@theoremjs/agents 0.3.4-next.464.g5fc5eed → 0.3.4-next.468.ge2da06f

package/esm/src/guardrails/detect-at.js

@@ -7,7 +7,7 @@ import { actionAt, DETECTORS, detects, } from './detectors.js';
 import { boundaryNote } from './egress.js';
 import { notePattern, SYSTEM_BOUNDARY } from './egress-patterns.js';
 import { imageLeakSpans, linkLeakSpans } from './egress-urls.js';
-import { CANARY_HIT, hitFromSpan, PROMPT_ECHO_HIT } from './hits.js';
+import { CANARY_HIT, hitFromSpan, promptEchoHit } from './hits.js';
 import { injectionSpans } from './injection.js';
 import { promptEchoRanges } from './prompt-echo.js';
 import { DETECT_RULES, detectRule } from './rules.js';
@@ -122,13 +122,13 @@ function theoremSpans(detector, text, scope, skipImages = false) {
     }
     return sensitiveSpans(text, ONLY[detector]);
 }
-/** The hit for a match of `detector`. One of ours never carries what it matched. */
+/** The hit for a match of `detector`. A canary leak never carries the token. */
 function hitOf(detector, text, span) {
     const { start, end } = span;
     if (detector === 'canary_leak')
         return { ...CANARY_HIT, span: { start, end } };
     if (detector === 'prompt_leak')
-        return { ...PROMPT_ECHO_HIT, span: { start, end } };
+        return promptEchoHit(text, start, end);
     if (detector === 'tool_instructions' && span.signal) {
         const severity = span.signal === 'order' || span.signal === 'authority' ? 'medium' : 'high';
         return { ...hitFromSpan(text, span, DETECT_RULES[detector], severity), signal: span.signal };

package/esm/src/guardrails/egress.d.ts

@@ -8,7 +8,7 @@ declare const WITHHELD_REASON: {
     readonly providerToolLeak: "a provider-side tool already sent the canary or system prompt";
     readonly egress: "Turn withheld: egress disclosure violation";
 };
-/** The prompt-echo hit, when `text` repeats the guarded system prompt's own words. */
+/** A hit for each stretch of `text` that repeats the guarded system prompt's own words. */
 declare function promptEchoHits(text: string, privateSystem?: readonly string[], canary?: string): GuardrailHit[];
 /** What a prompt-leak check reads of the turn. */
 type LeakScope = Pick<GuardrailContext, 'canary' | 'canaryGiven' | 'privateSystem'>;

package/esm/src/guardrails/egress.js

@@ -1,7 +1,7 @@
 import { canaryNoteMarker, guardedEventTexts, scanTextForCanaryLeak } from './canary.js';
 import { SYSTEM_BOUNDARY } from './egress-patterns.js';
-import { CANARY_HIT, PROMPT_ECHO_HIT } from './hits.js';
-import { scanTextForPromptEcho } from './prompt-echo.js';
+import { CANARY_HIT, promptEchoHit } from './hits.js';
+import { promptEchoRanges } from './prompt-echo.js';
 import { DETECT_RULES, EGRESS_RULES } from './rules.js';
 /** Why a reply was withheld, for the builder (`errorInternal`); the user reads `error.safety`. */
 const WITHHELD_REASON = {
@@ -13,11 +13,11 @@ const WITHHELD_REASON = {
 function canaryHits(text, canary) {
     return canary && scanTextForCanaryLeak(text, canary) ? [CANARY_HIT] : [];
 }
-/** The prompt-echo hit, when `text` repeats the guarded system prompt's own words. */
+/** A hit for each stretch of `text` that repeats the guarded system prompt's own words. */
 function promptEchoHits(text, privateSystem, canary) {
-    return privateSystem && scanTextForPromptEcho(text, privateSystem, canary)
-        ? [PROMPT_ECHO_HIT]
-        : [];
+    if (!privateSystem)
+        return [];
+    return promptEchoRanges(text, privateSystem, canary).map(([start, end]) => promptEchoHit(text, start, end));
 }
 /** The system-prompt leak hits: the canary unless it was given, and the prompt's own words when guarded. */
 function promptLeakHits(text, scope) {
@@ -78,9 +78,12 @@ function eventLeak(event, scope, detect, boundary) {
         found.push([canaryAction, CANARY_HIT]);
     }
     const promptAction = detect.prompt_leak[boundary];
-    if (promptAction !== 'ignore' &&
-        texts.some((text) => promptEchoHits(text, scope.privateSystem, scope.canary).length > 0)) {
-        found.push([promptAction, PROMPT_ECHO_HIT]);
+    if (promptAction !== 'ignore') {
+        for (const text of texts) {
+            for (const hit of promptEchoHits(text, scope.privateSystem, scope.canary)) {
+                found.push([promptAction, hit]);
+            }
+        }
     }
     if (found.length === 0)
         return undefined;

package/esm/src/guardrails/hints.js

@@ -14,8 +14,11 @@ const OTHER_HINTS = {
     [EGRESS_RULES.unscannable]: 'egress.hint_unscannable',
     [EGRESS_RULES.providerToolLeak]: 'egress.hint_provider_tool_leak',
 };
-/** The rules whose match is the profile's own, and is never repeated. */
-const UNQUOTED = [DETECT_RULES.canary_leak, DETECT_RULES.prompt_leak];
+/**
+ * The rules whose match is never repeated: the canary is the profile's own secret. A prompt leak is
+ * quoted, since the model already holds the instruction it repeated and must know which passage.
+ */
+const UNQUOTED = [DETECT_RULES.canary_leak];
 /** How many matches a detector's line quotes, and how much of each. */
 const MAX_QUOTED = 3;
 const MAX_QUOTE = 120;

package/esm/src/guardrails/hits.d.ts

@@ -1,14 +1,14 @@
 import type { GuardrailEvent, GuardrailHit, Severity } from './types.js';
 /** A canary leak. Never carries the live token, only a placeholder. */
 declare const CANARY_HIT: GuardrailHit;
-/** A prompt leak. Never carries the words: they are the private system instruction's. */
-declare const PROMPT_ECHO_HIT: GuardrailHit;
 /** A guardrail hit for a span of the text, with the matched text sliced from it. */
 declare function hitFromSpan(text: string, span: {
     start: number;
     end: number;
     name?: string;
 }, rule: string, severity: Severity): GuardrailHit;
+/** A prompt leak: the stretch of `text` from `start` to `end` that repeats the private system instruction. */
+declare function promptEchoHit(text: string, start: number, end: number): GuardrailHit;
 /** `match` is the caught text itself, so hosts and traces get it only via `observability.include.guardrailMatchPreview`. */
 declare function projectGuardrailEvent(event: GuardrailEvent, includeMatch: boolean): GuardrailEvent;
-export { CANARY_HIT, hitFromSpan, PROMPT_ECHO_HIT, projectGuardrailEvent };
+export { CANARY_HIT, hitFromSpan, projectGuardrailEvent, promptEchoHit };

package/esm/src/guardrails/hits.js

@@ -5,8 +5,6 @@ const CANARY_HIT = {
     severity: 'high',
     match: '[canary]',
 };
-/** A prompt leak. Never carries the words: they are the private system instruction's. */
-const PROMPT_ECHO_HIT = { rule: DETECT_RULES.prompt_leak, severity: 'high' };
 /** A guardrail hit for a span of the text, with the matched text sliced from it. */
 function hitFromSpan(text, span, rule, severity) {
     return {
@@ -17,6 +15,10 @@ function hitFromSpan(text, span, rule, severity) {
         ...(span.name === undefined ? {} : { pattern: span.name }),
     };
 }
+/** A prompt leak: the stretch of `text` from `start` to `end` that repeats the private system instruction. */
+function promptEchoHit(text, start, end) {
+    return hitFromSpan(text, { start, end }, DETECT_RULES.prompt_leak, 'high');
+}
 /** `match` is the caught text itself, so hosts and traces get it only via `observability.include.guardrailMatchPreview`. */
 function projectGuardrailEvent(event, includeMatch) {
     if (includeMatch) {
@@ -27,4 +29,4 @@ function projectGuardrailEvent(event, includeMatch) {
         hits: event.hits.map(({ match: _match, ...hit }) => hit),
     };
 }
-export { CANARY_HIT, hitFromSpan, PROMPT_ECHO_HIT, projectGuardrailEvent };
+export { CANARY_HIT, hitFromSpan, projectGuardrailEvent, promptEchoHit };

package/esm/src/guardrails/thought-guard.js

@@ -15,7 +15,7 @@ import { boundaryNote } from './egress.js';
 import { notePattern, SYSTEM_BOUNDARY } from './egress-patterns.js';
 import { createEgressStream, loadEgressAutomata } from './egress-stream.js';
 import { imageLeakSpans, linkLeakSpans } from './egress-urls.js';
-import { CANARY_HIT, PROMPT_ECHO_HIT } from './hits.js';
+import { CANARY_HIT } from './hits.js';
 import { labelText } from './labels.js';
 import { promptEchoHoldFrom, promptEchoRanges, promptEchoScanFrom } from './prompt-echo.js';
 import { DETECT_RULES } from './rules.js';
@@ -27,6 +27,7 @@ const OMIT_KEYS = {
 const IMAGE_HIT = { rule: DETECT_RULES.ungiven_images, severity: 'high' };
 const LINK_HIT = { rule: DETECT_RULES.ungiven_links, severity: 'high' };
 const MARKER_HIT = { rule: DETECT_RULES.marker_leak, severity: 'high' };
+const PROMPT_ECHO_HIT = { rule: DETECT_RULES.prompt_leak, severity: 'high' };
 /** Where `raw`, an offset into `view.text`, stands in the thought: a placeholder's start, or with `end` its end. */
 function shownAt(view, raw, end = false) {
     let piece = view.pieces[0];

package/esm/src/kernel/engine/runner/gates.js

@@ -412,6 +412,8 @@ async function* executeSingleAttemptCycle(args) {
     // invariant: The attempt's reply spans its before_end re-entries; only a new attempt starts it again.
     state.replyText = '';
     state.replyMessages = [];
+    // invariant: The leak check's carry is the end of this attempt's reply; a retry's is read on its own.
+    state.canaryCarry = undefined;
     let latestStructured;
     for (;;) {
         state.attemptEvents = [];

package/esm/src/kernel/types.d.ts

@@ -348,7 +348,7 @@ export interface ProfileOutputsSpec {
 export interface PrivateSystemPart {
     private: string;
 }
-/** One part of a system prompt: plain text or a part kept out of traces. */
+/** One part of a system prompt: shareable text, or private text a reply may not repeat. */
 export type SystemPart = string | PrivateSystemPart;
 /**
  * A system prompt: a string, or parts sent concatenated as written. A string,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theoremjs/agents",
-  "version": "0.3.4-next.464.g5fc5eed",
+  "version": "0.3.4-next.468.ge2da06f",
   "description": "A flat TypeScript agent kernel for typed profiles, deterministic turn execution, registered tools, provider adapters, guardrails, and host-injected traces.",
   "keywords": [
     "agent",