@intflows/genkit-guard 0.0.6 → 0.0.7

package/package.json

@@ -5,12 +5,11 @@
     "Hemant Kohli"
   ],
   "license": "Apache-2.0",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "type": "module",
   "exports": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "src/",
     "README.md",
     "package.json",
     "scripts/",

package/src/core/types.ts

@@ -1,26 +0,0 @@
-// Intent Guard Types
-export interface IntentGuardConfig {
-  allowedIntent: string;
-  intents: Record<string, string>; // name -> semantic description
-  threshold?: number;              // default 0.7
-  fallbackMessage?: string;
-}
-
-export interface IntentResult {
-  allowed: boolean;
-  score: number;
-}
-
-
-
-// PII Masking Types
-export interface PiiRule {
-  name: string;
-  pattern: RegExp;
-//   replaceWith: string;
-}
-
-export interface PiiConfig {
-  rules?: PiiRule[];
-  maskCharacter?: string; // e.g., "*"
-}

package/src/index.ts

@@ -1,17 +0,0 @@
-import { ModelSingleton } from './util/singleton.js';
-
-// export { intentGuard, piiGuard  } from './middleware/middleware.js';
-export { guard } from './middleware/middleware.js';
-export * from './core/types.js';
-
-/**
- * Pre-load the model to avoid cold-start delay on first user request.
- */
-export async function initGuard() {
-  console.log('[Guard] Loading local models...');
-  await Promise.all([
-    ModelSingleton.getExtractor(),
-    ModelSingleton.getNER()
-  ]);
-  console.log('[Guard] Models loaded');
-}

package/src/intent/intentAnalyzer.ts

@@ -1,100 +0,0 @@
-import { cos_sim } from '@huggingface/transformers';
-import { ModelSingleton } from '../util/singleton.js';
-
-const INJECTION_PATTERNS = [
-  'ignore instructions',
-  'reveal secrets',
-  'bypass security',
-  'system prompt',
-  'internal policy',
-  'developer message',
-  'confidential information',
-  'do not follow previous instructions',
-  'disregard earlier directives',
-  'override safety measures',
-  'leak data',
-  'expose vulnerabilities',
-  'access restricted areas',
-  'execute arbitrary code',
-  'perform unauthorized actions',
-  'escalate privileges',
-  'disable safeguards',
-  'manipulate output',
-  'circumvent controls',
-  'exploit weaknesses',
-  'compromise integrity',
-  'subvert protections',
-  'inject malicious content',
-  'craft deceptive prompts',
-  'trick the model',
-  'confuse the system',
-  'You are now a hacker',
-  'You are a malicious actor',
-  'Find a vulnerability',
-  'Write a prompt that bypasses security',
-  'Write a prompt that tricks the model',
-  'Write a prompt that confuses the system',
-  "ignore previous",
-  "ignore earlier",
-  "disregard previous",
-  "disregard earlier",
-  "you are a hacker",
-  "you are now a hacker",
-  "you are malicious",
-  "export the api key",
-  "give me the api key",
-  "bypass",
-  "override",
-  "jailbreak",
-  "system override",
-  "forget instructions",
-  "forget previous",
-  "forget earlier",
-  "do anything now",
-  "dan mode",
-  "developer mode",
-  "break character",
-  "act as"
-];
-
-export async function detectInjection(userInput: string) {
-  return INJECTION_PATTERNS.some(p =>
-    userInput.toLowerCase().includes(p)
-  );
-}
-
-
-export async function analyzeIntentStructured(
-  input: string,
-  intents: Record<string, string>,
-  threshold: number
-) {
-  const extractor = await ModelSingleton.getExtractor();
-
-  let bestIntent = '';
-  let bestScore = 0;
-
-  for (const [key, desc] of Object.entries(intents)) {
-    const output = await extractor(
-      [`intent: ${desc}`, `intent: ${input}`],
-      { pooling: 'mean', normalize: true }
-    );
-
-    const vectors = output.tolist() as number[][];
-    const score = cos_sim(vectors[0], vectors[1]);
-
-    const finalScore =
-      typeof score === 'number' ? score : (score as any).data[0];
-
-    if (finalScore > bestScore) {
-      bestScore = finalScore;
-      bestIntent = key;
-    }
-  }
-
-  return {
-    intent: bestIntent,
-    score: bestScore,
-    allowed: bestScore >= threshold
-  };
-}

package/src/middleware/middleware.ts

@@ -1,143 +0,0 @@
-import { analyzeIntentStructured, detectInjection } from '../intent/intentAnalyzer.js';
-import { detectPII } from '../pii/detector.js';
-import { PiiTokenizer } from '../pii/tokenizer.js';
-
-export function guard(config: any) {
-  return async (req: any, next: any) => {
-    const input =
-      req.prompt ||
-      req.messages?.[req.messages.length - 1]?.content?.[0]?.text ||
-      "";
-
-    // -------------------------
-    // 1. INTENT ANALYSIS
-    // -------------------------
-    const isInjection = await detectInjection(input);
-
-    if (isInjection) {
-      console.warn(`[Intent Guard] Prompt injection pattern detected in input`);
-      return block("Prompt injection detected", {
-      reason: "pattern_match"
-      });
-    }
-
-    console.log(`[Intent Guard] Analyzing intent for user's input`);
-    
-    const intentResult = await analyzeIntentStructured(
-      input,
-      config.intent.semantic.intents,
-      config.intent.semantic.threshold
-    );
-
-    console.log(`[Intent Guard] Detected intent: ${intentResult.intent} (score: ${intentResult.score.toFixed(2)})`);
-
-    if (!intentResult.allowed) {
-        console.warn(`[Intent Guard] Intent "${intentResult.intent}" not allowed ${intentResult.allowed}`);
-      return block("Intent not allowed", {
-        intent: intentResult.intent,
-        score: intentResult.score
-      });
-    }
-
-    // -------------------------
-    // 2. PII DETECTION + MASKING
-    // -------------------------
-    const piiMatches = await detectPII(input);
-    console.log(`[PII Guard] Detected PII: ${piiMatches.length} matches found`);
-    const tokenizer = new PiiTokenizer();   // <-- SINGLE INSTANCE
-
-    const piiResult = tokenizer.mask(input, piiMatches);
-
-    console.log(`[PII Guard] Masked PII: ${piiResult.piiTypes.length} types found`);
-
-    // Attach tokenizer so response can unmask
-    req.metadata = {
-      ...req.metadata,
-      piiTokenizer: tokenizer,
-      intent: intentResult.intent,
-      score: intentResult.score,
-      piiDetected: piiMatches.length > 0,
-      piiTypes: piiResult.piiTypes,
-      maskedInput: piiResult.maskedText
-    };
-
-    // Replace input
-    req.prompt = piiResult.maskedText;
-    req.messages = [
-      {
-        role: 'user',
-        content: [{ text: piiResult.maskedText }],
-      },
-    ];
-
-    // -------------------------
-    // 3. LLM CALL
-    // -------------------------
-    const res = await next(req);
-    
-    // -------------------------
-    // 4. RESPONSE UNMASK
-    // -------------------------
-    console.log(`[PII Guard] Unmasking response if needed`);
-
-    if (tokenizer) {
-      /**
-       * RECURSIVE TRANSFORMER
-       * This will find every string in the Genkit response (no matter if it's in 
-       * candidates, message, custom, or output) and unmask it.
-       */
-      const transform = (obj: any): any => {
-        // 1. If it's a string, unmask it
-        if (typeof obj === 'string') {
-          return tokenizer.unmask(obj);
-        }
-        
-        // 2. If it's an array, transform each element
-        if (Array.isArray(obj)) {
-          return obj.map(transform);
-        }
-        
-        // 3. If it's an object, transform each value
-        if (obj !== null && typeof obj === 'object') {
-          // Note: We iterate keys and mutate the object directly 
-          // to ensure Genkit's internal references are updated.
-          for (const key of Object.keys(obj)) {
-            obj[key] = transform(obj[key]);
-          }
-          return obj;
-        }
-        
-        // 4. Return as-is for numbers/booleans/null
-        return obj;
-      };
-    
-    // ----------------------------------------------------------------------
-    // 5. Transform the entire response object in-place to unmask all strings
-    // ----------------------------------------------------------------------      
-      transform(res);
-      
-      console.log("[PII Guard] Deep unmasking complete across all candidates and custom fields.");
-    }
-    
-    // ---------------------------------------------------------
-    // 6. Return the modified response with unmasked content
-    // ---------------------------------------------------------
-
-    return res;
-
-  };
-}
-
-
-// Helper to create a blocked response
-function block(message: string, metadata?: any) {
-  return {
-    finishReason: 'blocked',
-    output: {
-      type: "error",
-      status: "BLOCKED",
-      message
-    },
-    metadata
-  };
-}

package/src/pii/detector.ts

@@ -1,47 +0,0 @@
-import { ModelSingleton } from '../util/singleton.js';
-
-const REGEX_RULES = [
-  // EMAIL (keep your existing one)
-  { type: 'EMAIL', pattern: /\b[\w\.-]+@[\w\.-]+\.\w{2,}\b/gi },
-
-  // AU MOBILE (04xx xxx xxx or +61 4xx xxx xxx)
-  { type: 'AU_MOBILE', pattern: /\b(?:\+?61|0)4\d{2}[-\s]?\d{3}[-\s]?\d{3}\b/g },
-
-  // AU LANDLINE (02, 03, 07, 08)
-  { type: 'AU_LANDLINE', pattern: /\b(?:\+?61[-\s]?)?(?:2|3|7|8)\d{1}[-\s]?\d{4}[-\s]?\d{4}\b/g },
-
-  // MEDICARE NUMBER (10 digits, often grouped 4-5-1)
-  { type: 'MEDICARE', pattern: /\b\d{4}[-\s]?\d{5}[-\s]?\d\b/g },
-
-  // TFN (9 digits)
-  { type: 'TFN', pattern: /\b\d{3}[-\s]?\d{3}[-\s]?\d{3}\b/g },
-
-  // ABN (11 digits)
-  { type: 'ABN', pattern: /\b\d{2}[-\s]?\d{3}[-\s]?\d{3}[-\s]?\d{3}\b/g },
-
-  // CREDIT CARD (keep your existing one if needed)
-  { type: 'CREDIT_CARD', pattern: /\b(?:\d[ -]*?){13,16}\b/g }
-];
-
-export async function detectPII(text: string) {
-  const ner = await ModelSingleton.getNER();
-
-  const results: { type: string; value: string }[] = [];
-
-  // ---- NER ----
-  const entities = await ner(text);
-
-  for (const e of entities) {
-    if (e.entity.includes('PER')) {
-      results.push({ type: 'NAME', value: e.word.replace('##', '') });
-    }
-  }
-
-  // ---- REGEX ----
-  for (const rule of REGEX_RULES) {
-    const matches = text.match(rule.pattern) || [];
-    matches.forEach(m => results.push({ type: rule.type, value: m }));
-  }
-
-  return results;
-}

package/src/pii/tokenizer.ts

@@ -1,46 +0,0 @@
-export type PiiResult = {
-  maskedText: string;
-  pii: Record<string, string>;
-  piiTypes: string[];
-};
-
-export class PiiTokenizer {
-  private vault = new Map<string, string>();
-  private counter = 0;
-  private piiTypes = new Set<string>();
-
-  private createToken(type: string) {
-    return `[[${type}_${this.counter++}]]`;
-  }
-
-  mask(text: string, matches: { type: string; value: string }[]): PiiResult {
-    let masked = text;
-
-    for (const match of matches) {
-      const token = this.createToken(match.type);
-
-      this.vault.set(token, match.value);
-      this.piiTypes.add(match.type.toLowerCase());
-
-      masked = masked.split(match.value).join(token);
-    }
-
-    return {
-      maskedText: masked,
-      pii: Object.fromEntries(this.vault),
-      piiTypes: Array.from(this.piiTypes)
-    };
-  }
-
-  unmask(text: string): string {
-       let result = text;
-       this.vault.forEach((value, token) => {
-         result = result.split(token).join(value); // Global replacement
-       });
-       return result;
-    }
-
-  getVault() {
-    return Object.fromEntries(this.vault);
-  }
-}

package/src/util/singleton.ts

@@ -1,51 +0,0 @@
-import { pipeline, env, type FeatureExtractionPipeline } from '@huggingface/transformers';
-import path from 'path';
-import fs from 'fs';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-env.allowRemoteModels = false; 
-env.localModelPath = path.join(__dirname, '../../models'); 
-
-export class ModelSingleton {
-  private static extractor: any = null;
-  private static classifier: any = null;
-
-  static init() {
-    // Always resolve model path relative to the client app, not the library
-    const projectRoot = process.cwd();
-    const modelPath = path.join(projectRoot, "models");
-
-    // Ensure directory exists
-    if (!fs.existsSync(modelPath)) {
-      fs.mkdirSync(modelPath, { recursive: true });
-    }
-
-    env.cacheDir = modelPath;
-    env.localModelPath = modelPath;
-
-    // Allow remote download if missing
-    env.allowRemoteModels = true;
-
-    console.log("[Guard] Using model directory:", modelPath);
-  }
-
-
-  static async getExtractor() {
-    if (!this.extractor) {
-      this.init();
-      this.extractor = await (pipeline as any)('feature-extraction', 'Xenova/all-MiniLM-L6-v2');
-    }
-    return this.extractor;
-  }
-
-  static async getNER() {
-    if (!this.classifier) {
-      this.init();
-      // Token classification model for identifying sensitive entities
-      this.classifier = await (pipeline as any)('token-classification', 'Xenova/bert-base-NER');
-    }
-    return this.classifier;
-  }
-}