burrow-sdk 0.5.0

package/dist/integrations/adk.js

@@ -0,0 +1,323 @@
+/**
+ * Burrow adapter for Google Agent Development Kit (ADK).
+ *
+ * Provides model-level callbacks (before/after) and tool-level callbacks
+ * (before_tool/after_tool) that scan through Burrow for prompt injection.
+ *
+ * Model callbacks see full LLM requests/responses. Tool callbacks see
+ * individual tool calls with `toolName` and `toolArgs`, enabling more
+ * precise scanning.
+ *
+ * Usage (model-level):
+ *
+ * ```ts
+ * import { BurrowGuard } from "burrow-sdk";
+ * import { createBurrowCallback } from "burrow-sdk/integrations/adk";
+ *
+ * const guard = new BurrowGuard({ clientId: "...", clientSecret: "..." });
+ * const callback = createBurrowCallback(guard);
+ *
+ * const agent = new Agent({
+ *   model: "gemini-2.0-flash",
+ *   beforeModelCallback: callback,
+ * });
+ * ```
+ *
+ * Usage (tool-level, V2):
+ *
+ * ```ts
+ * import {
+ *   createBurrowCallbackV2,
+ *   createBurrowAfterCallbackV2,
+ *   createBurrowToolCallbackV2,
+ *   createBurrowAfterToolCallbackV2,
+ * } from "burrow-sdk/integrations/adk";
+ *
+ * const agent = new Agent({
+ *   model: "gemini-2.0-flash",
+ *   beforeModelCallback: createBurrowCallbackV2(guard),
+ *   afterModelCallback: createBurrowAfterCallbackV2(guard),
+ *   beforeToolCallback: createBurrowToolCallbackV2(guard),
+ *   afterToolCallback: createBurrowAfterToolCallbackV2(guard),
+ * });
+ * ```
+ */
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Known text-bearing keys to extract from tool arguments. */
+const KNOWN_TEXT_KEYS = ["command", "content", "query", "text", "url", "file_path", "pattern"];
+/**
+ * Extract scannable text from tool arguments.
+ * Prioritizes known text-bearing fields, falls back to JSON serialization.
+ */
+function extractToolArgsText(toolArgs) {
+    const parts = [];
+    for (const key of KNOWN_TEXT_KEYS) {
+        if (key in toolArgs && toolArgs[key] != null) {
+            parts.push(String(toolArgs[key]));
+        }
+    }
+    return parts.length > 0 ? parts.join(" ").trim() : JSON.stringify(toolArgs);
+}
+/**
+ * Extract text from the last content entry's parts in an LLM request.
+ */
+function extractRequestText(llmRequest) {
+    if (!llmRequest.contents || llmRequest.contents.length === 0) {
+        return "";
+    }
+    const lastContent = llmRequest.contents[llmRequest.contents.length - 1];
+    if (!lastContent.parts || lastContent.parts.length === 0) {
+        return "";
+    }
+    const parts = [];
+    for (const part of lastContent.parts) {
+        if (part.text) {
+            parts.push(part.text);
+        }
+    }
+    return parts.join(" ").trim();
+}
+/**
+ * Extract text from an LLM response's content parts.
+ */
+function extractResponseText(llmResponse) {
+    if (!llmResponse.content || !llmResponse.content.parts) {
+        return "";
+    }
+    const parts = [];
+    for (const part of llmResponse.content.parts) {
+        if (part.text) {
+            parts.push(part.text);
+        }
+    }
+    return parts.join(" ").trim();
+}
+function shouldBlock(result, blockOnWarn) {
+    return result.action === "block" || (blockOnWarn && result.action === "warn");
+}
+/**
+ * Build a blocked LlmResponse with the given message text.
+ */
+function blockedResponse(message) {
+    return {
+        content: {
+            role: "model",
+            parts: [{ text: message }],
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// V1 — model callbacks with explicit agent name
+// ---------------------------------------------------------------------------
+/**
+ * Create a Google ADK `before_model_callback` that scans with Burrow.
+ *
+ * When injection is detected, returns an `LlmResponse`-shaped object that
+ * blocks the original request and informs the user.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - Callback options (agentName, blockOnWarn).
+ * @returns A callback compatible with ADK's `before_model_callback`.
+ */
+export function createBurrowCallback(guard, options = {}) {
+    const agentName = options.agentName ?? "adk";
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (_callbackContext, llmRequest) => {
+        const text = extractRequestText(llmRequest);
+        if (!text)
+            return null;
+        const result = await guard.scan(text, {
+            contentType: "user_prompt",
+            agent: agentName,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return blockedResponse(`[Blocked by Burrow: ${result.category} ` +
+                `(${Math.round(result.confidence * 100)}% confidence). ` +
+                `This message was flagged as a potential ` +
+                `prompt injection and was not processed.]`);
+        }
+        return null;
+    };
+}
+/**
+ * Create a Google ADK `after_model_callback` that scans LLM responses.
+ *
+ * Checks if the model's response contains injection-like content
+ * that might have been triggered by indirect injection in tool outputs.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - Callback options (agentName, blockOnWarn).
+ * @returns A callback compatible with ADK's `after_model_callback`.
+ */
+export function createBurrowAfterCallback(guard, options = {}) {
+    const agentName = options.agentName ?? "adk";
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (_callbackContext, llmResponse) => {
+        const text = extractResponseText(llmResponse);
+        if (!text)
+            return null;
+        const result = await guard.scan(text, {
+            contentType: "tool_response",
+            agent: agentName,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return blockedResponse(`[Blocked by Burrow: Model response contained ` +
+                `suspected injection content (${result.category}). ` +
+                `Response was not delivered.]`);
+        }
+        return null;
+    };
+}
+// ---------------------------------------------------------------------------
+// V2 — model callbacks with per-agent identity from callback context
+// ---------------------------------------------------------------------------
+/**
+ * Create a Google ADK `before_model_callback` with per-agent identity.
+ *
+ * Each `LlmAgent` has its own callback slots, so the callback reads the
+ * agent name from `callbackContext.agent_name` to produce agent identifiers
+ * like `adk:research-agent`.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - V2 callback options (blockOnWarn).
+ * @returns A callback compatible with ADK's `before_model_callback`.
+ */
+export function createBurrowCallbackV2(guard, options = {}) {
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (callbackContext, llmRequest) => {
+        const text = extractRequestText(llmRequest);
+        if (!text)
+            return null;
+        const agentLabel = callbackContext.agent_name
+            ? `adk:${callbackContext.agent_name}`
+            : "adk";
+        const result = await guard.scan(text, {
+            contentType: "user_prompt",
+            agent: agentLabel,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return blockedResponse(`[Blocked by Burrow: ${result.category} ` +
+                `(${Math.round(result.confidence * 100)}% confidence). ` +
+                `This message was flagged as a potential ` +
+                `prompt injection and was not processed.]`);
+        }
+        return null;
+    };
+}
+/**
+ * Create a Google ADK `after_model_callback` with per-agent identity.
+ *
+ * Reads the agent name from `callbackContext.agent_name`.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - V2 callback options (blockOnWarn).
+ * @returns A callback compatible with ADK's `after_model_callback`.
+ */
+export function createBurrowAfterCallbackV2(guard, options = {}) {
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (callbackContext, llmResponse) => {
+        const text = extractResponseText(llmResponse);
+        if (!text)
+            return null;
+        const agentLabel = callbackContext.agent_name
+            ? `adk:${callbackContext.agent_name}`
+            : "adk";
+        const result = await guard.scan(text, {
+            contentType: "tool_response",
+            agent: agentLabel,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return blockedResponse(`[Blocked by Burrow: Model response contained ` +
+                `suspected injection content (${result.category}). ` +
+                `Response was not delivered.]`);
+        }
+        return null;
+    };
+}
+// ---------------------------------------------------------------------------
+// V2 — tool callbacks with per-agent identity
+// ---------------------------------------------------------------------------
+/**
+ * Create a Google ADK `before_tool_callback` with per-agent identity.
+ *
+ * Scans individual tool calls before execution, with access to the tool
+ * name and arguments. Reads `callbackContext.agent_name` for per-agent
+ * identity like `adk:research-agent`.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - V2 callback options (blockOnWarn).
+ * @returns A callback compatible with ADK's `before_tool_callback`.
+ *   Returns a dict to replace the tool result on block, or `null` to allow.
+ */
+export function createBurrowToolCallbackV2(guard, options = {}) {
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (callbackContext, toolName, toolArgs) => {
+        let text = "";
+        if (typeof toolArgs === "object" && toolArgs !== null) {
+            text = extractToolArgsText(toolArgs);
+        }
+        else if (typeof toolArgs === "string") {
+            text = toolArgs;
+        }
+        text = text.trim();
+        if (!text)
+            return null;
+        const agentLabel = callbackContext.agent_name
+            ? `adk:${callbackContext.agent_name}`
+            : "adk";
+        const result = await guard.scan(text, {
+            contentType: "tool_call",
+            agent: agentLabel,
+            toolName,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return {
+                status: "error",
+                message: `[Blocked by Burrow: ${result.category} ` +
+                    `(${Math.round(result.confidence * 100)}% confidence). ` +
+                    `Tool call was not executed.]`,
+            };
+        }
+        return null;
+    };
+}
+/**
+ * Create a Google ADK `after_tool_callback` with per-agent identity.
+ *
+ * Scans tool responses after execution for indirect injection.
+ * Reads `callbackContext.agent_name` for per-agent identity.
+ *
+ * @param guard - BurrowGuard instance.
+ * @param options - V2 callback options (blockOnWarn).
+ * @returns A callback compatible with ADK's `after_tool_callback`.
+ *   Returns a dict to replace the tool result on block, or `null` to allow.
+ */
+export function createBurrowAfterToolCallbackV2(guard, options = {}) {
+    const blockOnWarn = options.blockOnWarn ?? false;
+    return async (callbackContext, toolName, toolResponse) => {
+        const raw = toolResponse ? String(toolResponse) : "";
+        const text = raw.slice(0, 4096).trim();
+        if (!text)
+            return null;
+        const agentLabel = callbackContext.agent_name
+            ? `adk:${callbackContext.agent_name}`
+            : "adk";
+        const result = await guard.scan(text, {
+            contentType: "tool_response",
+            agent: agentLabel,
+            toolName,
+        });
+        if (shouldBlock(result, blockOnWarn)) {
+            return {
+                status: "error",
+                message: `[Blocked by Burrow: Tool output from '${toolName}' was flagged: ` +
+                    `${result.category} (${Math.round(result.confidence * 100)}% confidence). ` +
+                    `Treat with caution.]`,
+            };
+        }
+        return null;
+    };
+}
+//# sourceMappingURL=adk.js.map

package/dist/integrations/adk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adk.js","sourceRoot":"","sources":["../../src/integrations/adk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAgDH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;AAE/F;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAiC;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,UAAyB;IACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,WAA2B;IACtD,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,WAAoB;IAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO;QACL,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAkB,EAClB,UAAoC,EAAE;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,gBAAoC,EACpC,UAAyB,EACO,EAAE;QAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,eAAe,CACpB,uBAAuB,MAAM,CAAC,QAAQ,GAAG;gBACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,iBAAiB;gBACxD,0CAA0C;gBAC1C,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAkB,EAClB,UAAoC,EAAE;IAEtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,gBAAoC,EACpC,WAA2B,EACK,EAAE;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,eAAe;YAC5B,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,eAAe,CACpB,+CAA+C;gBAC/C,gCAAgC,MAAM,CAAC,QAAQ,KAAK;gBACpD,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,eAAmC,EACnC,UAAyB,EACO,EAAE;QAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU;YAC3C,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,EAAE;YACrC,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,eAAe,CACpB,uBAAuB,MAAM,CAAC,QAAQ,GAAG;gBACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,iBAAiB;gBACxD,0CAA0C;gBAC1C,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,eAAmC,EACnC,WAA2B,EACK,EAAE;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU;YAC3C,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,EAAE;YACrC,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,eAAe;YAC5B,KAAK,EAAE,UAAU;SAClB,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,eAAe,CACpB,+CAA+C;gBAC/C,gCAAgC,MAAM,CAAC,QAAQ,KAAK;gBACpD,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,eAAmC,EACnC,QAAgB,EAChB,QAAiC,EACQ,EAAE;QAC3C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,GAAG,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU;YAC3C,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,EAAE;YACrC,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,WAAW;YACxB,KAAK,EAAE,UAAU;YACjB,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,OAAO,EACL,uBAAuB,MAAM,CAAC,QAAQ,GAAG;oBACzC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,iBAAiB;oBACxD,8BAA8B;aACjC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,+BAA+B,CAC7C,KAAkB,EAClB,UAAsC,EAAE;IAExC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IAEjD,OAAO,KAAK,EACV,eAAmC,EACnC,QAAgB,EAChB,YAAqC,EACI,EAAE;QAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU;YAC3C,CAAC,CAAC,OAAO,eAAe,CAAC,UAAU,EAAE;YACrC,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACpC,WAAW,EAAE,eAAe;YAC5B,KAAK,EAAE,UAAU;YACjB,QAAQ;SACT,CAAC,CAAC;QAEH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,OAAO,EACL,yCAAyC,QAAQ,iBAAiB;oBAClE,GAAG,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,iBAAiB;oBAC3E,sBAAsB;aACzB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/integrations/ai-sdk.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Burrow adapter for the Vercel AI SDK.
+ *
+ * Provides a LanguageModelV3Middleware that scans prompts before they
+ * reach the model and optionally scans responses after generation.
+ *
+ * @example
+ * ```ts
+ * import { BurrowGuard } from "burrow-sdk";
+ * import { createBurrowMiddleware } from "burrow-sdk/integrations/ai-sdk";
+ * import { wrapLanguageModel } from "ai";
+ * import { openai } from "@ai-sdk/openai";
+ *
+ * const guard = new BurrowGuard({ clientId: "...", clientSecret: "..." });
+ * const middleware = createBurrowMiddleware(guard);
+ *
+ * const model = wrapLanguageModel({
+ *   model: openai("gpt-4"),
+ *   middleware,
+ * });
+ * ```
+ */
+import type { BurrowGuard } from "../index.js";
+import type { ScanResult } from "../types.js";
+/** Thrown when Burrow blocks an AI SDK request. */
+export declare class BurrowBlockedError extends Error {
+    readonly result: ScanResult;
+    constructor(result: ScanResult);
+}
+export interface BurrowMiddlewareOptions {
+    /** Agent name for scan context. */
+    agent?: string;
+    /** If true, also block on "warn" verdicts. */
+    blockOnWarn?: boolean;
+    /** If true, scan model responses for indirect injection. */
+    scanResponses?: boolean;
+}
+/**
+ * Create a Vercel AI SDK middleware that scans prompts with Burrow.
+ *
+ * The returned object conforms to the `LanguageModelV3Middleware` interface
+ * from `@ai-sdk/provider`. It uses:
+ * - `transformParams` to scan user input before the model call
+ * - `wrapGenerate` to optionally scan the model response
+ *
+ * This is framework-agnostic and does not import `ai` or `@ai-sdk/provider`
+ * directly — only the type shapes are relied upon.
+ */
+export declare function createBurrowMiddleware(guard: BurrowGuard, options?: BurrowMiddlewareOptions): {
+    /**
+     * Scan the prompt before it reaches the model.
+     */
+    transformParams: ({ params, }: {
+        type: string;
+        params: Record<string, unknown>;
+        model: unknown;
+    }) => Promise<Record<string, unknown>>;
+    /**
+     * Optionally scan the generated response.
+     */
+    wrapGenerate: (({ doGenerate, }: {
+        doGenerate: () => Promise<{
+            text?: string;
+            [key: string]: unknown;
+        }>;
+    }) => Promise<{
+        [key: string]: unknown;
+        text?: string;
+    }>) | undefined;
+};
+//# sourceMappingURL=ai-sdk.d.ts.map

package/dist/integrations/ai-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sdk.d.ts","sourceRoot":"","sources":["../../src/integrations/ai-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,mDAAmD;AACnD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,MAAM,EAAE,UAAU,CAAC;gBAEvB,MAAM,EAAE,UAAU;CAO/B;AAED,MAAM,WAAW,uBAAuB;IACtC,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAiCD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,uBAA4B;IAOnC;;OAEG;mCAGA;QACD,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,KAAK,EAAE,OAAO,CAAC;KAChB;IAcD;;OAEG;qCAII;QACD,UAAU,EAAE,MAAM,OAAO,CAAC;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;KACtE;;eADoC,MAAM;;EAgBlD"}

package/dist/integrations/ai-sdk.js

@@ -0,0 +1,115 @@
+/**
+ * Burrow adapter for the Vercel AI SDK.
+ *
+ * Provides a LanguageModelV3Middleware that scans prompts before they
+ * reach the model and optionally scans responses after generation.
+ *
+ * @example
+ * ```ts
+ * import { BurrowGuard } from "burrow-sdk";
+ * import { createBurrowMiddleware } from "burrow-sdk/integrations/ai-sdk";
+ * import { wrapLanguageModel } from "ai";
+ * import { openai } from "@ai-sdk/openai";
+ *
+ * const guard = new BurrowGuard({ clientId: "...", clientSecret: "..." });
+ * const middleware = createBurrowMiddleware(guard);
+ *
+ * const model = wrapLanguageModel({
+ *   model: openai("gpt-4"),
+ *   middleware,
+ * });
+ * ```
+ */
+/** Thrown when Burrow blocks an AI SDK request. */
+export class BurrowBlockedError extends Error {
+    result;
+    constructor(result) {
+        super(`Burrow blocked request: ${result.category} (${Math.round(result.confidence * 100)}% confidence)`);
+        this.name = "BurrowBlockedError";
+        this.result = result;
+    }
+}
+/**
+ * Extract user-facing text from AI SDK prompt messages.
+ */
+function extractPromptText(params) {
+    const prompt = params.prompt;
+    if (!prompt || !Array.isArray(prompt))
+        return "";
+    const parts = [];
+    for (const msg of prompt) {
+        if (typeof msg !== "object" || msg === null)
+            continue;
+        const role = msg.role;
+        const content = msg.content;
+        if (role === "user" || role === "system") {
+            if (typeof content === "string") {
+                parts.push(content);
+            }
+            else if (Array.isArray(content)) {
+                for (const part of content) {
+                    if (typeof part === "object" && part !== null && "text" in part) {
+                        parts.push(String(part.text));
+                    }
+                }
+            }
+        }
+    }
+    return parts.join(" ").trim();
+}
+function shouldBlock(result, blockOnWarn) {
+    return result.action === "block" || (blockOnWarn && result.action === "warn");
+}
+/**
+ * Create a Vercel AI SDK middleware that scans prompts with Burrow.
+ *
+ * The returned object conforms to the `LanguageModelV3Middleware` interface
+ * from `@ai-sdk/provider`. It uses:
+ * - `transformParams` to scan user input before the model call
+ * - `wrapGenerate` to optionally scan the model response
+ *
+ * This is framework-agnostic and does not import `ai` or `@ai-sdk/provider`
+ * directly — only the type shapes are relied upon.
+ */
+export function createBurrowMiddleware(guard, options = {}) {
+    const agent = options.agent ?? "ai-sdk";
+    const blockOnWarn = options.blockOnWarn ?? false;
+    const scanResponses = options.scanResponses ?? false;
+    return {
+        /**
+         * Scan the prompt before it reaches the model.
+         */
+        transformParams: async ({ params, }) => {
+            const text = extractPromptText(params);
+            if (text) {
+                const result = await guard.scan(text, {
+                    contentType: "user_prompt",
+                    agent,
+                });
+                if (shouldBlock(result, blockOnWarn)) {
+                    throw new BurrowBlockedError(result);
+                }
+            }
+            return params;
+        },
+        /**
+         * Optionally scan the generated response.
+         */
+        wrapGenerate: scanResponses
+            ? async ({ doGenerate, }) => {
+                const generated = await doGenerate();
+                if (generated.text && generated.text.trim()) {
+                    const result = await guard.scan(generated.text, {
+                        contentType: "tool_response",
+                        agent,
+                    });
+                    if (shouldBlock(result, blockOnWarn)) {
+                        throw new BurrowBlockedError(result);
+                    }
+                }
+                return generated;
+            }
+            : undefined,
+    };
+}
+//# sourceMappingURL=ai-sdk.js.map

package/dist/integrations/ai-sdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-sdk.js","sourceRoot":"","sources":["../../src/integrations/ai-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,mDAAmD;AACnD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3B,MAAM,CAAa;IAEnC,YAAY,MAAkB;QAC5B,KAAK,CACH,2BAA2B,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,eAAe,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAWD;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAA4B;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QACtD,MAAM,IAAI,GAAI,GAA+B,CAAC,IAAI,CAAC;QACnD,MAAM,OAAO,GAAI,GAA+B,CAAC,OAAO,CAAC;QACzD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;oBAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;wBAChE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC7D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,WAAoB;IAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,UAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IAErD,OAAO;QACL;;WAEG;QACH,eAAe,EAAE,KAAK,EAAE,EACtB,MAAM,GAKP,EAAE,EAAE;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;oBACpC,WAAW,EAAE,aAAa;oBAC1B,KAAK;iBACN,CAAC,CAAC;gBACH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;WAEG;QACH,YAAY,EAAE,aAAa;YACzB,CAAC,CAAC,KAAK,EAAE,EACL,UAAU,GAGX,EAAE,EAAE;gBACH,MAAM,SAAS,GAAG,MAAM,UAAU,EAAE,CAAC;gBACrC,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;wBAC9C,WAAW,EAAE,eAAe;wBAC5B,KAAK;qBACN,CAAC,CAAC;oBACH,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;wBACrC,MAAM,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC"}

package/dist/integrations/claude-sdk.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Burrow adapter for the Anthropic Claude Agent SDK (TypeScript).
+ *
+ * Provides hook callbacks for PreToolUse and PostToolUse events that scan
+ * tool inputs/outputs through Burrow for prompt injection detection.
+ *
+ * @example
+ * ```ts
+ * import { BurrowGuard } from "burrow-sdk";
+ * import { createBurrowHooks } from "burrow-sdk/integrations/claude-sdk";
+ * import { query } from "@anthropic-ai/claude-agent-sdk";
+ *
+ * const guard = new BurrowGuard({ clientId: "...", clientSecret: "..." });
+ * const hooks = createBurrowHooks(guard);
+ *
+ * for await (const message of query({
+ *   prompt: "Your prompt",
+ *   options: { hooks },
+ * })) {
+ *   console.log(message);
+ * }
+ * ```
+ */
+import type { BurrowGuard } from "../index.js";
+import type { ScanResult } from "../types.js";
+/** Thrown when Burrow blocks a Claude SDK tool call. */
+export declare class BurrowBlockedError extends Error {
+    readonly result: ScanResult;
+    constructor(result: ScanResult);
+}
+export interface BurrowHooksOptions {
+    /** Agent name for scan context. */
+    agentName?: string;
+    /** If true, also block on "warn" verdicts. */
+    blockOnWarn?: boolean;
+    /** Scan tool inputs before execution. Default: true. */
+    scanToolCalls?: boolean;
+    /** Scan tool outputs after execution. Default: true. */
+    scanToolResults?: boolean;
+}
+/**
+ * Hook input shapes as used by the Claude Agent SDK.
+ * These are defined locally to avoid requiring the SDK as a dependency.
+ */
+interface HookInput {
+    hook_event_name: string;
+    tool_name?: string;
+    tool_input?: Record<string, unknown>;
+}
+type HookCallback = (input: HookInput, toolUseId: string, context: {
+    signal?: AbortSignal;
+}) => Promise<Record<string, unknown>>;
+interface HookMatcher {
+    matcher: string;
+    hooks: HookCallback[];
+}
+/**
+ * Create Claude Agent SDK hooks that scan tool calls with Burrow.
+ *
+ * Returns a hooks configuration object compatible with the `query()` function
+ * from `@anthropic-ai/claude-agent-sdk`. The hooks intercept PreToolUse
+ * and PostToolUse events to scan for prompt injection.
+ *
+ * **Per-agent identity limitation:** The Claude Agent SDK hook context does
+ * not currently carry agent identity. For multi-agent setups, create
+ * separate hooks with different `agentName` values:
+ *
+ * ```ts
+ * const orchestratorHooks = createBurrowHooks(guard, { agentName: "claude-sdk:orchestrator" });
+ * const researcherHooks = createBurrowHooks(guard, { agentName: "claude-sdk:researcher" });
+ * ```
+ */
+export declare function createBurrowHooks(guard: BurrowGuard, options?: BurrowHooksOptions): Record<string, HookMatcher[]>;
+export {};
+//# sourceMappingURL=claude-sdk.d.ts.map

package/dist/integrations/claude-sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-sdk.d.ts","sourceRoot":"","sources":["../../src/integrations/claude-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,wDAAwD;AACxD,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,MAAM,EAAE,UAAU,CAAC;gBAEvB,MAAM,EAAE,UAAU;CAO/B;AAED,MAAM,WAAW,kBAAkB;IACjC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wDAAwD;IACxD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,UAAU,SAAS;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,KAAK,YAAY,GAAG,CAClB,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,EAAE,CAAC;CACvB;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,kBAAuB,GAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2E/B"}