@theoremjs/agents 0.3.4-next.484.g20d8b9d → 0.3.4-next.522.g9e684cd

package/esm/src/guardrails/detect-at.js

@@ -1,19 +1,19 @@
 // invariant: The one place a match becomes an action. Every boundary calls `detectAt`; nothing
 // else reads the matrix to decide what a match does.
 import { applySpans, spansFromPatterns } from '../observability/spans.js';
-import { INBOUND_BOUNDARIES, recordOf, TOOL_BOUNDARIES } from './boundaries.js';
+import { recordOf, TOOL_BOUNDARIES } from './boundaries.js';
 import { canaryLeakRanges } from './canary.js';
 import { actionAt, DETECTORS, detects, } from './detectors.js';
 import { boundaryNote } from './egress.js';
 import { notePattern, SYSTEM_BOUNDARY } from './egress-patterns.js';
 import { imageLeakSpans, linkLeakSpans } from './egress-urls.js';
+import { describeError } from './error.js';
 import { CANARY_HIT, hitFromSpan, promptEchoHit } from './hits.js';
 import { injectionSpans } from './injection.js';
 import { promptEchoRanges } from './prompt-echo.js';
 import { DETECT_RULES, detectRule } from './rules.js';
 import { sensitiveSpans } from './sensitive.js';
 import { SENSITIVE_GROUPS } from './sensitive-groups.js';
-import { TheoremError } from './theorem-error.js';
 import { directives, mergedRanges } from './tool-directives.js';
 import { ownToolsWithout, toolLeakSpans } from './tool-leak.js';
 const STRENGTH = ['allow', 'flag', 'redact', 'block'];
@@ -143,18 +143,23 @@ function leavesImages(detector, boundary, detect) {
 function foundBy(find, text, boundary) {
     try {
         const spans = find(text, boundary ? { boundary } : {});
+        const outside = {
+            signal: 'find_result',
+            // labels-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+            reason: 'find returned no list of stretches inside the text',
+        };
         if (!Array.isArray(spans))
-            return 'find_result';
+            return outside;
         const inside = spans.every(({ start, end }) => Number.isInteger(start) &&
             Number.isInteger(end) &&
             start >= 0 &&
             start < end &&
             end <= text.length);
-        return inside ? spans.map(({ start, end }) => ({ start, end, kind: 'host' })) : 'find_result';
+        return inside ? spans.map(({ start, end }) => ({ start, end, kind: 'host' })) : outside;
     }
-    catch {
+    catch (err) {
         // why: A reading that failed found nothing it can vouch for, so the text does not cross.
-        return 'find_threw';
+        return { signal: 'find_threw', reason: `find threw: ${describeError(err)}` };
     }
 }
 function hostReader(host, boundary, chosen) {
@@ -169,7 +174,9 @@ function hostReader(host, boundary, chosen) {
             if (!host.find)
                 return matched;
             const found = foundBy(host.find, text, boundary);
-            return typeof found === 'string' ? found : [...matched, ...found];
+            if (!Array.isArray(found))
+                return { ...found, reason: `Host detector '${host.id}' ${found.reason}` };
+            return [...matched, ...found];
         },
         hit: (text, span) => ({ ...hitFromSpan(text, span, rule, 'high'), label: host.label }),
     };
@@ -208,32 +215,17 @@ function failedHit({ rule, label }, signal) {
         ...(signal === undefined ? {} : { signal }),
     };
 }
-/**
- * The longest single text the person or host may send, in characters: far over any model's
- * context, and under what the detectors read safely.
- */
-const MAX_INBOUND_CHARS = 1_000_000;
-const INBOUND = new Set(INBOUND_BOUNDARIES);
-/** Refuses a text the person or host sent that is over `MAX_INBOUND_CHARS`; `where` names it for the log. */
-function refuseOverlong(text, where) {
-    if (text.length <= MAX_INBOUND_CHARS)
-        return;
-    // labels-exempt: internal diagnostic; the person reads `input.too_long`
-    throw new TheoremError('input', `${where} text of ${text.length} characters is over ${MAX_INBOUND_CHARS}`, {
-        copy: { key: 'input.too_long', params: { maxChars: MAX_INBOUND_CHARS } },
-    });
-}
 /** Reads `text` as it crosses `boundary` under the profile's resolved matrix. */
 function detectAt(text, boundary, detect, scope = NO_SCOPE) {
-    if (INBOUND.has(boundary))
-        refuseOverlong(text, boundary);
     const hits = [];
     const redact = [];
+    const reasons = [];
     let action = 'allow';
     for (const reader of readersAt(boundary, detect, scope)) {
         const spans = reader.spans(text);
-        if (typeof spans === 'string') {
-            hits.push(failedHit(reader, spans));
+        if (!Array.isArray(spans)) {
+            hits.push(failedHit(reader, spans.signal));
+            reasons.push(spans.reason);
             action = 'block';
             continue;
         }
@@ -242,11 +234,13 @@ function detectAt(text, boundary, detect, scope = NO_SCOPE) {
         for (const span of spans)
             hits.push(reader.hit(text, span));
         if (reader.chosen === 'redact')
-            redact.push(...spans);
+            for (const span of spans)
+                redact.push(span);
         action = stronger(action, reader.chosen);
     }
-    if (action === 'block')
-        return { action, hits };
+    if (action === 'block') {
+        return { action, hits, ...(reasons.length ? { errorInternal: reasons.join('\n') } : {}) };
+    }
     if (redact.length === 0)
         return { action, text, hits };
     const replaced = applySpans(text, redact);
@@ -264,7 +258,7 @@ function leftAfterRedact(replaced, boundary, detect, scope, detectors) {
         if (chosen === 'flag')
             return false;
         const left = spans(replaced);
-        return !left || left.length > 0;
+        return !Array.isArray(left) || left.length > 0;
     });
 }
 /** The detectors that read `boundary`: every one not set to `ignore`. */
@@ -298,16 +292,21 @@ function detectReads(boundaries, detect, scope) {
  */
 function detectRelease(window, { from, to, settled }, boundary, detect, { detectors, scope }) {
     const failed = [];
+    const reasons = [];
     const found = readersAt(boundary, detect, scope, detectors).flatMap((reader) => {
         const spans = reader.spans(window);
-        if (typeof spans === 'string')
-            failed.push(failedHit(reader, spans));
-        return (typeof spans === 'string' ? [] : spans)
+        if (!Array.isArray(spans)) {
+            failed.push(failedHit(reader, spans.signal));
+            reasons.push(spans.reason);
+            return [];
+        }
+        return spans
             .filter((span) => span.end > from && span.start < to)
             .map((span) => ({ span, rule: reader.rule, label: reader.label, chosen: reader.chosen }));
     });
-    if (failed.length > 0)
-        return { action: 'block', hits: failed, taken: 0 };
+    if (failed.length > 0) {
+        return { action: 'block', hits: failed, taken: 0, errorInternal: reasons.join('\n') };
+    }
     const hitOf = ({ span, rule, label }) => ({
         ...hitFromSpan(window, span, rule, 'high'),
         ...(label === undefined ? {} : { label }),
@@ -370,23 +369,31 @@ function storedHostSpans(text, detect) {
         if (!host.find || !text)
             return matched;
         const found = foundBy(host.find, text);
-        return typeof found === 'string'
-            ? [{ start: 0, end: text.length, kind: 'host' }]
-            : [...matched, ...found];
+        return Array.isArray(found)
+            ? [...matched, ...found]
+            : [{ start: 0, end: text.length, kind: 'host' }];
     });
 }
 /** A reader for everything crossing `boundary` in one request. */
 function boundaryReader(boundary, detect) {
     const hits = [];
+    const reasons = [];
     let action = 'allow';
     return {
         read(text) {
             const detected = detectAt(text, boundary, detect);
-            hits.push(...detected.hits);
+            for (const hit of detected.hits)
+                hits.push(hit);
+            if (detected.errorInternal)
+                reasons.push(detected.errorInternal);
             action = stronger(action, detected.action);
             return detected.text ?? '';
         },
-        found: () => ({ action, hits }),
+        found: () => ({
+            action,
+            hits,
+            ...(reasons.length ? { errorInternal: reasons.join('\n') } : {}),
+        }),
     };
 }
 const TOOL_STAGE = Object.fromEntries(TOOL_BOUNDARIES.map((boundary) => [
@@ -429,6 +436,9 @@ function detectEvent(boundary, found, provenance, stage = BOUNDARY_STAGE[boundar
         action: found.action,
         hits: found.hits,
         ...(provenance ? { provenance } : {}),
+        ...(found.action === 'block' && found.errorInternal
+            ? { errorInternal: found.errorInternal }
+            : {}),
     };
 }
-export { boundaryReader, detectAt, detectEvent, detectorsAt, detectReads, detectRelease, hostAt, isScoped, leakScopeOf, redactDetectors, refuseOverlong, scopeOf, storedHostSpans, storedSpans, stronger, };
+export { boundaryReader, detectAt, detectEvent, detectorsAt, detectReads, detectRelease, hostAt, isScoped, leakScopeOf, redactDetectors, scopeOf, storedHostSpans, storedSpans, stronger, };

package/esm/src/guardrails/detect-reply.d.ts

@@ -26,7 +26,7 @@ interface ReplyRead {
     blocked?: GuardrailHit[];
 }
 /** A JSON value read at `boundary`, with each match in a string replaced, or what stops it crossing. */
-declare function readValue(value: unknown, boundary: Boundary, detect: ResolvedDetect, scope?: DetectScope): Pick<Detection, 'action' | 'hits'> & {
+declare function readValue(value: unknown, boundary: Boundary, detect: ResolvedDetect, scope?: DetectScope): Pick<Detection, 'action' | 'hits' | 'errorInternal'> & {
     value?: unknown;
 };
 /**

package/esm/src/guardrails/detect-reply.js

@@ -23,8 +23,10 @@ function readValue(value, boundary, detect, scope = {}) {
         return { action: 'block', hits: [{ rule: EGRESS_RULES.unscannable, severity: 'high' }] };
     }
     const found = detectAt(scan.text, boundary, detect, scope);
-    if (found.action !== 'redact')
-        return { action: found.action, hits: found.hits, value };
+    if (found.action !== 'redact') {
+        const why = found.errorInternal ? { errorInternal: found.errorInternal } : {};
+        return { action: found.action, hits: found.hits, value, ...why };
+    }
     const redacted = mapStrings(value, (leaf) => detectAt(leaf, boundary, detect, scope).text ?? '');
     const left = detectAt(textForScan(redacted).text, boundary, detect, scope).action;
     // why: A match in a key, or one that runs across values, has no string to replace: it does not cross.