bare-agent 0.46.0 → 0.46.1

package/bareagent.context.md

@@ -254,9 +254,9 @@ const { answers, costUsd, raw } = await jev.classify('I was charged twice, pleas
 // raw → the full unmodified parsed Jev response (a request id / warnings beyond answers/usage/model, if any)
 ```
 
-Three question types, kept verbatim from Jev's own contract: `noul` (binary probability `0..1`), `choice` (pick one of `criteria`'s keys, plus untrusted `probabilities`/`confidence`), `score` (a position `0..N-1` on `criteria`'s legend). Jev's reply is **untrusted model output** — `classify()` schema-checks the discriminator field against the question that asked it (`ValidationError`, stamped `lib:'bare-agent'`, on a type mismatch or an out-of-range value) before returning it; `probabilities`/`confidence` pass through unvalidated.
+Three question types, kept verbatim from Jev's own contract: `noul` (binary probability `0..1`), `choice` (pick one of `criteria`'s keys, plus untrusted `probabilities`/`confidence`), `score` (a position `0..N-1` on `criteria`'s legend). Jev's reply is **untrusted model output** — `classify()` schema-checks the discriminator field against the question that asked it (`ValidationError`, stamped `lib:'bare-agent'`, on a type mismatch or an out-of-range value) before returning it; `probabilities`/`confidence` pass through unvalidated. A question's `instructions` can be a string, or the documented TypeSafe structured forms — an array or a plain object with named parts (e.g. `question`/`inspect`/`focus`/`ignore`) — for giving a question multiple named parts; empty `{}`/`[]`/non-plain values are rejected as missing instructions.
 
-**Injection hardening is on by default.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` prepends a defensive preamble to every question's `instructions` (copy-on-write, never mutates your `questions` object) so the classifier treats `state` as data, not commands. Opt out with `harden: false` on the constructor or per call.
+**Injection hardening is on by default, and shape-aware.** `state` is untrusted and can carry an embedded attack (`"you are now…"`, `"ignore previous instructions"`); `classify()` wraps every question's `instructions` with a defensive preamble — prefixed onto a string, prepended as element 0 of an array, or added under a reserved `__hardening__` key on an object — so the classifier treats `state` as data, not commands (copy-on-write, never mutates your `questions` object; a caller-supplied `__hardening__` key is rejected so it can't overwrite the preamble). Opt out with `harden: false` on the constructor or per call.
 
 **Calibrate a tier before you trust it.** `calibrateJev` (exported from `bare-agent`, mirrors `calibrate`/judge's harness) grades a Jev model against a frozen clear-case battery (`noul`/`choice`/`score` + a false-positive trap) **and** a multi-style injection battery, admitting only if the clear-case floor clears with zero reds **and** every injection style is resisted:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bare-agent",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "files": [
     "index.js",
     "index.d.ts",

package/src/provider-jev.d.ts

@@ -21,7 +21,7 @@ export class JevProvider {
      * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
      * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
      * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-     * @param {boolean} [options.harden=true] - Prepend a defensive preamble to each question's instructions, treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+     * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
      */
     constructor(options?: {
         apiKey?: string | undefined;
@@ -54,7 +54,7 @@ export class JevProvider {
     /**
      * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
      * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
-     * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
+     * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
      * @param {object} [opts]
      * @param {string} [opts.model] - Override the model for this call.
      * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [opts.rates] - Override rates for this call.
@@ -68,7 +68,7 @@ export class JevProvider {
      */
     classify(state: string | object | any[], questions: Record<string, {
         type: "noul" | "choice" | "score";
-        instructions: string;
+        instructions: string | object | any[];
         criteria?: any;
     }>, opts?: {
         model?: string | undefined;
@@ -101,9 +101,13 @@ export class JevProvider {
      */
     _validateRequest(state: any, questions: any): void;
     /**
-     * Build a hardened COPY of `questions` (new object, new nested question objects) with
-     * {@link HARDENING_PREAMBLE} prepended to each `instructions` string. Never mutates the
-     * caller's `questions` argument or its nested objects. @param {Record<string, any>} questions @returns {Record<string, any>}
+     * Build a hardened COPY of `questions` (new object, new nested question objects, new
+     * nested instructions containers) with {@link HARDENING_PREAMBLE} woven into each
+     * `instructions`, shape-aware so a structured form is wrapped rather than stringified:
+     * a string gets the preamble prefixed, an array gets it prepended as element 0, and an
+     * object gets it added under the reserved {@link HARDENING_KEY}. Never mutates the
+     * caller's `questions` argument or its nested objects/arrays.
+     * @param {Record<string, any>} questions @returns {Record<string, any>}
      */
     _hardenQuestions(questions: Record<string, any>): Record<string, any>;
     /**

package/src/provider-jev.js

@@ -36,6 +36,9 @@ const CLASSIFY_PATH = '/v1/systemone';
 const DEFAULT_MODEL = 'jev-latest';
 const QUESTION_TYPES = new Set(['noul', 'choice', 'score']);
 const JEV_USAGE_KEYS = ['input_tokens', 'output_tokens'];
+// Reserved key hardening uses to carry the preamble on an object-shaped `instructions` — a
+// caller-supplied key of the same name would silently overwrite the preamble on spread.
+const HARDENING_KEY = '__hardening__';
 
 // Injection hardening (default on): prepended to each question's `instructions` before the
 // request is sent, so an attack embedded in `state` (untrusted) can't hijack the classifier's
@@ -73,7 +76,7 @@ class JevProvider {
    * @param {number} [options.deadlineMs] - Total call-duration deadline (ms); 0 disables (default).
    * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [options.rates] - Per-1K-token USD rates for authoritative pricing (Jev: `{ in: 0.042/1000, out: 0 }`).
    * @param {boolean} [options.exposeErrorBody=false] - Include the raw error body on a ProviderError (default off).
-   * @param {boolean} [options.harden=true] - Prepend a defensive preamble to each question's instructions, treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
+   * @param {boolean} [options.harden=true] - Wrap each question's instructions with a defensive preamble (prefixed for a string, prepended as element 0 for an array, or added under a reserved key for an object), treating `state` as untrusted data and resisting embedded role/label-override attempts. Overridable per-call via `opts.harden`.
    */
   constructor(options = {}) {
     this.apiKey = options.apiKey;
@@ -89,7 +92,7 @@ class JevProvider {
   /**
    * Classify `state` against one or more typed `questions`. See the class doc for the primitive tags.
    * @param {string|object|any[]} state - The shared input all questions judge (Jev's `state`).
-   * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string, criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
+   * @param {Record<string, {type: 'noul'|'choice'|'score', instructions: string|object|any[], criteria?: any}>} questions - Keyed questions; each judged independently against `state`.
    * @param {object} [opts]
    * @param {string} [opts.model] - Override the model for this call.
    * @param {{in: number, out: number, cacheReadMult?: number, cacheWriteMult?: number}} [opts.rates] - Override rates for this call.
@@ -139,7 +142,14 @@ class JevProvider {
       const q = questions[id];
       if (!isPlainObject(q)) throw invalid(`question "${id}" must be an object`);
       if (!QUESTION_TYPES.has(q.type)) throw invalid(`question "${id}" has invalid type`, { type: q.type });
-      if (typeof q.instructions !== 'string' || !q.instructions) throw invalid(`question "${id}" missing instructions`);
+      const ins = q.instructions;
+      const insValid = (typeof ins === 'string' && ins.length > 0) ||
+        (Array.isArray(ins) && ins.length > 0) ||
+        (isPlainObject(ins) && Object.keys(ins).length > 0);
+      if (!insValid) throw invalid(`question "${id}" missing instructions`);
+      if (isPlainObject(q.instructions) && Object.prototype.hasOwnProperty.call(q.instructions, HARDENING_KEY)) {
+        throw invalid(`question "${id}" may not use reserved instructions key`, { key: HARDENING_KEY });
+      }
       if (q.type === 'choice') {
         if (!isPlainObject(q.criteria) || Object.keys(q.criteria).length < 2) {
           throw invalid(`choice "${id}" needs a criteria object of >=2 {key: description}`);
@@ -156,16 +166,29 @@ class JevProvider {
   }
 
   /**
-   * Build a hardened COPY of `questions` (new object, new nested question objects) with
-   * {@link HARDENING_PREAMBLE} prepended to each `instructions` string. Never mutates the
-   * caller's `questions` argument or its nested objects. @param {Record<string, any>} questions @returns {Record<string, any>}
+   * Build a hardened COPY of `questions` (new object, new nested question objects, new
+   * nested instructions containers) with {@link HARDENING_PREAMBLE} woven into each
+   * `instructions`, shape-aware so a structured form is wrapped rather than stringified:
+   * a string gets the preamble prefixed, an array gets it prepended as element 0, and an
+   * object gets it added under the reserved {@link HARDENING_KEY}. Never mutates the
+   * caller's `questions` argument or its nested objects/arrays.
+   * @param {Record<string, any>} questions @returns {Record<string, any>}
    */
   _hardenQuestions(questions) {
     /** @type {Record<string, any>} */
     const hardened = {};
     for (const id of Object.keys(questions)) {
       const q = questions[id];
-      hardened[id] = { ...q, instructions: HARDENING_PREAMBLE + q.instructions };
+      const ins = q.instructions;
+      let hardenedIns;
+      if (typeof ins === 'string') {
+        hardenedIns = HARDENING_PREAMBLE + ins;
+      } else if (Array.isArray(ins)) {
+        hardenedIns = [HARDENING_PREAMBLE, ...ins];
+      } else {
+        hardenedIns = { [HARDENING_KEY]: HARDENING_PREAMBLE, ...ins };
+      }
+      hardened[id] = { ...q, instructions: hardenedIns };
     }
     return hardened;
   }