@o-lang/olang 1.2.11 → 1.2.13

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@o-lang/olang",
-  "version": "1.2.11",
+  "version": "1.2.13",
   "author": "Olalekan Ogundipe <info@workfily.com>",
   "description": "O-Lang: A governance language for user-directed, rule-enforced agent workflows",
-  "main": "./src/index.js",
+  "main": "./src/runtime/index.js",
   "bin": {
     "olang": "./cli/olang.js"
   },

package/src/runtime/RuntimeAPI.js

@@ -467,7 +467,7 @@ _validateLLMOutput(output, actionContext) {
     { pattern: /\b(successful(?:ly)?|confirmed|approved|completed|processed|accepted|verified|imethibitishwa|imefanikiwa|amthibitishwa|ti\s+da|ti\s+ṣe|gụnyere|kimefanyika|yamekamilika)\b/i, capability: 'deceptive_claim', lang: 'multi' }
   ];
 
-  // 🔍 SCAN OUTPUT FOR FORBIDDEN INTENTS
+  // 🔍 SCAN OUTPUT FOR FORBIDDEN INTENTS (financial/PII/fake confirmations)
   for (const { pattern, capability, lang } of forbiddenPatterns) {
     if (pattern.test(output)) {
       // ✅ Only block if capability NOT in workflow allowlist
@@ -492,6 +492,40 @@ _validateLLMOutput(output, actionContext) {
     }
   }
 
+  // ✅ NEW: SEMANTIC INTENT DRIFT DETECTION (BACKWARD-COMPATIBLE)
+  const intent = this.context.__verified_intent;
+  if (intent) {
+    // Check prohibited topics
+    if (intent.prohibited_topics && Array.isArray(intent.prohibited_topics)) {
+      const lower = output.toLowerCase();
+      for (const topic of intent.prohibited_topics) {
+        if (lower.includes(topic.toLowerCase())) {
+          return {
+            passed: false,
+            reason: `Resolver output violates prohibited topic "${topic}" defined in __verified_intent`,
+            detected: topic,
+            language: 'multi'
+          };
+        }
+      }
+    }
+
+    // Check prohibited actions
+    if (intent.prohibited_actions && Array.isArray(intent.prohibited_actions)) {
+      const lower = output.toLowerCase();
+      for (const action of intent.prohibited_actions) {
+        if (lower.includes(action.toLowerCase())) {
+          return {
+            passed: false,
+            reason: `Resolver output violates prohibited action "${action}" defined in __verified_intent`,
+            detected: action,
+            language: 'multi'
+          };
+        }
+      }
+    }
+  }
+
   return { passed: true };
 }
   // -----------------------------
@@ -1170,7 +1204,17 @@ const isLLMAction = action.toLowerCase().includes('groq') ||
       ...inputs, 
       workflow_name: workflow.name 
     };
-    
+
+     // Optional strict mode: enforce resolver-originated inputs
+  if (process.env.OLANG_STRICT_INPUTS === 'true') {
+    if (!inputs.__resolver_origin) {
+      throw new Error(
+        '[O-Lang SAFETY] Inputs must originate from a certified resolver. ' +
+        'Use @o-lang/input-validator to validate external data.'
+      );
+    }
+  }
+   
     const currentGeneration = inputs.__generation || 1;
     if (workflow.maxGenerations !== null && currentGeneration > workflow.maxGenerations) {
       throw new Error(`Workflow generation ${currentGeneration} exceeds Constraint: max_generations = ${workflow.maxGenerations}`);