risicare 0.4.0 → 0.4.2

package/dist/index.d.cts

@@ -873,6 +873,13 @@ interface ApplyResult {
     fixType?: string;
     modifications: Record<string, unknown>;
     error?: string;
+    /**
+     * Guard-only: human-readable reason a guard failed (passed=false). Used
+     * by GuardRejectedError to surface an actionable message to the customer.
+     * `error` carries the raw exception text; `reason` carries the audit
+     * category ('guard_exception', 'content_filter', 'format_check', etc.).
+     */
+    reason?: string;
 }
 declare class FixApplier {
     private readonly _config;
@@ -1024,6 +1031,33 @@ declare class FixLoader {
  * Port of Python SDK's runtime/interceptors.py adapted for Node.js.
  */
 
+/**
+ * Thrown by the fix interceptor when a guard fix returns `passed: false`.
+ *
+ * PR-4+5 review B2 (2026-05-25): pre-fix, `applyGuardFix` returned
+ * `passed:false` correctly but no caller read `passed` — the provider
+ * patcher consumed `result.messages` / `result.params` and proceeded to the
+ * LLM with the attacker payload anyway. The `fail-CLOSED` was advisory only.
+ *
+ * Now the interceptor THROWS this error on both pre-call and post-call
+ * guard rejection. The provider patcher's surrounding span.startSpan
+ * already catches and records exceptions, so the customer sees a
+ * `GuardRejectedError` propagated out of their `openai.chat.completions.create`
+ * call — the LLM is NEVER invoked.
+ *
+ * Customers who want to handle rejection gracefully can:
+ *   try { await openai.chat.completions.create({ ... }); }
+ *   catch (e) {
+ *     if (e instanceof GuardRejectedError) { ... fallback ... }
+ *     else throw e;
+ *   }
+ */
+declare class GuardRejectedError extends Error {
+    readonly guardId: string;
+    readonly reason: string;
+    readonly phase: 'pre_call' | 'post_call';
+    constructor(guardId: string, reason: string, phase: 'pre_call' | 'post_call');
+}
 interface InterceptContext {
     /** Type of operation: "llm_call", "tool_call", "agent_delegate" */
     operationType: string;
@@ -1319,4 +1353,4 @@ type WebhookPayload = Uint8Array | ArrayBuffer | string;
  */
 declare function verifyWebhookSignature(payload: WebhookPayload, headers: HeaderLookup, secret: string, opts?: VerifyWebhookOptions): void;
 
-export { type ActiveFix, type AgentContext, type AgentOptions, AgentRole, DEFAULT_TIMESTAMP_TOLERANCE_S, type FixRuntimeConfig, type HeaderLookup, MessageType, type RisicareConfig, SemanticPhase, type SessionContext, type SessionOptions, Span, SpanKind, type SpanOptions, SpanStatus, type StartSpanOptions, type TraceContext, type TracedStreamOptions, Tracer, type VerifyWebhookOptions, type WebhookPayload, WebhookVerificationError, agent, disable, enable, extractTraceContext, flush, getCurrentAgent, getCurrentAgentId, getCurrentContext, getCurrentPhase, getCurrentSession, getCurrentSessionId, getCurrentSpan, getCurrentSpanId, getCurrentTraceId, getFixRuntime, getMetrics, getSpanById, getTraceContent, getTraceContext, getTracer, init, initFixRuntime, injectTraceContext, isEnabled, isProviderInstrumentationSuppressed, registerSpan, reportError, score, session, shutdown, shutdownFixRuntime, suppressProviderInstrumentation, traceAct, traceCoordinate, traceDecide, traceDelegate, traceMessage, traceObserve, traceThink, tracedStream, unregisterSpan, verifyWebhookSignature, withAgent, withPhase, withSession };
+export { type ActiveFix, type AgentContext, type AgentOptions, AgentRole, DEFAULT_TIMESTAMP_TOLERANCE_S, type FixRuntimeConfig, GuardRejectedError, type HeaderLookup, MessageType, type RisicareConfig, SemanticPhase, type SessionContext, type SessionOptions, Span, SpanKind, type SpanOptions, SpanStatus, type StartSpanOptions, type TraceContext, type TracedStreamOptions, Tracer, type VerifyWebhookOptions, type WebhookPayload, WebhookVerificationError, agent, disable, enable, extractTraceContext, flush, getCurrentAgent, getCurrentAgentId, getCurrentContext, getCurrentPhase, getCurrentSession, getCurrentSessionId, getCurrentSpan, getCurrentSpanId, getCurrentTraceId, getFixRuntime, getMetrics, getSpanById, getTraceContent, getTraceContext, getTracer, init, initFixRuntime, injectTraceContext, isEnabled, isProviderInstrumentationSuppressed, registerSpan, reportError, score, session, shutdown, shutdownFixRuntime, suppressProviderInstrumentation, traceAct, traceCoordinate, traceDecide, traceDelegate, traceMessage, traceObserve, traceThink, tracedStream, unregisterSpan, verifyWebhookSignature, withAgent, withPhase, withSession };

package/dist/index.d.ts

@@ -873,6 +873,13 @@ interface ApplyResult {
     fixType?: string;
     modifications: Record<string, unknown>;
     error?: string;
+    /**
+     * Guard-only: human-readable reason a guard failed (passed=false). Used
+     * by GuardRejectedError to surface an actionable message to the customer.
+     * `error` carries the raw exception text; `reason` carries the audit
+     * category ('guard_exception', 'content_filter', 'format_check', etc.).
+     */
+    reason?: string;
 }
 declare class FixApplier {
     private readonly _config;
@@ -1024,6 +1031,33 @@ declare class FixLoader {
  * Port of Python SDK's runtime/interceptors.py adapted for Node.js.
  */
 
+/**
+ * Thrown by the fix interceptor when a guard fix returns `passed: false`.
+ *
+ * PR-4+5 review B2 (2026-05-25): pre-fix, `applyGuardFix` returned
+ * `passed:false` correctly but no caller read `passed` — the provider
+ * patcher consumed `result.messages` / `result.params` and proceeded to the
+ * LLM with the attacker payload anyway. The `fail-CLOSED` was advisory only.
+ *
+ * Now the interceptor THROWS this error on both pre-call and post-call
+ * guard rejection. The provider patcher's surrounding span.startSpan
+ * already catches and records exceptions, so the customer sees a
+ * `GuardRejectedError` propagated out of their `openai.chat.completions.create`
+ * call — the LLM is NEVER invoked.
+ *
+ * Customers who want to handle rejection gracefully can:
+ *   try { await openai.chat.completions.create({ ... }); }
+ *   catch (e) {
+ *     if (e instanceof GuardRejectedError) { ... fallback ... }
+ *     else throw e;
+ *   }
+ */
+declare class GuardRejectedError extends Error {
+    readonly guardId: string;
+    readonly reason: string;
+    readonly phase: 'pre_call' | 'post_call';
+    constructor(guardId: string, reason: string, phase: 'pre_call' | 'post_call');
+}
 interface InterceptContext {
     /** Type of operation: "llm_call", "tool_call", "agent_delegate" */
     operationType: string;
@@ -1319,4 +1353,4 @@ type WebhookPayload = Uint8Array | ArrayBuffer | string;
  */
 declare function verifyWebhookSignature(payload: WebhookPayload, headers: HeaderLookup, secret: string, opts?: VerifyWebhookOptions): void;
 
-export { type ActiveFix, type AgentContext, type AgentOptions, AgentRole, DEFAULT_TIMESTAMP_TOLERANCE_S, type FixRuntimeConfig, type HeaderLookup, MessageType, type RisicareConfig, SemanticPhase, type SessionContext, type SessionOptions, Span, SpanKind, type SpanOptions, SpanStatus, type StartSpanOptions, type TraceContext, type TracedStreamOptions, Tracer, type VerifyWebhookOptions, type WebhookPayload, WebhookVerificationError, agent, disable, enable, extractTraceContext, flush, getCurrentAgent, getCurrentAgentId, getCurrentContext, getCurrentPhase, getCurrentSession, getCurrentSessionId, getCurrentSpan, getCurrentSpanId, getCurrentTraceId, getFixRuntime, getMetrics, getSpanById, getTraceContent, getTraceContext, getTracer, init, initFixRuntime, injectTraceContext, isEnabled, isProviderInstrumentationSuppressed, registerSpan, reportError, score, session, shutdown, shutdownFixRuntime, suppressProviderInstrumentation, traceAct, traceCoordinate, traceDecide, traceDelegate, traceMessage, traceObserve, traceThink, tracedStream, unregisterSpan, verifyWebhookSignature, withAgent, withPhase, withSession };
+export { type ActiveFix, type AgentContext, type AgentOptions, AgentRole, DEFAULT_TIMESTAMP_TOLERANCE_S, type FixRuntimeConfig, GuardRejectedError, type HeaderLookup, MessageType, type RisicareConfig, SemanticPhase, type SessionContext, type SessionOptions, Span, SpanKind, type SpanOptions, SpanStatus, type StartSpanOptions, type TraceContext, type TracedStreamOptions, Tracer, type VerifyWebhookOptions, type WebhookPayload, WebhookVerificationError, agent, disable, enable, extractTraceContext, flush, getCurrentAgent, getCurrentAgentId, getCurrentContext, getCurrentPhase, getCurrentSession, getCurrentSessionId, getCurrentSpan, getCurrentSpanId, getCurrentTraceId, getFixRuntime, getMetrics, getSpanById, getTraceContent, getTraceContext, getTracer, init, initFixRuntime, injectTraceContext, isEnabled, isProviderInstrumentationSuppressed, registerSpan, reportError, score, session, shutdown, shutdownFixRuntime, suppressProviderInstrumentation, traceAct, traceCoordinate, traceDecide, traceDelegate, traceMessage, traceObserve, traceThink, tracedStream, unregisterSpan, verifyWebhookSignature, withAgent, withPhase, withSession };