callAction) : await this.evaluateToolApproval(tool, effectiveHookArgs) ?? { approved: true };
+          hookArgs.args = effectiveArgs;
+          const inputGuardrailResult = await runToolGuardrails(
+            this.guardrails,
+            tool?.inputGuardrails ?? [],
+            toolGuardrailContext(
+              tool,
+              hookArgs,
+              this.agent,
+              this.runContext,
+              observation?.turn ?? 0
+            )
+          );
+          await this.recordGuardrailDecisions(inputGuardrailResult.decisions);
+          effectiveArgs = inputGuardrailResult.rawArgs;
+          hookArgs.args = effectiveArgs;
+          if (inputGuardrailResult.blocked) {
+            output = inputGuardrailResult.message ?? "Tool call blocked by guardrail.";
+            skipped = true;
+          } else {
+            approvalDecision = inputGuardrailResult.approval !== void 0 ? await this.requestApproval(
+              tool,
+              hookArgs,
+              compact({
+                reason: inputGuardrailResult.approval.reason,
+                rejectMessage: inputGuardrailResult.approval.rejectMessage
+              })
+            ) : callAction?.type === "approval_request" ? await this.requestApproval(tool, hookArgs, callAction) : await this.evaluateToolApproval(tool, hookArgs) ?? { approved: true };
+            if (!approvalDecision.approved) {
+              output = approvalDecision.result;
+              skipped = true;
+            } else {
+              output = await this.runApprovedToolCall(
+                toolCall,
+                hookArgs,
+                effectiveArgs,
+                args,
+                toolObservers,
+                observation,
+                onStreamEvent,
+                false
+              );
+              effectiveArgs = hookArgs.args;
+            }
+          }
         } catch (error) {
           await recordToolError(
             toolObservers,
@@ -627,52 +682,6 @@ var ToolCallExecutor = class {
           );
           throw error;
         }
-        if (!approvalDecision.approved) {
-          output = approvalDecision.result;
-          skipped = true;
-        } else {
-          try {
-            output = await this.agent.callTool(toolCall.function.name, effectiveArgs, {
-              emitStreamEvent: async (event) => {
-                await toolObservers?.streamEvent(
-                  compact({
-                    turn: observation?.turn ?? 0,
-                    toolCall,
-                    toolName: toolCall.function.name,
-                    internalCallId,
-                    args: effectiveArgs,
-                    toolCallId: toolCall.callId,
-                    event
-                  })
-                );
-                const payload = agentToolEventPayload(toolCall, internalCallId, event);
-                if (payload !== void 0) {
-                  onStreamEvent?.(payload);
-                }
-              }
-            });
-          } catch (error) {
-            const errorAction = await this.activeHook?.onToolError?.({
-              ...hookArgs,
-              args: effectiveArgs,
-              error,
-              run: runControl
-            });
-            await toolObservers?.error({
-              turn: observation?.turn ?? 0,
-              toolCall,
-              toolName: toolCall.function.name,
-              internalCallId,
-              args: effectiveArgs,
-              ...toolCall.callId !== void 0 && { toolCallId: toolCall.callId },
-              error
-            });
-            if (errorAction?.type === "terminate") {
-              throw this.cancel(errorAction.reason);
-            }
-            output = error instanceof Error ? error.toString() : String(error);
-          }
-        }
       }
       let result = toolOutputToText(output);
       let structuredResult = toolOutputToStructuredResult(output);
@@ -692,6 +701,29 @@ var ToolCallExecutor = class {
           structuredResult = toolOutputToStructuredResult(middlewareReplacement);
         }
       }
+      const resultGuardrailResult = await runToolResultGuardrails(
+        this.guardrails,
+        tool?.outputGuardrails ?? [],
+        toolResultGuardrailContext(
+          tool,
+          hookArgs,
+          result,
+          structuredResult,
+          this.agent,
+          this.runContext,
+          observation?.turn ?? 0
+        )
+      );
+      await this.recordGuardrailDecisions(resultGuardrailResult.decisions);
+      if (resultGuardrailResult.blocked) {
+        output = resultGuardrailResult.message ?? "Tool result blocked by guardrail.";
+        result = toolOutputToText(output);
+        structuredResult = toolOutputToStructuredResult(output);
+      } else if (resultGuardrailResult.result !== result || resultGuardrailResult.structuredResult !== structuredResult) {
+        output = resultGuardrailResult.structuredResult ?? resultGuardrailResult.result;
+        result = resultGuardrailResult.result;
+        structuredResult = resultGuardrailResult.structuredResult;
+      }
       const resultAction = await this.activeHook?.onToolResult?.({
         ...hookArgs,
         args: effectiveArgs,
@@ -728,6 +760,61 @@ var ToolCallExecutor = class {
       return ToolContent.toolResult(toolCall.id, output, toolCall.callId);
     });
   }
+  async runApprovedToolCall(toolCall, hookArgs, effectiveArgs, originalArgs, toolObservers, observation, onStreamEvent, applyInputMiddleware = true) {
+    const middlewareArgs = applyInputMiddleware ? await this.runToolInputMiddlewares({
+      ...hookArgs,
+      args: effectiveArgs,
+      turn: observation?.turn ?? 0,
+      originalArgs
+    }) : effectiveArgs;
+    hookArgs.args = middlewareArgs;
+    try {
+      return await this.agent.callTool(toolCall.function.name, middlewareArgs, {
+        emitStreamEvent: async (event) => {
+          await toolObservers?.streamEvent(
+            compact({
+              turn: observation?.turn ?? 0,
+              toolCall,
+              toolName: toolCall.function.name,
+              internalCallId: hookArgs.internalCallId,
+              args: middlewareArgs,
+              toolCallId: toolCall.callId,
+              event
+            })
+          );
+          const payload = agentToolEventPayload(toolCall, hookArgs.internalCallId, event);
+          if (payload !== void 0) {
+            onStreamEvent?.(payload);
+          }
+        }
+      });
+    } catch (error) {
+      const errorAction = await this.activeHook?.onToolError?.({
+        ...hookArgs,
+        args: middlewareArgs,
+        error,
+        run: runControl
+      });
+      await toolObservers?.error({
+        turn: observation?.turn ?? 0,
+        toolCall,
+        toolName: toolCall.function.name,
+        internalCallId: hookArgs.internalCallId,
+        args: middlewareArgs,
+        ...toolCall.callId !== void 0 && { toolCallId: toolCall.callId },
+        error
+      });
+      if (errorAction?.type === "terminate") {
+        throw this.cancel(errorAction.reason);
+      }
+      return error instanceof Error ? error.toString() : String(error);
+    }
+  }
+  async recordGuardrailDecisions(decisions) {
+    for (const decision of decisions) {
+      await this.onGuardrailDecision?.(decision);
+    }
+  }
   async runToolResultMiddlewares(args) {
     let result = args.result;
     let structuredResult = args.structuredResult;
@@ -829,6 +916,55 @@ function approvalContext(tool, hookArgs, agent, run) {
     })
   });
 }
+function toolGuardrailContext(tool, hookArgs, agent, run, turn) {
+  const parsedArgs = parseGuardrailContextArgs(tool, hookArgs.args);
+  return compact({
+    toolName: hookArgs.toolName,
+    args: parsedArgs,
+    rawArgs: hookArgs.args,
+    toolCallId: hookArgs.toolCallId,
+    internalCallId: hookArgs.internalCallId,
+    turn,
+    run: guardrailRunContext(agent, run)
+  });
+}
+function toolResultGuardrailContext(tool, hookArgs, result, structuredResult, agent, run, turn) {
+  const parsedArgs = parseGuardrailContextArgs(tool, hookArgs.args);
+  return compact({
+    toolName: hookArgs.toolName,
+    args: parsedArgs,
+    rawArgs: hookArgs.args,
+    result,
+    structuredResult,
+    toolCallId: hookArgs.toolCallId,
+    internalCallId: hookArgs.internalCallId,
+    turn,
+    run: guardrailRunContext(agent, run)
+  });
+}
+function parseGuardrailContextArgs(tool, rawArgs) {
+  const parsedArgs = parseGuardrailArgs(rawArgs);
+  try {
+    return tool?.parseApprovalArgs?.(parsedArgs) ?? parsedArgs;
+  } catch {
+    return parsedArgs;
+  }
+}
+function parseGuardrailArgs(args) {
+  try {
+    return parseToolArgs(args);
+  } catch {
+    return args;
+  }
+}
+function guardrailRunContext(agent, run) {
+  return compact({
+    agentId: agent.id,
+    runId: run.runId,
+    sessionId: run.sessionId,
+    metadata: run.metadata
+  });
+}
 function normalizeApprovalDecision(decision) {
   if (typeof decision === "boolean") {
     return { approved: decision };
@@ -852,6 +988,8 @@ function toolTraceMetadata(tool) {
   const mcpMetadata = typeof metadata === "object" && metadata !== null ? metadata : void 0;
   return {
     approvalRequired: tool.approval !== void 0,
+    inputGuardrailCount: tool.inputGuardrails?.length ?? 0,
+    outputGuardrailCount: tool.outputGuardrails?.length ?? 0,
     ...typeof mcpMetadata?.serverName === "string" && mcpMetadata.serverName.length > 0 ? { mcpServerName: mcpMetadata.serverName } : {}
   };
 }
@@ -1100,6 +1238,7 @@ var PromptRequest = class _PromptRequest {
     this.maxTurnCount = agent.defaultMaxTurns ?? 0;
     this.activeHook = agent.hook;
     this.approvalOptions = agent.approvals;
+    this.guardrailPolicies = [...agent.guardrails];
     this.memoryRecorder = new PromptRequestMemory(agent, memoryContext, initialHistory);
   }
   agent;
@@ -1109,6 +1248,8 @@ var PromptRequest = class _PromptRequest {
   maxTurnCount;
   activeHook;
   approvalOptions;
+  guardrailPolicies;
+  guardrailDecisions = [];
   concurrency = 1;
   traceOptions;
   requestMiddlewares = [];
@@ -1131,6 +1272,10 @@ var PromptRequest = class _PromptRequest {
     this.approvalOptions = options;
     return this;
   }
+  guardrails(policies) {
+    this.guardrailPolicies = appendGuardrailPolicies(this.guardrailPolicies, policies);
+    return this;
+  }
   /**
    * @deprecated Use `withHook` instead.
    */
@@ -1175,14 +1320,37 @@ var PromptRequest = class _PromptRequest {
   async send() {
     this.startRun();
     const runId = globalThis.crypto.randomUUID();
-    const newMessages = [this.promptMessage];
-    this.chatHistory = await this.memoryRecorder.prepareRun(runId, newMessages);
-    const pendingTurnMessages = this.memoryRecorder.pendingTurnMessages(newMessages);
     let usage = Usage.empty();
     let currentTurns = 0;
     let lastPrompt = this.promptMessage;
+    let newMessages = [this.promptMessage];
     const runObservers = await this.startRunObservers();
     try {
+      const inputResult = await runInputGuardrails(this.guardrailPolicies, {
+        prompt: this.promptMessage,
+        history: this.chatHistory,
+        inputText: textFromMessage(this.promptMessage),
+        run: this.guardrailRunContext(runId)
+      });
+      for (const decision of inputResult.decisions) {
+        await this.recordGuardrailDecision(decision, runObservers);
+      }
+      this.promptMessage = inputResult.prompt;
+      if (inputResult.blocked) {
+        const output = inputResult.message ?? "The request was blocked by a guardrail.";
+        const result = {
+          output,
+          usage: Usage.empty(),
+          messages: [this.promptMessage, Message.assistant(output)],
+          guardrails: [...this.guardrailDecisions]
+        };
+        await runObservers.end(result);
+        this.runState = "completed";
+        return result;
+      }
+      newMessages = [this.promptMessage];
+      this.chatHistory = await this.memoryRecorder.prepareRun(runId, newMessages);
+      const pendingTurnMessages = this.memoryRecorder.pendingTurnMessages(newMessages);
       await this.runRunStartHook(newMessages);
       while (currentTurns <= this.maxTurnCount + 1) {
         const prompt = newMessages.at(-1);
@@ -1198,7 +1366,10 @@ var PromptRequest = class _PromptRequest {
         const dynamicContext = await fetchDynamicContext(this.agent, ragText);
         const toolDefs = await fetchToolDefinitions(this.agent, ragText);
         let request = new CompletionRequestBuilder(this.agent.model, prompt).instructions(this.agent.instructions).messages(historyForRequest).documents([...this.agent.staticContext, ...dynamicContext]).tools(toolDefs).temperature(this.agent.temperature).maxTokens(this.agent.maxTokens).additionalParams(this.agent.additionalParams).toolChoice(this.agent.toolChoice).outputSchema(this.agent.outputSchema).build();
-        request = await this.runCompletionRequestMiddlewares(request, currentTurns);
+        request = await this.runCompletionRequestMiddlewares(
+          request,
+          currentTurns
+        );
         let response;
         try {
           response = await this.runCompletion(request, currentTurns, runObservers);
@@ -1210,27 +1381,46 @@ var PromptRequest = class _PromptRequest {
         usage = Usage.add(usage, response.usage);
         await this.runCompletionResponseHook(prompt, response, newMessages);
         await this.runTurnEndHook(currentTurns, response, newMessages);
-        const assistantMessage = Message.assistant(response.choice, response.messageId);
-        newMessages.push(assistantMessage);
-        await this.memoryRecorder.commitMessages(
-          runId,
-          currentTurns,
-          [assistantMessage],
-          pendingTurnMessages
-        );
         const toolCalls = response.choice.filter(
           (item) => item.type === "tool_call"
         );
+        const assistantMessage = Message.assistant(response.choice, response.messageId);
+        newMessages.push(assistantMessage);
         if (toolCalls.length === 0) {
+          if (this.steeringMessages.length > 0) {
+            await this.memoryRecorder.commitMessages(
+              runId,
+              currentTurns,
+              [assistantMessage],
+              pendingTurnMessages
+            );
+          }
           if (await this.drainSteeringMessages(runId, currentTurns, newMessages, pendingTurnMessages)) {
             await this.memoryRecorder.commitCompletedTurn(runId, currentTurns, pendingTurnMessages);
             continue;
           }
+          const guardedOutput = await this.runOutputGuardrailsForResponse(
+            runId,
+            usage,
+            response,
+            newMessages,
+            runObservers
+          );
+          response = guardedOutput.response;
+          const finalAssistantMessage = Message.assistant(response.choice, response.messageId);
+          newMessages[newMessages.length - 1] = finalAssistantMessage;
+          await this.memoryRecorder.commitMessages(
+            runId,
+            currentTurns,
+            [finalAssistantMessage],
+            pendingTurnMessages
+          );
           const result = {
-            output: textFromAssistantContent(response.choice),
+            output: guardedOutput.output,
             usage,
             messages: [...newMessages],
-            trace: runObservers.trace
+            trace: runObservers.trace,
+            guardrails: [...this.guardrailDecisions]
           };
           await this.runRunEndHook(result, newMessages);
           await runObservers.end(result);
@@ -1243,6 +1433,12 @@ var PromptRequest = class _PromptRequest {
           this.runState = "completed";
           return result;
         }
+        await this.memoryRecorder.commitMessages(
+          runId,
+          currentTurns,
+          [assistantMessage],
+          pendingTurnMessages
+        );
         const toolResults = await this.executeToolCalls(
           runId,
           toolCalls,
@@ -1253,6 +1449,9 @@ var PromptRequest = class _PromptRequest {
             turn: currentTurns,
             runObservers,
             toolDefinitions: request.tools
+          },
+          async (decision) => {
+            await this.recordGuardrailDecision(decision, runObservers);
           }
         );
         const toolMessage = Message.tool(toolResults);
@@ -1281,18 +1480,51 @@ var PromptRequest = class _PromptRequest {
     }
     this.startRun();
     const runId = globalThis.crypto.randomUUID();
-    const newMessages = [this.promptMessage];
-    this.chatHistory = await this.memoryRecorder.prepareRun(runId, newMessages);
-    const pendingTurnMessages = this.memoryRecorder.pendingTurnMessages(newMessages);
-    let usage = Usage.empty();
-    let currentTurns = 0;
-    let lastPrompt = this.promptMessage;
-    const runObservers = await this.startRunObservers();
     const emit = async (event) => {
       await this.recordAgentEvent(runId, event);
       return event;
     };
+    let usage = Usage.empty();
+    let currentTurns = 0;
+    let lastPrompt = this.promptMessage;
+    let newMessages = [this.promptMessage];
+    const runObservers = await this.startRunObservers();
+    const bufferOutputDeltas = hasEnforcedOutputGuardrails(this.guardrailPolicies);
     try {
+      const inputResult = await runInputGuardrails(this.guardrailPolicies, {
+        prompt: this.promptMessage,
+        history: this.chatHistory,
+        inputText: textFromMessage(this.promptMessage),
+        run: this.guardrailRunContext(runId)
+      });
+      for (const decision of inputResult.decisions) {
+        await this.recordGuardrailDecision(decision, runObservers);
+        yield await emit({ type: "guardrail_decision", decision });
+      }
+      this.promptMessage = inputResult.prompt;
+      if (inputResult.blocked) {
+        const output = inputResult.message ?? "The request was blocked by a guardrail.";
+        const result = {
+          output,
+          usage: Usage.empty(),
+          messages: [this.promptMessage, Message.assistant(output)],
+          guardrails: [...this.guardrailDecisions]
+        };
+        await runObservers.end(result);
+        this.runState = "completed";
+        yield await emit({
+          type: "final",
+          runId,
+          output: result.output,
+          usage: result.usage,
+          messages: result.messages,
+          guardrails: result.guardrails
+        });
+        return;
+      }
+      newMessages = [this.promptMessage];
+      this.chatHistory = await this.memoryRecorder.prepareRun(runId, newMessages);
+      const pendingTurnMessages = this.memoryRecorder.pendingTurnMessages(newMessages);
       await this.runRunStartHook(newMessages);
       while (currentTurns <= this.maxTurnCount + 1) {
         const prompt = newMessages.at(-1);
@@ -1314,7 +1546,10 @@ var PromptRequest = class _PromptRequest {
         const dynamicContext = await fetchDynamicContext(this.agent, ragText);
         const toolDefs = await fetchToolDefinitions(this.agent, ragText);
         let request = new CompletionRequestBuilder(this.agent.model, prompt).instructions(this.agent.instructions).messages(historyForRequest).documents([...this.agent.staticContext, ...dynamicContext]).tools(toolDefs).temperature(this.agent.temperature).maxTokens(this.agent.maxTokens).additionalParams(this.agent.additionalParams).toolChoice(this.agent.toolChoice).outputSchema(this.agent.outputSchema).build();
-        request = await this.runCompletionRequestMiddlewares(request, currentTurns);
+        request = await this.runCompletionRequestMiddlewares(
+          request,
+          currentTurns
+        );
         assertCompletionRequestSupported(this.agent.model, request, { streaming: true });
         const providerRequest = this.providerTraceRequest(request, { stream: true });
         const generationObservers = await runObservers.startGeneration(
@@ -1348,7 +1583,8 @@ var PromptRequest = class _PromptRequest {
               if (mapped.type === "tool_call") {
                 emittedToolCallIds.add(mapped.toolCall.id);
               }
-              if (!bufferResponseEvents) {
+              const shouldBuffer = bufferResponseEvents || bufferOutputDeltas && (mapped.type === "text_delta" || mapped.type === "reasoning_delta");
+              if (!shouldBuffer) {
                 yield await emit(addTurn(currentTurns, mapped));
               }
             }
@@ -1370,39 +1606,67 @@ var PromptRequest = class _PromptRequest {
         usage = Usage.add(usage, response.usage);
         await this.runCompletionResponseHook(prompt, response, newMessages);
         await this.runTurnEndHook(currentTurns, response, newMessages);
-        const assistantMessage = Message.assistant(response.choice, response.messageId);
-        newMessages.push(assistantMessage);
-        await this.memoryRecorder.commitMessages(
-          runId,
-          currentTurns,
-          [assistantMessage],
-          pendingTurnMessages
-        );
         const toolCalls = response.choice.filter(
           (item) => item.type === "tool_call"
         );
-        if (bufferResponseEvents) {
-          for (const event of responseStreamEvents(currentTurns, response)) {
-            yield await emit(event);
-          }
-        } else {
-          for (const toolCall of toolCalls) {
-            if (!emittedToolCallIds.has(toolCall.id)) {
-              yield await emit({ type: "tool_call", turn: currentTurns, toolCall });
+        let assistantMessage = Message.assistant(response.choice, response.messageId);
+        newMessages.push(assistantMessage);
+        if (toolCalls.length === 0) {
+          let emittedTurnEnd = false;
+          if (!bufferOutputDeltas) {
+            if (bufferResponseEvents) {
+              for (const event of responseStreamEvents(currentTurns, response)) {
+                yield await emit(event);
+              }
             }
+            yield await emit({ type: "turn_end", turn: currentTurns, response });
+            emittedTurnEnd = true;
+          }
+          if (this.steeringMessages.length > 0) {
+            await this.memoryRecorder.commitMessages(
+              runId,
+              currentTurns,
+              [assistantMessage],
+              pendingTurnMessages
+            );
           }
-        }
-        yield await emit({ type: "turn_end", turn: currentTurns, response });
-        if (toolCalls.length === 0) {
           if (await this.drainSteeringMessages(runId, currentTurns, newMessages, pendingTurnMessages)) {
             await this.memoryRecorder.commitCompletedTurn(runId, currentTurns, pendingTurnMessages);
             continue;
           }
+          const guardedOutput = await this.runOutputGuardrailsForResponse(
+            runId,
+            usage,
+            response,
+            newMessages,
+            runObservers
+          );
+          for (const decision of guardedOutput.decisions) {
+            yield await emit({ type: "guardrail_decision", decision });
+          }
+          response = guardedOutput.response;
+          assistantMessage = Message.assistant(response.choice, response.messageId);
+          newMessages[newMessages.length - 1] = assistantMessage;
+          await this.memoryRecorder.commitMessages(
+            runId,
+            currentTurns,
+            [assistantMessage],
+            pendingTurnMessages
+          );
+          if (!emittedTurnEnd && (bufferResponseEvents || bufferOutputDeltas)) {
+            for (const event of responseStreamEvents(currentTurns, response)) {
+              yield await emit(event);
+            }
+          }
+          if (!emittedTurnEnd) {
+            yield await emit({ type: "turn_end", turn: currentTurns, response });
+          }
           const result = {
-            output: textFromAssistantContent(response.choice),
+            output: guardedOutput.output,
             usage,
             messages: [...newMessages],
-            trace: runObservers.trace
+            trace: runObservers.trace,
+            guardrails: [...this.guardrailDecisions]
           };
           await this.runRunEndHook(result, newMessages);
           await runObservers.end(result);
@@ -1419,10 +1683,29 @@ var PromptRequest = class _PromptRequest {
             output: result.output,
             usage: result.usage,
             messages: result.messages,
-            trace: result.trace
+            trace: result.trace,
+            guardrails: result.guardrails
           });
           return;
         }
+        if (bufferResponseEvents) {
+          for (const event of responseStreamEvents(currentTurns, response)) {
+            yield await emit(event);
+          }
+        } else {
+          for (const toolCall of toolCalls) {
+            if (!emittedToolCallIds.has(toolCall.id)) {
+              yield await emit({ type: "tool_call", turn: currentTurns, toolCall });
+            }
+          }
+        }
+        await this.memoryRecorder.commitMessages(
+          runId,
+          currentTurns,
+          [assistantMessage],
+          pendingTurnMessages
+        );
+        yield await emit({ type: "turn_end", turn: currentTurns, response });
         const toolResultEvents = createAsyncQueue();
         const toolResultsPromise = this.executeToolCalls(
           runId,
@@ -1438,6 +1721,10 @@ var PromptRequest = class _PromptRequest {
             turn: currentTurns,
             runObservers,
             toolDefinitions: request.tools
+          },
+          async (decision) => {
+            await this.recordGuardrailDecision(decision, runObservers);
+            toolResultEvents.enqueue({ type: "guardrail_decision", decision });
           }
         );
         toolResultsPromise.then(
@@ -1505,11 +1792,12 @@ var PromptRequest = class _PromptRequest {
       };
     }
   }
-  async executeToolCalls(runId, toolCalls, newMessages, onResult, onStreamEvent, observation) {
+  async executeToolCalls(runId, toolCalls, newMessages, onResult, onStreamEvent, observation, onGuardrailDecision) {
     const executor = new ToolCallExecutor(
       this.agent,
       this.activeHook,
       this.approvalOptions,
+      this.guardrailPolicies,
       {
         runId,
         sessionId: this.memoryContext?.sessionId,
@@ -1517,10 +1805,51 @@ var PromptRequest = class _PromptRequest {
       },
       this.concurrency,
       this.requestMiddlewares,
-      (reason) => this.cancelled(newMessages, reason)
+      (reason) => this.cancelled(newMessages, reason),
+      onGuardrailDecision
     );
     return executor.execute(toolCalls, onResult, onStreamEvent, observation);
   }
+  async runOutputGuardrailsForResponse(runId, usage, response, messages, runObservers) {
+    const originalOutput = textFromAssistantContent(response.choice);
+    const result = await runOutputGuardrails(this.guardrailPolicies, {
+      outputText: originalOutput,
+      messages: [...this.chatHistory, ...messages],
+      usage,
+      run: this.guardrailRunContext(runId)
+    });
+    for (const decision of result.decisions) {
+      await this.recordGuardrailDecision(decision, runObservers);
+    }
+    const output = result.blocked ? result.message ?? "The response was blocked by a guardrail." : result.outputText;
+    if (output === originalOutput) {
+      return { output, response, decisions: result.decisions };
+    }
+    return {
+      output,
+      response: {
+        ...response,
+        choice: [AssistantContent.text(output)]
+      },
+      decisions: result.decisions
+    };
+  }
+  async recordGuardrailDecision(decision, runObservers) {
+    this.guardrailDecisions.push(decision);
+    await runObservers.event({
+      name: "guardrail.decision",
+      level: decision.action === "block" ? "WARNING" : "DEFAULT",
+      attributes: guardrailDecisionAttributes(decision)
+    });
+  }
+  guardrailRunContext(runId) {
+    return compact({
+      agentId: this.agent.id,
+      runId,
+      sessionId: this.memoryContext?.sessionId,
+      metadata: this.memoryContext?.metadata
+    });
+  }
   async startRunObservers() {
     const failOnObserverError = this.traceOptions?.failOnObserverError === true || this.agent.observers.some((registration) => registration.failOnObserverError === true);
     return startAgentRunObservers(
@@ -1770,6 +2099,33 @@ function responseStreamEvents(turn, response) {
   }
   return events;
 }
+function textFromMessage(message) {
+  if (message.role === "system") {
+    return message.content;
+  }
+  return message.content.flatMap((content) => {
+    if (content.type === "text") {
+      return [content.text];
+    }
+    if (content.type === "document" && content.source.type === "text") {
+      return [content.source.text];
+    }
+    return [];
+  }).join("\n");
+}
+function guardrailDecisionAttributes(decision) {
+  return compact({
+    policyId: decision.policyId,
+    guardrailId: decision.guardrailId,
+    boundary: decision.boundary,
+    mode: decision.mode,
+    action: decision.action,
+    applied: decision.applied,
+    reason: decision.reason,
+    message: decision.message,
+    latencyMs: decision.latencyMs
+  });
+}
 
 export {
   MaxTurnsError,
@@ -1778,4 +2134,4 @@ export {
   extractRagText,
   PromptRequest
 };
-//# sourceMappingURL=chunk-SISUMRUX.js.map
+//# sourceMappingURL=chunk-KTTIPWE7.js.map