plugin-sensitive-filter-xr 0.0.2 → 0.0.5

package/dist/lib/sensitiveFilter.js

@@ -1,13 +1,17 @@
-import { __decorate } from "tslib";
+import { __decorate, __metadata } from "tslib";
 import { z as z4 } from 'zod/v4';
 import { AIMessage, HumanMessage } from '@langchain/core/messages';
-import { Injectable } from '@nestjs/common';
-import { AgentMiddlewareStrategy, } from '@xpert-ai/plugin-sdk';
-import { SensitiveFilterIcon, resolveGeneralPackRules, sensitiveFilterConfigSchema, } from './types.js';
+import { Inject, Injectable } from '@nestjs/common';
+import { CommandBus } from '@nestjs/cqrs';
+import { AgentMiddlewareStrategy, CreateModelClientCommand, WrapWorkflowNodeExecutionCommand, } from '@xpert-ai/plugin-sdk';
+import { SensitiveFilterIcon, llmDecisionSchema, resolveGeneralPackRules, sensitiveFilterConfigSchema, } from './types.js';
 const SENSITIVE_FILTER_MIDDLEWARE_NAME = 'SensitiveFilterMiddleware';
 const DEFAULT_INPUT_BLOCK_MESSAGE = '输入内容触发敏感策略，已拦截。';
 const DEFAULT_OUTPUT_BLOCK_MESSAGE = '输出内容触发敏感策略，已拦截。';
 const DEFAULT_REWRITE_TEXT = '[已过滤]';
+const CONFIG_PARSE_ERROR = '敏感词过滤配置格式不正确，请检查填写内容。';
+const BUSINESS_RULES_VALIDATION_ERROR = '请至少配置 1 条有效业务规则（pattern/type/action/scope/severity），或启用通用规则包。';
+const LLM_MODE_VALIDATION_ERROR = '请完善 LLM 过滤配置：需填写过滤模型、生效范围、审核规则说明。';
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -62,9 +66,6 @@ function extractInputText(state, runtime) {
     }
     return '';
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
 function getSeverityWeight(severity) {
     return severity === 'high' ? 2 : 1;
 }
@@ -168,7 +169,7 @@ function normalizeRuleDrafts(input) {
     const rules = [];
     for (const [index, draft] of input.entries()) {
         if (!isRecord(draft)) {
-            throw new Error(`Invalid rule at index ${index}: rule must be an object`);
+            continue;
         }
         const id = toNonEmptyString(draft['id']);
         const pattern = toNonEmptyString(draft['pattern']);
@@ -177,44 +178,175 @@ function normalizeRuleDrafts(input) {
         const severity = toNonEmptyString(draft['severity']);
         const action = toNonEmptyString(draft['action']);
         const replacementText = toNonEmptyString(draft['replacementText']) ?? undefined;
-        if (!pattern) {
-            throw new Error(`Invalid rule at index ${index}: pattern is required`);
-        }
-        if (!type) {
-            throw new Error(`Invalid rule at index ${index}: type is required`);
-        }
-        if (!action) {
-            throw new Error(`Invalid rule at index ${index}: action is required`);
+        const hasAnyValue = Boolean(id || pattern || type || scope || severity || action || replacementText);
+        if (!hasAnyValue) {
+            continue;
         }
-        if (action === 'rewrite' && !replacementText) {
-            throw new Error(`Invalid rule at index ${index}: replacementText is required when action is rewrite`);
+        if (!pattern || !type || !action || !scope || !severity) {
+            continue;
         }
         if (!['keyword', 'regex'].includes(type)) {
-            throw new Error(`Invalid rule at index ${index}: unsupported type '${type}'`);
+            continue;
         }
-        const normalizedScope = scope ?? 'both';
-        if (!['input', 'output', 'both'].includes(normalizedScope)) {
-            throw new Error(`Invalid rule at index ${index}: unsupported scope '${normalizedScope}'`);
+        if (!['input', 'output', 'both'].includes(scope)) {
+            continue;
         }
-        const normalizedSeverity = severity ?? 'medium';
-        if (!['high', 'medium'].includes(normalizedSeverity)) {
-            throw new Error(`Invalid rule at index ${index}: unsupported severity '${normalizedSeverity}'`);
+        if (!['high', 'medium'].includes(severity)) {
+            continue;
         }
         if (!['block', 'rewrite'].includes(action)) {
-            throw new Error(`Invalid rule at index ${index}: unsupported action '${action}'`);
+            continue;
         }
         rules.push({
             id: id ?? `rule-${index + 1}`,
             pattern,
             type,
-            scope: normalizedScope,
-            severity: normalizedSeverity,
+            scope,
+            severity,
             action,
             replacementText,
         });
     }
     return rules;
 }
+function modeIncludesScope(scope, phase) {
+    return scope === 'both' || scope === phase;
+}
+function buildInternalLlmPrompt(rulePrompt) {
+    return ('你是敏感内容审核器。请根据用户给出的审核规则判断文本是否命中敏感内容。' +
+        '\n你只能返回 JSON，不要输出额外说明。' +
+        '\nJSON字段: matched(boolean), action("block"|"rewrite"), replacementText(string), reason(string), categories(string[]).' +
+        '\n命中时请尽量给出 replacementText；未命中时返回 {"matched": false}。' +
+        '\n说明：系统会统一执行改写策略，即便你返回 action=block 也会按 rewrite 处理。' +
+        `\n\n用户审核规则：\n${rulePrompt}`);
+}
+function parseLlmDecision(raw, rewriteFallbackText) {
+    let payload = raw;
+    if (typeof payload === 'string') {
+        try {
+            payload = JSON.parse(payload);
+        }
+        catch {
+            throw new Error('LLM decision is not valid JSON string');
+        }
+    }
+    if (isRecord(payload) && !('matched' in payload) && 'content' in payload) {
+        const content = extractPrimitiveText(payload['content']).trim();
+        if (!content) {
+            throw new Error('LLM decision content is empty');
+        }
+        try {
+            payload = JSON.parse(content);
+        }
+        catch {
+            throw new Error('LLM decision content is not valid JSON');
+        }
+    }
+    const parsed = llmDecisionSchema.safeParse(payload);
+    if (!parsed.success) {
+        throw new Error(`Invalid LLM decision: ${z4.prettifyError(parsed.error)}`);
+    }
+    const decision = parsed.data;
+    const reason = toNonEmptyString(decision.reason) ?? undefined;
+    const categories = Array.isArray(decision.categories) ? decision.categories.filter(Boolean) : undefined;
+    if (!decision.matched) {
+        return {
+            matched: false,
+            reason,
+            categories,
+        };
+    }
+    return {
+        matched: true,
+        action: 'rewrite',
+        replacementText: toNonEmptyString(decision.replacementText) ?? rewriteFallbackText,
+        reason,
+        categories,
+    };
+}
+function resolveRuntimeLlmConfig(config) {
+    if (!isRecord(config)) {
+        throw new Error(LLM_MODE_VALIDATION_ERROR);
+    }
+    const model = isRecord(config.model) ? config.model : null;
+    const scope = toNonEmptyString(config.scope);
+    const rulePrompt = toNonEmptyString(config.rulePrompt) ?? toNonEmptyString(config.systemPrompt);
+    if (!model || !scope || !rulePrompt) {
+        throw new Error(LLM_MODE_VALIDATION_ERROR);
+    }
+    const outputMethodRaw = toNonEmptyString(config.outputMethod);
+    const outputMethod = ['functionCalling', 'jsonMode', 'jsonSchema'].includes(outputMethodRaw ?? '')
+        ? outputMethodRaw
+        : 'jsonMode';
+    const timeoutMs = typeof config.timeoutMs === 'number' && Number.isFinite(config.timeoutMs) && config.timeoutMs > 0
+        ? Math.min(Math.floor(config.timeoutMs), 120000)
+        : undefined;
+    const legacyOnLlmError = toNonEmptyString(config.onLlmError);
+    const legacyErrorRewriteText = toNonEmptyString(config.errorRewriteText) ?? undefined;
+    return {
+        model,
+        scope,
+        rulePrompt,
+        systemPrompt: buildInternalLlmPrompt(rulePrompt),
+        outputMethod,
+        legacyOnLlmError: legacyOnLlmError ?? undefined,
+        legacyErrorRewriteText,
+        rewriteFallbackText: toNonEmptyString(config.rewriteFallbackText) ?? DEFAULT_REWRITE_TEXT,
+        timeoutMs,
+    };
+}
+function withTimeout(promise, timeoutMs) {
+    if (!timeoutMs || timeoutMs <= 0) {
+        return promise;
+    }
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`LLM filter timeout after ${timeoutMs}ms`));
+        }, timeoutMs);
+        promise
+            .then((result) => {
+            clearTimeout(timer);
+            resolve(result);
+        })
+            .catch((error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function normalizeConfigurable(input) {
+    if (!isRecord(input)) {
+        return null;
+    }
+    return input;
+}
+function buildOutputMethodCandidates(preferred) {
+    const queue = [preferred, 'functionCalling', 'jsonMode', 'jsonSchema'];
+    const unique = [];
+    for (const method of queue) {
+        if (!unique.includes(method)) {
+            unique.push(method);
+        }
+    }
+    return unique;
+}
+function getErrorText(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error ?? '');
+}
+function isUnsupportedStructuredOutputError(error) {
+    const message = getErrorText(error).toLowerCase();
+    const patterns = [
+        'response_format type is unavailable',
+        'invalid response_format',
+        'response_format',
+        'unsupported schema',
+        'not support',
+    ];
+    return patterns.some((pattern) => message.includes(pattern));
+}
 let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
     constructor() {
         this.meta = {
@@ -224,8 +356,8 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
                 zh_Hans: '敏感内容过滤中间件',
             },
             description: {
-                en_US: 'Filter sensitive content before input and after output using business rules and optional local general lexicon.',
-                zh_Hans: '基于业务规则进行输入/输出过滤，并可选启用本地开源通用词库（中英双语）作为兜底。',
+                en_US: 'Filter sensitive content before input and after output using rule mode or LLM prompt mode (mutually exclusive).',
+                zh_Hans: '支持规则模式或 LLM 提示词模式（互斥）进行输入/输出敏感内容过滤。',
             },
             icon: {
                 type: 'svg',
@@ -234,15 +366,37 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
             configSchema: {
                 type: 'object',
                 properties: {
+                    mode: {
+                        type: 'string',
+                        title: {
+                            en_US: 'Filter Mode',
+                            zh_Hans: '过滤模式',
+                        },
+                        description: {
+                            en_US: 'Choose exactly one mode: Rule or LLM.',
+                            zh_Hans: '二选一：规则模式或 LLM 模式。',
+                        },
+                        enum: ['rule', 'llm'],
+                        default: 'rule',
+                        'x-ui': {
+                            enumLabels: {
+                                rule: { en_US: 'Rule Mode', zh_Hans: '规则模式' },
+                                llm: { en_US: 'LLM Mode', zh_Hans: 'LLM 模式' },
+                            },
+                        },
+                    },
                     rules: {
                         type: 'array',
+                        'x-ui': {
+                            span: 2,
+                        },
                         title: {
                             en_US: 'Business Rules',
                             zh_Hans: '业务规则',
                         },
                         description: {
-                            en_US: 'Add at least one complete business rule. If you only need baseline protection, enable General Pack below.',
-                            zh_Hans: '建议至少添加一条完整业务规则；若仅需基础兜底，可直接启用下方“通用规则包”。',
+                            en_US: 'Used in rule mode. Draft rows are allowed during editing. Runtime requires valid fields.',
+                            zh_Hans: '规则模式使用。编辑阶段允许草稿行，运行阶段要求有效规则字段。',
                         },
                         items: {
                             type: 'object',
@@ -306,29 +460,17 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
                                 },
                                 replacementText: {
                                     type: 'string',
-                                    title: { en_US: 'Replacement Text', zh_Hans: '替换文本（rewrite 必填）' },
+                                    title: { en_US: 'Replacement Text', zh_Hans: '替换文本（可选）' },
                                 },
                             },
-                            required: ['pattern', 'type', 'action'],
-                            allOf: [
-                                {
-                                    if: {
-                                        properties: {
-                                            action: {
-                                                const: 'rewrite',
-                                            },
-                                        },
-                                    },
-                                    then: {
-                                        required: ['replacementText'],
-                                    },
-                                },
-                            ],
+                            required: ['pattern', 'type', 'action', 'scope', 'severity'],
                         },
-                        minItems: 1,
                     },
                     generalPack: {
                         type: 'object',
+                        'x-ui': {
+                            span: 2,
+                        },
                         title: {
                             en_US: 'General Pack',
                             zh_Hans: '通用规则包（本地开源词库）',
@@ -346,6 +488,10 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
                             profile: {
                                 type: 'string',
                                 title: { en_US: 'Profile', zh_Hans: '策略档位' },
+                                description: {
+                                    en_US: 'Strict blocks on hit with broader lexicon; Balanced rewrites on hit with smaller lexicon.',
+                                    zh_Hans: '严格：词库范围更大且命中后拦截；平衡：词库范围较小且命中后改写。',
+                                },
                                 enum: ['strict', 'balanced'],
                                 'x-ui': {
                                     enumLabels: {
@@ -365,80 +511,283 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
                         type: 'boolean',
                         default: false,
                         title: { en_US: 'Case Sensitive', zh_Hans: '区分大小写' },
+                        'x-ui': {
+                            span: 2,
+                        },
                     },
                     normalize: {
                         type: 'boolean',
                         default: true,
                         title: { en_US: 'Normalize Text', zh_Hans: '文本标准化' },
+                        'x-ui': {
+                            span: 2,
+                        },
+                    },
+                    llm: {
+                        type: 'object',
+                        'x-ui': {
+                            span: 2,
+                        },
+                        title: {
+                            en_US: 'LLM Filter Config',
+                            zh_Hans: 'LLM 过滤配置',
+                        },
+                        description: {
+                            en_US: 'Used only when mode=llm.',
+                            zh_Hans: '仅在 mode=llm 时生效。',
+                        },
+                        properties: {
+                            model: {
+                                type: 'object',
+                                title: {
+                                    en_US: 'Filter Model',
+                                    zh_Hans: '过滤模型',
+                                },
+                                'x-ui': {
+                                    component: 'ai-model-select',
+                                    span: 2,
+                                    inputs: {
+                                        modelType: 'llm',
+                                        hiddenLabel: true,
+                                    },
+                                },
+                            },
+                            scope: {
+                                type: 'string',
+                                title: { en_US: 'Scope', zh_Hans: '生效范围' },
+                                enum: ['input', 'output', 'both'],
+                                'x-ui': {
+                                    enumLabels: {
+                                        input: { en_US: 'Input', zh_Hans: '仅输入' },
+                                        output: { en_US: 'Output', zh_Hans: '仅输出' },
+                                        both: { en_US: 'Both', zh_Hans: '输入和输出' },
+                                    },
+                                },
+                            },
+                            rulePrompt: {
+                                type: 'string',
+                                title: { en_US: 'Rule Prompt', zh_Hans: '审核规则说明' },
+                                description: {
+                                    en_US: 'Describe your moderation rules in natural language. No JSON format is required.',
+                                    zh_Hans: '用自然语言描述审核规则，无需手写 JSON 格式。',
+                                },
+                                'x-ui': {
+                                    component: 'textarea',
+                                    span: 2,
+                                    placeholder: {
+                                        en_US: 'e.g. Rewrite violent/privacy-sensitive content into a safe neutral response.',
+                                        zh_Hans: '例如：涉及暴力或隐私泄露内容时，改写为安全中性表达。',
+                                    },
+                                },
+                            },
+                            outputMethod: {
+                                type: 'string',
+                                title: { en_US: 'Output Method', zh_Hans: '结构化输出方式' },
+                                enum: ['functionCalling', 'jsonMode', 'jsonSchema'],
+                                default: 'jsonMode',
+                                'x-ui': {
+                                    enumLabels: {
+                                        functionCalling: { en_US: 'Function Calling', zh_Hans: '函数调用' },
+                                        jsonMode: { en_US: 'JSON Mode', zh_Hans: 'JSON模式' },
+                                        jsonSchema: { en_US: 'JSON Schema', zh_Hans: 'JSON架构' },
+                                    },
+                                },
+                            },
+                            rewriteFallbackText: {
+                                type: 'string',
+                                title: { en_US: 'Rewrite Fallback Text', zh_Hans: '改写兜底文本' },
+                            },
+                            timeoutMs: {
+                                type: 'number',
+                                title: { en_US: 'Timeout (ms)', zh_Hans: '超时毫秒' },
+                            },
+                        },
+                        required: ['model', 'scope', 'rulePrompt'],
                     },
                 },
+                required: ['mode'],
+                allOf: [
+                    {
+                        if: {
+                            properties: {
+                                mode: {
+                                    const: 'llm',
+                                },
+                            },
+                        },
+                        then: {
+                            required: ['llm'],
+                        },
+                    },
+                ],
             },
         };
     }
-    createMiddleware(options, _context) {
+    async createMiddleware(options, context) {
         const parsed = sensitiveFilterConfigSchema.safeParse(options ?? {});
         if (!parsed.success) {
-            throw new Error(`Invalid sensitive filter middleware options: ${z4.prettifyError(parsed.error)}`);
+            throw new Error(CONFIG_PARSE_ERROR);
+        }
+        if (parsed.data.mode === 'llm') {
+            return this.createLlmModeMiddleware(parsed.data, context);
         }
-        const config = parsed.data;
+        return this.createRuleModeMiddleware(parsed.data, context);
+    }
+    createRuleModeMiddleware(config, context) {
         const caseSensitive = config.caseSensitive ?? false;
         const normalize = config.normalize ?? true;
-        const customRules = normalizeRuleDrafts(config.rules);
+        const customRules = normalizeRuleDrafts(config.rules ?? []);
         const generalRules = resolveGeneralPackRules(config.generalPack);
         const allRules = [...customRules, ...generalRules];
-        const compiledRules = allRules.map((rule, index) => {
-            const normalizedPattern = rule.type === 'keyword' ? normalizeForMatching(rule.pattern, normalize, caseSensitive) : rule.pattern;
-            if (rule.type === 'regex') {
-                try {
-                    return {
-                        ...rule,
-                        index,
-                        normalizedPattern,
-                        matchRegex: new RegExp(rule.pattern, caseSensitive ? '' : 'i'),
-                        rewriteRegex: new RegExp(rule.pattern, caseSensitive ? 'g' : 'gi'),
-                    };
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    throw new Error(`Invalid regex pattern in rule '${rule.id}': ${message}`);
+        const hasEffectiveRules = allRules.length > 0;
+        let compiledRulesCache = null;
+        const getCompiledRules = () => {
+            if (compiledRulesCache) {
+                return compiledRulesCache;
+            }
+            compiledRulesCache = allRules.map((rule, index) => {
+                const normalizedPattern = rule.type === 'keyword' ? normalizeForMatching(rule.pattern, normalize, caseSensitive) : rule.pattern;
+                if (rule.type === 'regex') {
+                    try {
+                        return {
+                            ...rule,
+                            index,
+                            normalizedPattern,
+                            matchRegex: new RegExp(rule.pattern, caseSensitive ? '' : 'i'),
+                            rewriteRegex: new RegExp(rule.pattern, caseSensitive ? 'g' : 'gi'),
+                        };
+                    }
+                    catch (error) {
+                        const message = error instanceof Error ? error.message : String(error);
+                        throw new Error(`请完善规则配置：规则「${rule.id}」的正则表达式不合法（${message}）。`);
+                    }
                 }
+                return {
+                    ...rule,
+                    index,
+                    normalizedPattern,
+                };
+            });
+            return compiledRulesCache;
+        };
+        let inputBlockedMessage = null;
+        let pendingInputRewrite = null;
+        let finalAction = 'pass';
+        let auditEntries = [];
+        let runtimeConfigurable = null;
+        const resetRunState = () => {
+            inputBlockedMessage = null;
+            pendingInputRewrite = null;
+            finalAction = 'pass';
+            auditEntries = [];
+        };
+        const pushAudit = (entry) => {
+            auditEntries.push({
+                ...entry,
+                timestamp: new Date().toISOString(),
+                mode: 'rule',
+            });
+        };
+        const assignRuntimeConfigurable = (runtimeLike) => {
+            const configurable = normalizeConfigurable(runtimeLike?.configurable);
+            if (!configurable) {
+                return;
             }
+            if (configurable.thread_id && configurable.executionId) {
+                runtimeConfigurable = configurable;
+            }
+        };
+        const buildAuditSnapshot = () => {
+            const summary = {
+                total: auditEntries.length,
+                matched: auditEntries.filter((entry) => entry.matched).length,
+                blocked: auditEntries.filter((entry) => entry.action === 'block').length,
+                rewritten: auditEntries.filter((entry) => entry.action === 'rewrite').length,
+                errorPolicyTriggered: auditEntries.filter((entry) => entry.errorPolicyTriggered).length,
+            };
             return {
-                ...rule,
-                index,
-                normalizedPattern,
+                mode: 'rule',
+                finalAction,
+                records: auditEntries,
+                summary,
             };
-        });
-        let inputBlockedMessage = null;
-        let pendingInputRewrite = null;
+        };
+        const persistAuditSnapshot = async () => {
+            const configurable = runtimeConfigurable;
+            if (!configurable?.thread_id || !configurable.executionId || !this.commandBus) {
+                return;
+            }
+            const { thread_id, checkpoint_ns, checkpoint_id, subscriber, executionId } = configurable;
+            const snapshot = buildAuditSnapshot();
+            await this.commandBus.execute(new WrapWorkflowNodeExecutionCommand(async () => {
+                return {
+                    state: snapshot,
+                    output: snapshot,
+                };
+            }, {
+                execution: {
+                    category: 'workflow',
+                    type: 'middleware',
+                    title: `${context.node.title} Audit`,
+                    inputs: {
+                        mode: snapshot.mode,
+                        total: snapshot.summary.total,
+                    },
+                    parentId: executionId,
+                    threadId: thread_id,
+                    checkpointNs: checkpoint_ns,
+                    checkpointId: checkpoint_id,
+                    agentKey: context.node.key,
+                },
+                subscriber,
+            }));
+        };
         return {
             name: SENSITIVE_FILTER_MIDDLEWARE_NAME,
             beforeAgent: async (state, runtime) => {
+                resetRunState();
+                assignRuntimeConfigurable(runtime);
+                if (!hasEffectiveRules) {
+                    throw new Error(BUSINESS_RULES_VALIDATION_ERROR);
+                }
+                const compiledRules = getCompiledRules();
                 const safeState = state ?? {};
                 const safeRuntime = runtime ?? {};
-                inputBlockedMessage = null;
-                pendingInputRewrite = null;
-                if (compiledRules.length === 0) {
-                    return undefined;
-                }
                 const inputText = extractInputText(safeState, safeRuntime);
                 const inputMatches = findMatches(inputText, 'input', compiledRules, normalize, caseSensitive);
                 const winner = pickWinningRule(inputMatches);
                 if (!winner) {
+                    pushAudit({
+                        phase: 'input',
+                        matched: false,
+                        source: 'rule',
+                        errorPolicyTriggered: false,
+                    });
                     return undefined;
                 }
+                pushAudit({
+                    phase: 'input',
+                    matched: true,
+                    source: 'rule',
+                    action: winner.action,
+                    reason: `rule:${winner.id}`,
+                    errorPolicyTriggered: false,
+                });
                 if (winner.action === 'block') {
+                    finalAction = 'block';
                     inputBlockedMessage = winner.replacementText?.trim() || DEFAULT_INPUT_BLOCK_MESSAGE;
                     return undefined;
                 }
-                const rewrittenInput = rewriteTextByRule(inputText, winner, caseSensitive);
-                pendingInputRewrite = rewrittenInput;
+                finalAction = 'rewrite';
+                pendingInputRewrite = rewriteTextByRule(inputText, winner, caseSensitive);
                 return undefined;
             },
             wrapModelCall: async (request, handler) => {
-                if (compiledRules.length === 0) {
-                    return handler(request);
+                assignRuntimeConfigurable(request?.runtime);
+                if (!hasEffectiveRules) {
+                    throw new Error(BUSINESS_RULES_VALIDATION_ERROR);
                 }
+                const compiledRules = getCompiledRules();
                 if (inputBlockedMessage) {
                     return new AIMessage(inputBlockedMessage);
                 }
@@ -449,21 +798,371 @@ let SensitiveFilterMiddleware = class SensitiveFilterMiddleware {
                 const outputMatches = findMatches(outputText, 'output', compiledRules, normalize, caseSensitive);
                 const winner = pickWinningRule(outputMatches);
                 if (!winner) {
+                    pushAudit({
+                        phase: 'output',
+                        matched: false,
+                        source: 'rule',
+                        errorPolicyTriggered: false,
+                    });
                     return response;
                 }
+                pushAudit({
+                    phase: 'output',
+                    matched: true,
+                    source: 'rule',
+                    action: winner.action,
+                    reason: `rule:${winner.id}`,
+                    errorPolicyTriggered: false,
+                });
                 if (winner.action === 'block') {
+                    finalAction = 'block';
                     const blockedOutput = winner.replacementText?.trim() || DEFAULT_OUTPUT_BLOCK_MESSAGE;
                     return replaceModelResponseText(response, blockedOutput);
                 }
+                finalAction = 'rewrite';
                 const rewrittenOutput = rewriteTextByRule(outputText, winner, caseSensitive);
                 return replaceModelResponseText(response, rewrittenOutput);
             },
             afterAgent: async () => {
+                await persistAuditSnapshot();
+                return undefined;
+            },
+        };
+    }
+    createLlmModeMiddleware(config, context) {
+        const llmDraftConfig = config.llm;
+        let resolvedLlmConfig = null;
+        let modelPromise = null;
+        const structuredModelPromises = new Map();
+        const getLlmConfig = () => {
+            if (!resolvedLlmConfig) {
+                resolvedLlmConfig = resolveRuntimeLlmConfig(llmDraftConfig);
+            }
+            return resolvedLlmConfig;
+        };
+        const ensureModel = async () => {
+            const llmConfig = getLlmConfig();
+            if (!modelPromise) {
+                modelPromise = this.commandBus.execute(new CreateModelClientCommand(llmConfig.model, {
+                    usageCallback: () => { },
+                }));
+            }
+            return modelPromise;
+        };
+        const ensureStructuredModel = async (method) => {
+            if (!structuredModelPromises.has(method)) {
+                structuredModelPromises.set(method, (async () => {
+                    const model = await ensureModel();
+                    return model.withStructuredOutput?.(llmDecisionSchema, {
+                        method,
+                    }) ?? null;
+                })());
+            }
+            return structuredModelPromises.get(method);
+        };
+        let pendingInputRewrite = null;
+        let finalAction = 'pass';
+        let auditEntries = [];
+        let runtimeConfigurable = null;
+        let resolvedOutputMethod;
+        let fallbackTriggered = false;
+        let methodAttempts = [];
+        const resetRunState = () => {
+            pendingInputRewrite = null;
+            finalAction = 'pass';
+            auditEntries = [];
+            resolvedOutputMethod = undefined;
+            fallbackTriggered = false;
+            methodAttempts = [];
+        };
+        const pushAudit = (entry) => {
+            auditEntries.push({
+                ...entry,
+                timestamp: new Date().toISOString(),
+                mode: 'llm',
+            });
+        };
+        const assignRuntimeConfigurable = (runtimeLike) => {
+            const configurable = normalizeConfigurable(runtimeLike?.configurable);
+            if (!configurable) {
+                return;
+            }
+            if (configurable.thread_id && configurable.executionId) {
+                runtimeConfigurable = configurable;
+            }
+        };
+        const captureLlmOutputTrace = (trace) => {
+            for (const method of trace.methodAttempts) {
+                if (!methodAttempts.includes(method)) {
+                    methodAttempts.push(method);
+                }
+            }
+            resolvedOutputMethod = trace.resolvedOutputMethod;
+            fallbackTriggered = fallbackTriggered || trace.fallbackTriggered;
+        };
+        const buildAuditSnapshot = () => {
+            const summary = {
+                total: auditEntries.length,
+                matched: auditEntries.filter((entry) => entry.matched).length,
+                blocked: auditEntries.filter((entry) => entry.action === 'block').length,
+                rewritten: auditEntries.filter((entry) => entry.action === 'rewrite').length,
+                errorPolicyTriggered: auditEntries.filter((entry) => entry.errorPolicyTriggered).length,
+            };
+            return {
+                mode: 'llm',
+                finalAction,
+                records: auditEntries,
+                summary,
+                llmOutput: resolvedLlmConfig
+                    ? {
+                        requestedOutputMethod: resolvedLlmConfig.outputMethod,
+                        resolvedOutputMethod,
+                        methodAttempts,
+                        fallbackTriggered,
+                    }
+                    : undefined,
+            };
+        };
+        const persistAuditSnapshot = async () => {
+            const configurable = runtimeConfigurable;
+            if (!configurable?.thread_id || !configurable.executionId || !this.commandBus) {
+                return;
+            }
+            const { thread_id, checkpoint_ns, checkpoint_id, subscriber, executionId } = configurable;
+            const snapshot = buildAuditSnapshot();
+            await this.commandBus.execute(new WrapWorkflowNodeExecutionCommand(async () => {
+                return {
+                    state: snapshot,
+                    output: snapshot,
+                };
+            }, {
+                execution: {
+                    category: 'workflow',
+                    type: 'middleware',
+                    title: `${context.node.title} Audit`,
+                    inputs: {
+                        mode: snapshot.mode,
+                        total: snapshot.summary.total,
+                    },
+                    parentId: executionId,
+                    threadId: thread_id,
+                    checkpointNs: checkpoint_ns,
+                    checkpointId: checkpoint_id,
+                    agentKey: context.node.key,
+                },
+                subscriber,
+            }));
+        };
+        const buildEvaluationMessages = (phase, text, llmConfig) => {
+            return [
+                { role: 'system', content: llmConfig.systemPrompt },
+                {
+                    role: 'user',
+                    content: `phase=${phase}\n` +
+                        '请严格基于给定文本进行敏感判定，并只返回约定结构。\n' +
+                        `text:\n${text}`,
+                },
+            ];
+        };
+        const invokeAndTrack = async (phase, text, runtime, llmConfig) => {
+            const invokeCore = async () => {
+                const messages = buildEvaluationMessages(phase, text, llmConfig);
+                const model = await ensureModel();
+                const candidates = buildOutputMethodCandidates(llmConfig.outputMethod);
+                const attempts = [];
+                for (const method of candidates) {
+                    attempts.push(method);
+                    try {
+                        const structuredModel = await ensureStructuredModel(method);
+                        if (!structuredModel) {
+                            throw new Error(`Structured output is not available for method: ${method}`);
+                        }
+                        const raw = await withTimeout(structuredModel.invoke(messages), llmConfig.timeoutMs);
+                        return {
+                            raw,
+                            trace: {
+                                requestedOutputMethod: llmConfig.outputMethod,
+                                resolvedOutputMethod: method,
+                                methodAttempts: attempts,
+                                fallbackTriggered: method !== llmConfig.outputMethod || attempts.length > 1,
+                            },
+                        };
+                    }
+                    catch (error) {
+                        if (isUnsupportedStructuredOutputError(error)) {
+                            continue;
+                        }
+                        throw error;
+                    }
+                }
+                attempts.push('plainText');
+                const raw = await withTimeout(model.invoke(messages), llmConfig.timeoutMs);
+                return {
+                    raw,
+                    trace: {
+                        requestedOutputMethod: llmConfig.outputMethod,
+                        resolvedOutputMethod: 'plainText',
+                        methodAttempts: attempts,
+                        fallbackTriggered: true,
+                    },
+                };
+            };
+            const parseCore = async () => {
+                const { raw, trace } = await invokeCore();
+                captureLlmOutputTrace(trace);
+                return parseLlmDecision(raw, llmConfig.rewriteFallbackText);
+            };
+            const configurable = (runtime?.configurable ?? {});
+            const { thread_id, checkpoint_ns, checkpoint_id, subscriber, executionId } = configurable;
+            if (!thread_id || !executionId) {
+                return parseCore();
+            }
+            const tracked = await this.commandBus.execute(new WrapWorkflowNodeExecutionCommand(async () => {
+                const decision = await parseCore();
+                return {
+                    state: decision,
+                    output: decision,
+                };
+            }, {
+                execution: {
+                    category: 'workflow',
+                    type: 'middleware',
+                    inputs: {
+                        phase,
+                        text,
+                    },
+                    parentId: executionId,
+                    threadId: thread_id,
+                    checkpointNs: checkpoint_ns,
+                    checkpointId: checkpoint_id,
+                    agentKey: context.node.key,
+                    title: context.node.title,
+                },
+                subscriber,
+            }));
+            return tracked;
+        };
+        const resolveOnErrorDecision = (llmConfig, error) => {
+            const reason = `llm-error:${error instanceof Error ? error.message : String(error)}`;
+            return {
+                matched: true,
+                action: 'rewrite',
+                replacementText: llmConfig.legacyErrorRewriteText ?? llmConfig.rewriteFallbackText,
+                reason,
+            };
+        };
+        return {
+            name: SENSITIVE_FILTER_MIDDLEWARE_NAME,
+            beforeAgent: async (state, runtime) => {
+                resetRunState();
+                assignRuntimeConfigurable(runtime);
+                const llmConfig = getLlmConfig();
+                if (!modeIncludesScope(llmConfig.scope, 'input')) {
+                    pushAudit({
+                        phase: 'input',
+                        matched: false,
+                        source: 'llm',
+                        reason: 'scope-skip',
+                        errorPolicyTriggered: false,
+                    });
+                    return undefined;
+                }
+                const inputText = extractInputText(state ?? {}, runtime ?? {});
+                if (!inputText) {
+                    pushAudit({
+                        phase: 'input',
+                        matched: false,
+                        source: 'llm',
+                        reason: 'empty-input',
+                        errorPolicyTriggered: false,
+                    });
+                    return undefined;
+                }
+                let decision;
+                let fromErrorPolicy = false;
+                try {
+                    decision = await invokeAndTrack('input', inputText, runtime, llmConfig);
+                }
+                catch (error) {
+                    decision = resolveOnErrorDecision(llmConfig, error);
+                    fromErrorPolicy = true;
+                }
+                pushAudit({
+                    phase: 'input',
+                    matched: decision.matched,
+                    source: fromErrorPolicy ? 'error-policy' : 'llm',
+                    action: decision.action,
+                    reason: decision.reason,
+                    errorPolicyTriggered: fromErrorPolicy,
+                });
+                if (!decision.matched || !decision.action) {
+                    return undefined;
+                }
+                finalAction = 'rewrite';
+                pendingInputRewrite = toNonEmptyString(decision.replacementText) ?? llmConfig.rewriteFallbackText;
+                return undefined;
+            },
+            wrapModelCall: async (request, handler) => {
+                assignRuntimeConfigurable(request?.runtime);
+                const llmConfig = getLlmConfig();
+                const modelRequest = pendingInputRewrite ? rewriteModelRequestInput(request, pendingInputRewrite) : request;
+                pendingInputRewrite = null;
+                const response = await handler(modelRequest);
+                if (!modeIncludesScope(llmConfig.scope, 'output')) {
+                    pushAudit({
+                        phase: 'output',
+                        matched: false,
+                        source: 'llm',
+                        reason: 'scope-skip',
+                        errorPolicyTriggered: false,
+                    });
+                    return response;
+                }
+                const outputText = extractModelResponseText(response);
+                if (!outputText) {
+                    pushAudit({
+                        phase: 'output',
+                        matched: false,
+                        source: 'llm',
+                        reason: 'empty-output',
+                        errorPolicyTriggered: false,
+                    });
+                    return response;
+                }
+                let decision;
+                let fromErrorPolicy = false;
+                try {
+                    decision = await invokeAndTrack('output', outputText, request?.runtime, llmConfig);
+                }
+                catch (error) {
+                    decision = resolveOnErrorDecision(llmConfig, error);
+                    fromErrorPolicy = true;
+                }
+                pushAudit({
+                    phase: 'output',
+                    matched: decision.matched,
+                    source: fromErrorPolicy ? 'error-policy' : 'llm',
+                    action: decision.action,
+                    reason: decision.reason,
+                    errorPolicyTriggered: fromErrorPolicy,
+                });
+                if (!decision.matched || !decision.action) {
+                    return response;
+                }
+                finalAction = 'rewrite';
+                return replaceModelResponseText(response, toNonEmptyString(decision.replacementText) ?? llmConfig.rewriteFallbackText);
+            },
+            afterAgent: async () => {
+                await persistAuditSnapshot();
                 return undefined;
             },
         };
     }
 };
+__decorate([
+    Inject(CommandBus),
+    __metadata("design:type", CommandBus)
+], SensitiveFilterMiddleware.prototype, "commandBus", void 0);
 SensitiveFilterMiddleware = __decorate([
     Injectable(),
     AgentMiddlewareStrategy(SENSITIVE_FILTER_MIDDLEWARE_NAME)