llm-output-guard 1.11.3 → 1.12.0

package/README.md

@@ -276,7 +276,7 @@ because only one of those is evidence.
 
 - **Zero runtime dependencies**, enforced in CI. Node ≥ 18; works on edge, browser, Deno, Bun.
 - **The size claim is a budget, not a memory.** `npm run size` bundles each entry, minifies and gzips it, and fails over budget — enforced in CI beside the zero-dependency check, because a number in prose is the cheapest thing in a repo to go stale.
-- **Types resolve on old and new TypeScript alike.** Every subpath is listed in `typesVersions` as well as `exports`, so `moduleResolution: "node"` — still the default under `module: commonjs` — sees the adapters instead of only the root.
+- **Types resolve on old and new TypeScript alike**, and it is checked rather than assumed. `npm run check:resolution` packs the tarball and typechecks every entry point under `node`, `node16`, `nodenext` and `bundler` on TypeScript 5 and 7 — enforced in CI. `moduleResolution: "node"` ignores the `exports` map, which is why `typesVersions` is there too.
 - **Pure and synchronous.** No network, no clock, no randomness — safe on a hot path, trivial to test.
 - **Scores, not booleans.** Detectors report 0–1 and leave the threshold decision to you.
 - **Abstains rather than guesses.** Samples too short to judge score 0.
@@ -349,7 +349,7 @@ re-released as 0.5.0. The rule it broke is the one in the table above.
 - `PROMPT_ECHO` cannot tell a degenerate echo from a rewrite or translation — the difference is in what you asked for, not in the text.
 - `SCRIPT_MISMATCH` and `PROMPT_ECHO` do not run mid-stream by default: both measure a property of the whole response, and a mid-stream check reads a trailing window. `earlyDocumentChecks: true` opts in, with a measured false-positive risk — see **[docs/streaming.md](docs/streaming.md)**.
 - Tool *arguments* are measured only with `checkToolArguments: true`, non-streaming responses only.
-- `openai`'s `responses.stream()` helper is not wrapped; `create({ stream: true })` is.
+- `anthropic`'s `messages.stream()` helper is not wrapped; `create({ stream: true })` is. `openai`'s `responses.stream()` **is** — including `finalResponse()` and `done()` — but an `on()`-only consumer gets the report without an exception, because a callback has no error channel.
 - Truncation from a missing full stop is weak evidence, scored 0.55 and deliberately left below the defaults. Lower `maxTruncation` to ~0.5 to catch it, and expect false positives.
 - A JSON array of repeated identical records reads as a loop and fails from three records up. Set `redundancyScope: 'jsonValues'`.
 - `AGENT_LOOP` needs an *exact* cycle. An agent circling without repeating — `build`, read a file, `build`, read another, `build` — is **not** detected: the only signal that reads it scores that 0.444 against a healthy edit/test rhythm's 0.375, a margin too small to ship. Measured, rejected, and pinned by a test.

package/dist/anthropic.cjs

@@ -667,6 +667,77 @@ function checkPreamble(text, options) {
   return checkOutput(text, { ...options, ...TOOL_CALL_PREAMBLE });
 }
 
+// src/internal/event-stream-guard.ts
+function guardEventStream(stream, reader, options) {
+  const { onVerdict, onDegenerate = "throw", ...checkOptions } = options;
+  const guard = createStreamGuard(checkOptions);
+  let failure = null;
+  let sawToolCall = false;
+  let finishReason;
+  let ended = false;
+  const fire = (verdict) => {
+    failure = verdict;
+    onVerdict?.(verdict, { streaming: true });
+    if (onDegenerate === "ignore") return;
+    stream.abort?.();
+    stream.controller?.abort();
+  };
+  if (typeof stream.on === "function") {
+    stream.on(reader.delta.event, ((payload) => {
+      if (failure || ended) return;
+      const verdict = guard.push(reader.delta.read(payload));
+      if (verdict && !verdict.ok) fire(verdict);
+    }));
+    for (const event of reader.toolCall.events) {
+      stream.on(event, ((payload) => {
+        if (reader.toolCall.is(payload)) sawToolCall = true;
+      }));
+    }
+    for (const event of reader.terminal.events) {
+      stream.on(event, ((payload) => {
+        if (ended || failure) return;
+        ended = true;
+        finishReason = reader.terminal.finishReason(payload) ?? finishReason;
+        const verdict = sawToolCall ? checkPreamble(guard.text, checkOptions) : guard.end(finishReason);
+        if (verdict) onVerdict?.(verdict, { streaming: true });
+      }));
+    }
+  }
+  const ours = () => failure !== null;
+  async function* guarded() {
+    try {
+      for await (const event of stream) yield event;
+    } catch (error) {
+      if (!ours()) throw error;
+      if (onDegenerate === "throw") throw new DegenerateOutputError(failure);
+      return;
+    }
+    if (ours() && onDegenerate === "throw") throw new DegenerateOutputError(failure);
+  }
+  const wrapTerminal = (fn) => async function(...args) {
+    try {
+      const result = await fn.apply(stream, args);
+      if (ours() && onDegenerate === "throw") throw new DegenerateOutputError(failure);
+      return result;
+    } catch (error) {
+      if (error instanceof DegenerateOutputError) throw error;
+      if (ours() && onDegenerate === "throw") throw new DegenerateOutputError(failure);
+      throw error;
+    }
+  };
+  return new Proxy(stream, {
+    get(target, prop) {
+      if (prop === Symbol.asyncIterator) return guarded;
+      const value = Reflect.get(target, prop, target);
+      if (typeof value !== "function") return value;
+      if (prop === "finalResponse" || prop === "done") {
+        return wrapTerminal(value);
+      }
+      return value.bind(target);
+    }
+  });
+}
+
 // src/internal/tool-arguments.ts
 var ARGUMENT_SCOPE = {
   minLength: 0,
@@ -800,10 +871,18 @@ function guardClient(client, paths, options = {}) {
       }
     });
   };
-  const wrapCreate = (create, surface) => function(...args) {
+  const wrapCreate = (create, guardedPath) => function(...args) {
+    const { surface } = guardedPath;
     const prepared = surface.abortable?.(args);
     const callArgs = prepared?.args ?? args;
     const result = create.apply(this, callArgs);
+    if (guardedPath.eventStream && result && typeof result === "object" && typeof result[Symbol.asyncIterator] === "function") {
+      return guardEventStream(result, guardedPath.eventStream, {
+        ...optionsFor(surface, callArgs[0]),
+        onVerdict,
+        onDegenerate
+      });
+    }
     if (!result || typeof result.then !== "function") return result;
     let checked;
     const guarded = () => checked ??= Promise.resolve(result).then(
@@ -832,9 +911,9 @@ function guardClient(client, paths, options = {}) {
       if (matching.length === 0) return typeof value === "function" ? value.bind(obj) : value;
       const terminal = matching.find((g) => g.path.length === 1);
       if (terminal && typeof value === "function") {
-        return wrapCreate(value.bind(obj), terminal.surface);
+        return wrapCreate(value.bind(obj), terminal);
       }
-      const deeper = matching.filter((g) => g.path.length > 1).map((g) => ({ path: g.path.slice(1), surface: g.surface }));
+      const deeper = matching.filter((g) => g.path.length > 1).map((g) => ({ ...g, path: g.path.slice(1) }));
       if (deeper.length === 0 || !value || typeof value !== "object") {
         return typeof value === "function" ? value.bind(obj) : value;
       }