musubi-sdd 5.1.0 → 5.6.1

package/src/orchestration/guardrails/guardrail-rules.js

@@ -1,8 +1,8 @@
 /**
  * @fileoverview Guardrail validation rules DSL
- * 
+ *
  * Provides a declarative DSL for defining guardrail validation rules.
- * 
+ *
  * @module orchestration/guardrails/guardrail-rules
  * @version 3.9.0
  */
@@ -30,18 +30,18 @@ const RuleType = {
   MAX_LENGTH: 'maxLength',
   MIN_LENGTH: 'minLength',
   PATTERN: 'pattern',
-  
+
   // Security rules
   NO_PII: 'noPII',
   NO_PROHIBITED_WORDS: 'noProhibitedWords',
   NO_INJECTION: 'noInjection',
-  
+
   // Format rules
   TYPE: 'type',
   ENUM: 'enum',
-  
+
   // Custom rules
-  CUSTOM: 'custom'
+  CUSTOM: 'custom',
 };
 
 /**
@@ -55,11 +55,12 @@ const SecurityPatterns = {
   SSN: /\b\d{3}[-\s]?\d{2}[-\s]?\d{4}\b/g,
   CREDIT_CARD: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g,
   IP_ADDRESS: /\b(?:\d{1,3}\.){3}\d{1,3}\b/g,
-  
+
   // Injection patterns
-  SQL_INJECTION: /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b.*\b(FROM|INTO|WHERE|TABLE)\b)|(--.*)|(\/\*.*\*\/)/gi,
+  SQL_INJECTION:
+    /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b.*\b(FROM|INTO|WHERE|TABLE)\b)|(--.*)|(\/\*.*\*\/)/gi,
   XSS: /<script[^>]*>[\s\S]*?<\/script>|javascript:|on\w+\s*=/gi,
-  COMMAND_INJECTION: /[;&|`$(){}[\]]/g
+  COMMAND_INJECTION: /[;&|`$(){}[\]]/g,
 };
 
 /**
@@ -79,14 +80,14 @@ class RuleBuilder {
     this.rules.push({
       id: 'required',
       type: RuleType.REQUIRED,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return false;
         if (typeof value === 'string' && value.trim() === '') return false;
         if (Array.isArray(value) && value.length === 0) return false;
         return true;
       },
       message,
-      severity: 'error'
+      severity: 'error',
     });
     return this;
   }
@@ -101,15 +102,15 @@ class RuleBuilder {
     this.rules.push({
       id: `maxLength_${max}`,
       type: RuleType.MAX_LENGTH,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return true;
-        const len = typeof value === 'string' ? value.length : 
-                    Array.isArray(value) ? value.length : 0;
+        const len =
+          typeof value === 'string' ? value.length : Array.isArray(value) ? value.length : 0;
         return len <= max;
       },
       message: message || `Exceeds maximum length of ${max}`,
       severity: 'error',
-      options: { max }
+      options: { max },
     });
     return this;
   }
@@ -124,15 +125,15 @@ class RuleBuilder {
     this.rules.push({
       id: `minLength_${min}`,
       type: RuleType.MIN_LENGTH,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return false;
-        const len = typeof value === 'string' ? value.length : 
-                    Array.isArray(value) ? value.length : 0;
+        const len =
+          typeof value === 'string' ? value.length : Array.isArray(value) ? value.length : 0;
         return len >= min;
       },
       message: message || `Below minimum length of ${min}`,
       severity: 'error',
-      options: { min }
+      options: { min },
     });
     return this;
   }
@@ -147,14 +148,14 @@ class RuleBuilder {
     this.rules.push({
       id: `pattern_${pattern.source}`,
       type: RuleType.PATTERN,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return true;
         if (typeof value !== 'string') return false;
         return pattern.test(value);
       },
       message: message || `Does not match required pattern`,
       severity: 'error',
-      options: { pattern: pattern.source }
+      options: { pattern: pattern.source },
     });
     return this;
   }
@@ -169,14 +170,14 @@ class RuleBuilder {
     this.rules.push({
       id: `noPattern_${pattern.source}`,
       type: RuleType.PATTERN,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return true;
         if (typeof value !== 'string') return true;
         return !pattern.test(value);
       },
       message: message || `Contains prohibited pattern`,
       severity: 'error',
-      options: { pattern: pattern.source, inverted: true }
+      options: { pattern: pattern.source, inverted: true },
     });
     return this;
   }
@@ -199,12 +200,12 @@ class RuleBuilder {
     this.rules.push({
       id: 'noPII',
       type: RuleType.NO_PII,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return { passed: true };
         if (typeof value !== 'string') return { passed: true };
-        
+
         const detections = [];
-        
+
         if (detectEmail && SecurityPatterns.EMAIL.test(value)) {
           detections.push('email');
           SecurityPatterns.EMAIL.lastIndex = 0;
@@ -230,12 +231,12 @@ class RuleBuilder {
 
         return {
           passed: detections.length === 0,
-          detections
+          detections,
         };
       },
       message: 'Contains personally identifiable information (PII)',
       severity: 'error',
-      options
+      options,
     });
     return this;
   }
@@ -249,14 +250,14 @@ class RuleBuilder {
    */
   noProhibitedWords(words, options = {}) {
     const caseSensitive = options.caseSensitive || false;
-    
+
     this.rules.push({
       id: 'noProhibitedWords',
       type: RuleType.NO_PROHIBITED_WORDS,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return { passed: true };
         if (typeof value !== 'string') return { passed: true };
-        
+
         const checkValue = caseSensitive ? value : value.toLowerCase();
         const foundWords = words.filter(word => {
           const checkWord = caseSensitive ? word : word.toLowerCase();
@@ -265,12 +266,12 @@ class RuleBuilder {
 
         return {
           passed: foundWords.length === 0,
-          foundWords
+          foundWords,
         };
       },
       message: 'Contains prohibited content',
       severity: 'error',
-      options: { words, caseSensitive }
+      options: { words, caseSensitive },
     });
     return this;
   }
@@ -291,12 +292,12 @@ class RuleBuilder {
     this.rules.push({
       id: 'noInjection',
       type: RuleType.NO_INJECTION,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return { passed: true };
         if (typeof value !== 'string') return { passed: true };
-        
+
         const detections = [];
-        
+
         if (checkSql && SecurityPatterns.SQL_INJECTION.test(value)) {
           detections.push('sql');
           SecurityPatterns.SQL_INJECTION.lastIndex = 0;
@@ -312,12 +313,12 @@ class RuleBuilder {
 
         return {
           passed: detections.length === 0,
-          detections
+          detections,
         };
       },
       message: 'Contains potential injection attack',
       severity: 'error',
-      options
+      options,
     });
     return this;
   }
@@ -332,9 +333,9 @@ class RuleBuilder {
     this.rules.push({
       id: `type_${expectedType}`,
       type: RuleType.TYPE,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return true;
-        
+
         if (expectedType === 'array') {
           return Array.isArray(value);
         }
@@ -342,7 +343,7 @@ class RuleBuilder {
       },
       message: message || `Expected type ${expectedType}`,
       severity: 'error',
-      options: { expectedType }
+      options: { expectedType },
     });
     return this;
   }
@@ -357,13 +358,13 @@ class RuleBuilder {
     this.rules.push({
       id: 'enum',
       type: RuleType.ENUM,
-      check: (value) => {
+      check: value => {
         if (value === null || value === undefined) return true;
         return allowedValues.includes(value);
       },
       message: message || `Must be one of: ${allowedValues.join(', ')}`,
       severity: 'error',
-      options: { allowedValues }
+      options: { allowedValues },
     });
     return this;
   }
@@ -382,7 +383,7 @@ class RuleBuilder {
       type: RuleType.CUSTOM,
       check: checkFn,
       message,
-      severity
+      severity,
     });
     return this;
   }
@@ -480,37 +481,22 @@ const CommonRuleSets = {
   /**
    * Basic security rules
    */
-  security: rules()
-    .noPII()
-    .noInjection()
-    .build(),
+  security: rules().noPII().noInjection().build(),
 
   /**
    * Strict content rules
    */
-  strictContent: rules()
-    .required()
-    .maxLength(10000)
-    .noPII()
-    .noInjection()
-    .build(),
+  strictContent: rules().required().maxLength(10000).noPII().noInjection().build(),
 
   /**
    * User input rules
    */
-  userInput: rules()
-    .required()
-    .maxLength(5000)
-    .noInjection()
-    .build(),
+  userInput: rules().required().maxLength(5000).noInjection().build(),
 
   /**
    * Agent output rules
    */
-  agentOutput: rules()
-    .required()
-    .noPII()
-    .build()
+  agentOutput: rules().required().noPII().build(),
 };
 
 // Global registry instance
@@ -528,5 +514,5 @@ module.exports = {
   RuleRegistry,
   rules,
   CommonRuleSets,
-  globalRuleRegistry
+  globalRuleRegistry,
 };

package/src/orchestration/guardrails/index.js

@@ -1,9 +1,9 @@
 /**
  * @fileoverview Guardrails module exports
- * 
+ *
  * This module provides guardrail functionality for input/output validation
  * in the MUSUBI orchestration system.
- * 
+ *
  * @module orchestration/guardrails
  * @version 3.9.0
  */
@@ -17,7 +17,7 @@ const {
   SafetyCheckGuardrail,
   createSafetyCheckGuardrail,
   SafetyLevel,
-  ConstitutionalMapping
+  ConstitutionalMapping,
 } = require('./safety-check');
 const {
   RuleType,
@@ -26,7 +26,7 @@ const {
   RuleRegistry,
   rules,
   CommonRuleSets,
-  globalRuleRegistry
+  globalRuleRegistry,
 } = require('./guardrail-rules');
 
 module.exports = {
@@ -57,5 +57,5 @@ module.exports = {
   RuleRegistry,
   rules,
   CommonRuleSets,
-  globalRuleRegistry
+  globalRuleRegistry,
 };

package/src/orchestration/guardrails/input-guardrail.js

@@ -1,9 +1,9 @@
 /**
  * @fileoverview Input Guardrail for validating agent inputs
- * 
+ *
  * InputGuardrail validates and sanitizes inputs before they reach agents.
  * Inspired by OpenAI Agents SDK guardrails pattern.
- * 
+ *
  * @module orchestration/guardrails/input-guardrail
  * @version 3.9.0
  */
@@ -51,7 +51,7 @@ class InputGuardrail extends BaseGuardrail {
       failFast: config.failFast,
       severity: config.severity,
       tripwireEnabled: config.tripwireEnabled,
-      options: config.options
+      options: config.options,
     });
 
     // Load rules from config, rule set, or default
@@ -79,9 +79,8 @@ class InputGuardrail extends BaseGuardrail {
    * @returns {InputGuardrail} this for chaining
    */
   addFieldRules(fieldName, rulesOrBuilder) {
-    const fieldRules = rulesOrBuilder instanceof RuleBuilder 
-      ? rulesOrBuilder.build() 
-      : rulesOrBuilder;
+    const fieldRules =
+      rulesOrBuilder instanceof RuleBuilder ? rulesOrBuilder.build() : rulesOrBuilder;
     this.fieldRules.set(fieldName, fieldRules);
     return this;
   }
@@ -106,25 +105,33 @@ class InputGuardrail extends BaseGuardrail {
       try {
         const customResult = await this.customValidator(sanitizedInput, context);
         if (customResult === false || (customResult && customResult.passed === false)) {
-          violations.push(this.createViolation(
-            'CUSTOM_VALIDATION_FAILED',
-            customResult.message || 'Custom validation failed',
-            'error',
-            { custom: true }
-          ));
+          violations.push(
+            this.createViolation(
+              'CUSTOM_VALIDATION_FAILED',
+              customResult.message || 'Custom validation failed',
+              'error',
+              { custom: true }
+            )
+          );
         }
       } catch (error) {
-        violations.push(this.createViolation(
-          'CUSTOM_VALIDATOR_ERROR',
-          `Custom validator error: ${error.message}`,
-          'error',
-          { error: error.message }
-        ));
+        violations.push(
+          this.createViolation(
+            'CUSTOM_VALIDATOR_ERROR',
+            `Custom validator error: ${error.message}`,
+            'error',
+            { error: error.message }
+          )
+        );
       }
     }
 
     // Check if input is structured (object) and has field rules
-    if (typeof sanitizedInput === 'object' && sanitizedInput !== null && !Array.isArray(sanitizedInput)) {
+    if (
+      typeof sanitizedInput === 'object' &&
+      sanitizedInput !== null &&
+      !Array.isArray(sanitizedInput)
+    ) {
       // Validate each field with field-specific rules
       for (const [fieldName, fieldRules] of this.fieldRules) {
         const fieldValue = sanitizedInput[fieldName];
@@ -147,12 +154,14 @@ class InputGuardrail extends BaseGuardrail {
     return this.createResult(
       passed,
       violations,
-      passed ? 'Input validation passed' : `Input validation failed with ${violations.length} violation(s)`,
+      passed
+        ? 'Input validation passed'
+        : `Input validation failed with ${violations.length} violation(s)`,
       0,
       {
         sanitized: this.sanitize,
         originalInput: input,
-        sanitizedInput: this.sanitize ? sanitizedInput : undefined
+        sanitizedInput: this.sanitize ? sanitizedInput : undefined,
       }
     );
   }
@@ -171,7 +180,7 @@ class InputGuardrail extends BaseGuardrail {
     for (const rule of rulesToApply) {
       try {
         const result = await Promise.resolve(rule.check(value));
-        
+
         let passed = result;
         let additionalContext = {};
 
@@ -182,24 +191,28 @@ class InputGuardrail extends BaseGuardrail {
         }
 
         if (!passed) {
-          violations.push(this.createViolation(
-            rule.id.toUpperCase(),
-            `${fieldName}: ${rule.message}`,
-            rule.severity || this.defaultSeverity,
-            { field: fieldName, rule: rule.id, ...additionalContext }
-          ));
+          violations.push(
+            this.createViolation(
+              rule.id.toUpperCase(),
+              `${fieldName}: ${rule.message}`,
+              rule.severity || this.defaultSeverity,
+              { field: fieldName, rule: rule.id, ...additionalContext }
+            )
+          );
 
           if (this.failFast) {
             break;
           }
         }
       } catch (error) {
-        violations.push(this.createViolation(
-          'RULE_ERROR',
-          `Rule '${rule.id}' execution error: ${error.message}`,
-          'error',
-          { field: fieldName, rule: rule.id, error: error.message }
-        ));
+        violations.push(
+          this.createViolation(
+            'RULE_ERROR',
+            `Rule '${rule.id}' execution error: ${error.message}`,
+            'error',
+            { field: fieldName, rule: rule.id, error: error.message }
+          )
+        );
       }
     }
 
@@ -216,18 +229,18 @@ class InputGuardrail extends BaseGuardrail {
     if (typeof input === 'string') {
       return input;
     }
-    
+
     if (typeof input === 'object' && input !== null) {
       // For structured input, extract 'message', 'content', or 'text' fields
       if (input.message) return input.message;
       if (input.content) return input.content;
       if (input.text) return input.text;
       if (input.input) return input.input;
-      
+
       // If no known field, stringify the object
       return JSON.stringify(input);
     }
-    
+
     return String(input);
   }
 
@@ -327,7 +340,7 @@ class InputGuardrail extends BaseGuardrail {
       rulesCount: this.rules.length,
       fieldRulesCount: this.fieldRules.size,
       sanitize: this.sanitize,
-      rules: this.rules.map(r => ({ id: r.id, type: r.type, severity: r.severity }))
+      rules: this.rules.map(r => ({ id: r.id, type: r.type, severity: r.severity })),
     };
   }
 }
@@ -344,14 +357,14 @@ function createInputGuardrail(preset = 'userInput', overrides = {}) {
       name: 'SecurityGuardrail',
       description: 'Security-focused input validation',
       ruleSet: 'security',
-      tripwireEnabled: true
+      tripwireEnabled: true,
     },
     userInput: {
       name: 'UserInputGuardrail',
       description: 'Validates user input',
       ruleSet: 'userInput',
       sanitize: true,
-      sanitizeOptions: { trimWhitespace: true }
+      sanitizeOptions: { trimWhitespace: true },
     },
     strict: {
       name: 'StrictInputGuardrail',
@@ -359,20 +372,20 @@ function createInputGuardrail(preset = 'userInput', overrides = {}) {
       ruleSet: 'strictContent',
       sanitize: true,
       tripwireEnabled: true,
-      failFast: true
+      failFast: true,
     },
     minimal: {
       name: 'MinimalInputGuardrail',
       description: 'Minimal validation',
-      rules: rules().required().build()
-    }
+      rules: rules().required().build(),
+    },
   };
 
-  const config = { ...presets[preset] || presets.userInput, ...overrides };
+  const config = { ...(presets[preset] || presets.userInput), ...overrides };
   return new InputGuardrail(config);
 }
 
 module.exports = {
   InputGuardrail,
-  createInputGuardrail
+  createInputGuardrail,
 };