@secure-ai/guard 0.1.0 → 0.2.1

package/README.md

@@ -133,7 +133,7 @@ cause in a process already carrying too many.
 ## Also available over MCP
 
 Agents that speak MCP can reach the same controls as tools at
-`https://api.secureai.one/mcp` — `inspect_action`, `check_policy`,
+`https://secureai.one/mcp` — `inspect_action`, `check_policy`,
 `recent_activity`, plus `redact` and `restore`.
 
 Full reference: <https://secureai.one/developers>

package/dist/index.d.ts

@@ -246,6 +246,23 @@ export declare class SecureAI {
      * check would make protection opt-in at every site, which is the thing this
      * exists to stop.
      */
+    /**
+     * What to hand the wrapped function.
+     *
+     * The API omits `input` only on a block, so on any other decision it is
+     * there. The question is what to do if it is not, and the answer is not
+     * "send what the caller had".
+     *
+     * On a redact, the caller's input is the one thing that must not go: it
+     * still contains the values the decision just said to replace. Falling
+     * back to it turns a missing field into the product doing the exact
+     * opposite of its purpose, silently, with the audit trail recording a
+     * redaction that did not happen. So a redact with nothing to send throws.
+     *
+     * On an allow, nothing was rewritten and the caller's own input is the
+     * correct thing to pass, so the fallback is right there and stays.
+     */
+    private sendable;
     guard<A, R>(tool: string, fn: (input: A) => Promise<R> | R, opts?: {
         direction?: Direction;
         agent?: string;

package/dist/index.js

@@ -82,7 +82,20 @@ export class SecureAIError extends Error {
         this.code = code;
     }
 }
-const DEFAULT_BASE = "https://api.secureai.one";
+/**
+ * Where the client talks to, when nobody says otherwise.
+ *
+ * This was an api. subdomain in 0.2.0, and that host does not
+ * exist -- it was never created. Nothing caught it: the tests
+ * pass a baseUrl, the typecheck has no opinion about a string, and the
+ * package published cleanly. The first person to install the SDK and follow
+ * the README would have got ENOTFOUND on their first call.
+ *
+ * secureai.one/v1 is the address the docs have always given and it is
+ * proxied to the Worker, so this is the same endpoint the curl examples hit.
+ * Keep the two in step: docs/api.md in the web repo is the other half.
+ */
+const DEFAULT_BASE = "https://secureai.one";
 export class SecureAI {
     apiKey;
     baseUrl;
@@ -231,6 +244,31 @@ export class SecureAI {
      * check would make protection opt-in at every site, which is the thing this
      * exists to stop.
      */
+    /**
+     * What to hand the wrapped function.
+     *
+     * The API omits `input` only on a block, so on any other decision it is
+     * there. The question is what to do if it is not, and the answer is not
+     * "send what the caller had".
+     *
+     * On a redact, the caller's input is the one thing that must not go: it
+     * still contains the values the decision just said to replace. Falling
+     * back to it turns a missing field into the product doing the exact
+     * opposite of its purpose, silently, with the audit trail recording a
+     * redaction that did not happen. So a redact with nothing to send throws.
+     *
+     * On an allow, nothing was rewritten and the caller's own input is the
+     * correct thing to pass, so the fallback is right there and stays.
+     */
+    sendable(tool, verdict, original) {
+        if (verdict.input !== undefined)
+            return verdict.input;
+        if (verdict.decision === "redact") {
+            throw new SecureAIError(`Secure AI decided to redact ${tool} but returned nothing to send. ` +
+                `The original was not sent: it still holds the values that decision was about.`, 502, "missing_rewritten_input");
+        }
+        return original;
+    }
     guard(tool, fn, opts) {
         return async (input) => {
             let verdict;
@@ -280,11 +318,9 @@ export class SecureAI {
                 });
                 if (after.decision === "block")
                     throw new ActionBlocked(tool, after);
-                return await fn((after.input ?? input));
+                return await fn(this.sendable(tool, after, input));
             }
-            // input is present whenever the decision is not block; the fallback is
-            // belt and braces against a future field being dropped.
-            return await fn((verdict.input ?? input));
+            return await fn(this.sendable(tool, verdict, input));
         };
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secure-ai/guard",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Data loss prevention for AI agents. Inspect what an agent is about to do, before it does it.",
   "license": "MIT",
   "type": "module",