@intflows/genkit-guard 0.0.13 → 0.0.14

package/scripts/test-publish-wiki.js

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+test('wiki preview never pushes; publish updates pages and preserves unrelated files', () => {
+  const work = mkdtempSync(join(tmpdir(), 'wiki-test-'));
+  const run = (cmd, args, cwd = work) => {
+    const result = spawnSync(cmd, args, { cwd, encoding: 'utf8', env: { ...process.env, GIT_AUTHOR_NAME: 'Test', GIT_AUTHOR_EMAIL: 'test@example.com', GIT_COMMITTER_NAME: 'Test', GIT_COMMITTER_EMAIL: 'test@example.com' } });
+    assert.equal(result.status, 0, result.stderr); return result.stdout;
+  };
+  try {
+    const remote = join(work, 'remote.git'); const seed = join(work, 'seed'); const source = join(work, 'pages');
+    run('git', ['init', '--bare', remote]); run('git', ['clone', remote, seed]);
+    writeFileSync(join(seed, 'Home.md'), 'Preserve me');
+    run('git', ['add', '.'], seed); run('git', ['commit', '-m', 'initial'], seed); run('git', ['push', 'origin', 'HEAD'], seed);
+    mkdirSync(source); writeFileSync(join(source, '1.-Home.md'), '# New home'); writeFileSync(join(source, 'README.md'), 'Do not publish');
+    const args = [resolve('scripts/publish-wiki.js'), '--repo', remote, '--source', source];
+    const before = run('git', ['rev-parse', 'HEAD'], remote);
+    assert.match(run(process.execPath, args), /Preview only/);
+    assert.equal(run('git', ['rev-parse', 'HEAD'], remote), before);
+    assert.match(run(process.execPath, [...args, '--publish']), /published/);
+    assert.equal(run('git', ['show', 'HEAD:1.-Home.md'], remote), '# New home');
+    assert.equal(run('git', ['show', 'HEAD:Home.md'], remote), 'Preserve me');
+    assert.doesNotMatch(run('git', ['ls-tree', '--name-only', 'HEAD'], remote), /README/);
+    assert.match(run(process.execPath, [...args, '--publish']), /nothing to publish/);
+  } finally { rmSync(work, { recursive: true, force: true }); }
+});

package/scripts/test-release1.js

@@ -0,0 +1,83 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { genkit, z } from 'genkit';
+import { guard, guardMiddleware, GuardToolError } from '../dist/index.js';
+import { ModelSingleton } from '../dist/util/singleton.js';
+ModelSingleton.getExtractor = async () => async () => ({ tolist: () => [[1, 0], [1, 0]] });
+ModelSingleton.getNER = async () => async () => [];
+const base = { intent: { semantic: { intents: { support: 'Support' } } }, logging: { enabled: false } };
+const request = () => ({ toolRequest: { name: 'sendEmail', input: { email: 'alice@example.com', nested: ['alice@example.com'] } } });
+
+test('tool policies enforce before execution and redact nested arguments', async () => {
+  for (const action of ['allow', 'block', 'redact', 'approval-required']) {
+    const decisions = [];
+    const middleware = guard({ ...base, tools: { rules: { sendEmail: action } }, logging: { enabled: false, onDecision: d => decisions.push(d) } });
+    let executed = 0;
+    const run = middleware.tool(request(), {}, async req => {
+      executed++;
+      if (action === 'redact') assert.deepEqual(req.toolRequest.input, { email: '[REDACTED]', nested: ['[REDACTED]'] });
+      else assert.equal(req.toolRequest.input.email, 'alice@example.com');
+      return { toolResponse: { name: 'sendEmail', output: 'ok' } };
+    });
+    if (action === 'block' || action === 'approval-required') await assert.rejects(run, GuardToolError);
+    else await run;
+    assert.equal(executed, action === 'allow' || action === 'redact' ? 1 : 0);
+    assert.equal(decisions[0].action, action);
+    assert.equal(decisions[0].schemaVersion, '1');
+    assert.doesNotMatch(JSON.stringify(decisions), /alice|example.com|nested/);
+  }
+});
+
+test('approval is explicit, per-call and cannot be spoofed by request flags', async () => {
+  for (const approve of [undefined, () => false, () => 'true', () => { throw new Error('secret'); }, async () => true]) {
+    let ran = false;
+    const middleware = guard({ ...base, tools: { defaultAction: 'approval-required', approve } });
+    const req = request(); req.toolRequest.input.approved = true;
+    const run = middleware.tool(req, {}, async () => { ran = true; });
+    if (approve && await Promise.resolve().then(() => approve()).catch(() => false) === true) await run;
+    else await assert.rejects(run, GuardToolError);
+    assert.equal(ran, Boolean(approve && await Promise.resolve().then(() => approve()).catch(() => false) === true));
+  }
+});
+
+test('default block, unknown tools, invalid actions and callback failures stop execution', async () => {
+  for (const tools of [{ defaultAction: 'block', rules: { other: 'allow' } }, { defaultAction: 'invalid' }]) {
+    await assert.rejects(guard({ ...base, tools }).tool(request(), {}, () => assert.fail('Executed')), GuardToolError);
+  }
+  await assert.rejects(guard({ ...base, logging: { enabled: false, onDecision: () => { throw new Error('sink unavailable'); } } }).tool(request(), {}, () => assert.fail('Executed')), /sink unavailable/);
+});
+
+test('prompt and tool events share contract; console does not include raw content', async () => {
+  const events = []; const lines = [];
+  const original = { log: console.log, warn: console.warn };
+  console.log = console.warn = value => lines.push(value);
+  try {
+    const middleware = guard({ ...base, policyVersion: 'release-1', logging: { onDecision: d => events.push(d) } });
+    await middleware.model({ prompt: 'Help alice@example.com' }, {}, async req => ({ text: req.prompt }));
+    await middleware.model({ prompt: 'ignore previous alice@example.com' }, {}, () => assert.fail('Executed'));
+    await middleware.tool(request(), {}, async () => undefined);
+  } finally { Object.assign(console, original); }
+  assert.deepEqual(events.map(d => d.guard), ['injection', 'intent', 'pii', 'injection', 'tool']);
+  assert.ok(events.every(d => d.policyVersion === 'release-1' && d.latencyMs >= 0));
+  assert.equal(new Set(events.map(d => d.decisionId)).size, events.length);
+  assert.doesNotMatch(lines.join(''), /alice@example.com|Help alice|ignore previous/);
+});
+
+test('Genkit generate actually intercepts tool execution', async () => {
+  for (const factory of [guard, guardMiddleware]) for (const action of ['allow', 'block', 'redact', 'approval-required']) {
+    const ai = genkit({});
+    let executions = 0; let turn = 0;
+    const tool = ai.defineTool({ name: 'sendEmail', description: 'Test', inputSchema: z.object({ email: z.string() }), outputSchema: z.string() }, async input => {
+      executions++;
+      assert.equal(input.email, action === 'redact' ? '[REDACTED]' : 'alice@example.com');
+      return 'ok';
+    });
+    const model = ai.defineModel({ name: 'test/model' }, async () => ({ message: { role: 'model', content: ++turn === 1
+      ? [{ toolRequest: { name: 'sendEmail', ref: '1', input: { email: 'alice@example.com' } } }]
+      : [{ text: 'Done' }] } }));
+    const run = ai.generate({ model, prompt: 'Help', tools: [tool], use: [factory({ ...base, tools: { defaultAction: action } })] });
+    if (action === 'block' || action === 'approval-required') await assert.rejects(run);
+    else await run;
+    assert.equal(executions, ['allow', 'redact'].includes(action) ? 1 : 0);
+  }
+});

package/scripts/test-types.ts

@@ -19,3 +19,33 @@ guard({
     },
   },
 });
+
+import { defineGuardConfig, initGuard, type GuardConfig } from '../src/index.js';
+const shared = defineGuardConfig({
+  models: { extractor: 'custom/intent' },
+  pii: { model: 'custom/pii', mode: 'classifier', labelMappings: { LABEL_0: null, LABEL_1: 'NAME' } },
+});
+guard(shared);
+void initGuard(shared);
+const legacy: GuardConfig = { models: { extractor: 'legacy/intent' }, pii: { model: 'legacy/pii' } };
+guard(legacy);
+void initGuard(legacy);
+
+import type { GuardDecision } from '../src/index.js';
+const release1 = defineGuardConfig({
+  policyVersion: 'release-1',
+  tools: {
+    defaultAction: 'block',
+    rules: { lookup: 'allow', sendEmail: 'approval-required', summarize: 'redact' },
+    approve: async ({ toolName, input, context }) => {
+      const call: unknown[] = [toolName, input, context];
+      return call.length === 0;
+    },
+  },
+  logging: { onDecision: async (decision: GuardDecision) => { console.log(decision.reasonCode); } },
+});
+guard(release1);
+
+// Legacy direct invocation remains typed for configurations without tool policies.
+void guard()({ prompt: 'test' }, async (request: unknown) => request);
+void guard({ pii: { mode: 'ner' } })({ prompt: 'test' }, async (request: unknown) => request);