@secure-ai/guard 0.1.0 → 0.2.0

package/dist/index.d.ts

@@ -246,6 +246,23 @@ export declare class SecureAI {
      * check would make protection opt-in at every site, which is the thing this
      * exists to stop.
      */
+    /**
+     * What to hand the wrapped function.
+     *
+     * The API omits `input` only on a block, so on any other decision it is
+     * there. The question is what to do if it is not, and the answer is not
+     * "send what the caller had".
+     *
+     * On a redact, the caller's input is the one thing that must not go: it
+     * still contains the values the decision just said to replace. Falling
+     * back to it turns a missing field into the product doing the exact
+     * opposite of its purpose, silently, with the audit trail recording a
+     * redaction that did not happen. So a redact with nothing to send throws.
+     *
+     * On an allow, nothing was rewritten and the caller's own input is the
+     * correct thing to pass, so the fallback is right there and stays.
+     */
+    private sendable;
     guard<A, R>(tool: string, fn: (input: A) => Promise<R> | R, opts?: {
         direction?: Direction;
         agent?: string;

package/dist/index.js

@@ -231,6 +231,31 @@ export class SecureAI {
      * check would make protection opt-in at every site, which is the thing this
      * exists to stop.
      */
+    /**
+     * What to hand the wrapped function.
+     *
+     * The API omits `input` only on a block, so on any other decision it is
+     * there. The question is what to do if it is not, and the answer is not
+     * "send what the caller had".
+     *
+     * On a redact, the caller's input is the one thing that must not go: it
+     * still contains the values the decision just said to replace. Falling
+     * back to it turns a missing field into the product doing the exact
+     * opposite of its purpose, silently, with the audit trail recording a
+     * redaction that did not happen. So a redact with nothing to send throws.
+     *
+     * On an allow, nothing was rewritten and the caller's own input is the
+     * correct thing to pass, so the fallback is right there and stays.
+     */
+    sendable(tool, verdict, original) {
+        if (verdict.input !== undefined)
+            return verdict.input;
+        if (verdict.decision === "redact") {
+            throw new SecureAIError(`Secure AI decided to redact ${tool} but returned nothing to send. ` +
+                `The original was not sent: it still holds the values that decision was about.`, 502, "missing_rewritten_input");
+        }
+        return original;
+    }
     guard(tool, fn, opts) {
         return async (input) => {
             let verdict;
@@ -280,11 +305,9 @@ export class SecureAI {
                 });
                 if (after.decision === "block")
                     throw new ActionBlocked(tool, after);
-                return await fn((after.input ?? input));
+                return await fn(this.sendable(tool, after, input));
             }
-            // input is present whenever the decision is not block; the fallback is
-            // belt and braces against a future field being dropped.
-            return await fn((verdict.input ?? input));
+            return await fn(this.sendable(tool, verdict, input));
         };
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secure-ai/guard",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Data loss prevention for AI agents. Inspect what an agent is about to do, before it does it.",
   "license": "MIT",
   "type": "module",