shield360 1.1.0 → 1.2.0

package/dist/ai-security/events.js

@@ -0,0 +1,153 @@
+"use strict";
+/**
+ * AI security events: what a check found and what it did, sent to Shield360
+ * (POST /api/ai-security/events) in batches off the call path.
+ *
+ * An event carries the check, the kind of finding, the mode and the action
+ * taken, the app, the end customer (tenant and user ids as given: the
+ * platform keeps user ids only as a keyed hash) and per finding a kind, a
+ * masked token and a keyed fingerprint. Never the text that was checked.
+ *
+ * A batch that cannot be delivered is retried a few times and dropped; the
+ * decision was already taken. Repeated identical events (same check, kind,
+ * tool and customer) inside a few seconds are counted into one.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/ai_security/_events.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemorySink = exports.EventReporter = exports.AI_SECURITY_EVENT = void 0;
+const crypto_1 = require("crypto");
+const os_1 = require("os");
+const customer_1 = require("../customer");
+exports.AI_SECURITY_EVENT = 'shield360.ai_security.event';
+const BATCH = 100;
+const FLUSH_MS = 2000;
+const MAX_QUEUED = 5000;
+const ATTEMPTS = 3;
+const DEDUPE_MS = 5000;
+const MAX_DETAIL = 1000;
+class EventReporter {
+    constructor(endpoint, apiKey, app, environment, fetchImpl = fetch, now = Date.now) {
+        this.endpoint = endpoint;
+        this.apiKey = apiKey;
+        this.app = app;
+        this.environment = environment;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+        this.queue = [];
+        this.recent = new Map();
+        this.sending = Promise.resolve();
+        this.timer = setInterval(() => void this.flush(), FLUSH_MS);
+        this.timer.unref?.();
+    }
+    add(event) {
+        try {
+            const customer = (0, customer_1.getCustomer)();
+            const key = [event.check, event.kind, event.action, event.tool || '', event.server || '', customer?.tenantId || '', customer?.userId || ''].join('|');
+            const at = this.now();
+            const seen = this.recent.get(key);
+            if (seen && at - seen.at < DEDUPE_MS && this.queue.includes(seen)) {
+                seen.wire.attrs['shield360.ai_security.count'] = Number(seen.wire.attrs['shield360.ai_security.count'] || 1) + (event.count || 1);
+                return;
+            }
+            if (this.queue.length >= MAX_QUEUED)
+                return;
+            const attrs = {
+                'shield360.ai_security.event_id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
+                'shield360.ai_security.app': this.app,
+                'shield360.ai_security.check': event.check,
+                'shield360.ai_security.kind': event.kind,
+                'shield360.ai_security.mode': event.mode,
+                'shield360.ai_security.action': event.action,
+                'shield360.ai_security.count': event.count || 1,
+            };
+            const put = (k, v) => {
+                if (v === undefined || v === null || v === '')
+                    return;
+                attrs[`shield360.ai_security.${k}`] = typeof v === 'number' || typeof v === 'boolean' ? v : String(v).slice(0, MAX_DETAIL);
+            };
+            put('source', event.source);
+            if (typeof event.score === 'number')
+                put('score', Math.round(event.score * 1000) / 1000);
+            put('rules', event.rules?.join(','));
+            put('categories', event.categories?.join(','));
+            put('rules_version', event.rulesVersion);
+            put('tool', event.tool);
+            put('server', event.server);
+            put('detail', event.detail);
+            if (event.findings?.length) {
+                const kept = event.findings.slice(0, 10);
+                put('findings', JSON.stringify(kept));
+                put('fingerprints', kept.map((f) => f.fingerprint).filter(Boolean).join(','));
+            }
+            if (customer) {
+                attrs['shield360.customer.tenant_id'] = customer.tenantId;
+                if (customer.userId)
+                    attrs['shield360.customer.user_id'] = customer.userId;
+            }
+            const pending = { wire: { name: exports.AI_SECURITY_EVENT, time: new Date(at).toISOString(), attrs }, key, at };
+            this.queue.push(pending);
+            this.recent.set(key, pending);
+            if (this.recent.size > 2000)
+                this.recent.clear();
+        }
+        catch {
+            // Reporting never breaks a call.
+        }
+    }
+    flush() {
+        this.sending = this.sending.then(async () => {
+            while (this.queue.length) {
+                const batch = this.queue.splice(0, BATCH);
+                await this.post(batch.map((p) => p.wire));
+            }
+        });
+        return this.sending;
+    }
+    async post(batch) {
+        const body = JSON.stringify({
+            resource: { 'host.name': (0, os_1.hostname)(), 'deployment.environment': this.environment, 'service.name': this.app },
+            events: batch,
+        });
+        for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+            try {
+                const res = await this.fetchImpl(this.endpoint, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${this.apiKey}` },
+                    body,
+                });
+                if (res.ok)
+                    return;
+                if ([400, 401, 403, 413].includes(res.status))
+                    return;
+            }
+            catch {
+                // retried below
+            }
+            await new Promise((r) => setTimeout(r, 300 * (attempt + 1)).unref?.());
+        }
+    }
+    close() {
+        clearInterval(this.timer);
+        return this.flush();
+    }
+}
+exports.EventReporter = EventReporter;
+/** Collects events in memory: for tests, and when no Shield360 URL is configured. */
+class MemorySink {
+    constructor() {
+        this.events = [];
+    }
+    add(event) {
+        if (this.events.length < 10000)
+            this.events.push(event);
+    }
+    flush() {
+        return Promise.resolve();
+    }
+    close() {
+        return Promise.resolve();
+    }
+}
+exports.MemorySink = MemorySink;
+//# sourceMappingURL=events.js.map

package/dist/ai-security/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/ai-security/events.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,mCAAoC;AACpC,2BAA8B;AAC9B,0CAA0C;AAE7B,QAAA,iBAAiB,GAAG,6BAA6B,CAAC;AAsC/D,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,UAAU,GAAG,IAAI,CAAC;AAYxB,MAAa,aAAa;IAMxB,YACmB,QAAgB,EAChB,MAAc,EACd,GAAW,EACX,WAAmB,EACnB,YAA0B,KAAK,EAC/B,MAAoB,IAAI,CAAC,GAAG;QAL5B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QACX,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAAsB;QAC/B,QAAG,GAAH,GAAG,CAAyB;QAXvC,UAAK,GAAc,EAAE,CAAC;QACb,WAAM,GAAG,IAAI,GAAG,EAAmB,CAAC;QAE7C,YAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAUjD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,KAAsB;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,sBAAW,GAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtJ,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;gBAClI,OAAO;YACT,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU;gBAAE,OAAO;YAC5C,MAAM,KAAK,GAA8C;gBACvD,gCAAgC,EAAE,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChE,2BAA2B,EAAE,IAAI,CAAC,GAAG;gBACrC,6BAA6B,EAAE,KAAK,CAAC,KAAK;gBAC1C,4BAA4B,EAAE,KAAK,CAAC,IAAI;gBACxC,4BAA4B,EAAE,KAAK,CAAC,IAAI;gBACxC,8BAA8B,EAAE,KAAK,CAAC,MAAM;gBAC5C,6BAA6B,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;aAChD,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAU,EAAE,EAAE;gBACpC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;oBAAE,OAAO;gBACtD,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC7H,CAAC,CAAC;YACF,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACzF,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;YACzC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxB,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;gBACtC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,CAAC,8BAA8B,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBAC1D,IAAI,QAAQ,CAAC,MAAM;oBAAE,KAAK,CAAC,4BAA4B,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7E,CAAC;YACD,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,yBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;YACjH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAa;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAA,aAAQ,GAAE,EAAE,wBAAwB,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;YAC3G,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAC9C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACvF,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,EAAE;oBAAE,OAAO;gBACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,OAAO;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAvGD,sCAuGC;AAED,qFAAqF;AACrF,MAAa,UAAU;IAAvB;QACW,WAAM,GAAsB,EAAE,CAAC;IAU1C,CAAC;IATC,GAAG,CAAC,KAAsB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,KAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAXD,gCAWC"}

package/dist/ai-security/hooks.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Wires the AI security checks into the providers and frameworks the SDK
+ * knows, without changing their instrumentations (kept apart so the
+ * tracing and the security code can change independently):
+ *
+ *   OpenAI chat completions and responses, Anthropic messages
+ *     before the call   limits; jailbreak check of the user turns; indirect
+ *                       injection check of tool results in the messages
+ *                       (role "tool", function_call_output, tool_result
+ *                       blocks), stripped in place in enforce mode
+ *     after the call    output check (redacted in place in enforce mode),
+ *                       streamed answers through the bounded stream scanner;
+ *                       tokens and cost counted for limits
+ *   LangChain           retrievers (checkRetrieval, pageContent stripped in
+ *                       place) and tools (permission before, injection check
+ *                       of the result after)
+ *   LlamaIndex          retrievers
+ *   MCP client          listTools (pinning, poisoning), callTool (refused
+ *                       tools, permissions, injection check of text results)
+ *
+ * Every hook fails open: if anything inside it throws (other than a block
+ * the policy asked for), the call proceeds as if the hook were not there.
+ *
+ * Supported module loading: CommonJS require, and ESM imports that resolve
+ * to the same CommonJS build. Each patch function also takes the module
+ * object, for apps that load it another way.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/ai_security/_hooks.py
+ */
+type Prepared = {
+    params: any;
+    systemPrompt: string;
+};
+/** Checks and, in enforce mode, rewrites a request's messages. @internal exported for tests */
+export declare function prepareRequest(params: any, provider: 'openai' | 'anthropic'): Prepared;
+/** Checks a whole answer; redacts it in place. @internal exported for tests */
+export declare function finishResponse(response: any, prepared: Prepared): any;
+/** Wraps a streamed answer (OpenAI chunks or Anthropic events) with the stream scanner. @internal exported for tests */
+export declare function wrapStream(stream: any, prepared: Prepared): any;
+export declare function patchOpenAI(mod: any): string[];
+export declare function patchAnthropic(mod: any): string[];
+export declare function patchLangChainRetrievers(mod: any): string[];
+export declare function patchLangChainTools(mod: any): string[];
+export declare function patchLlamaIndex(mod: any): string[];
+export declare function patchMcpClient(mod: any): string[];
+/** Patches every installed module it knows. Returns what was wired. */
+export declare function setupAiSecurity(): string[];
+export {};

package/dist/ai-security/hooks.js

@@ -0,0 +1,461 @@
+"use strict";
+/**
+ * Wires the AI security checks into the providers and frameworks the SDK
+ * knows, without changing their instrumentations (kept apart so the
+ * tracing and the security code can change independently):
+ *
+ *   OpenAI chat completions and responses, Anthropic messages
+ *     before the call   limits; jailbreak check of the user turns; indirect
+ *                       injection check of tool results in the messages
+ *                       (role "tool", function_call_output, tool_result
+ *                       blocks), stripped in place in enforce mode
+ *     after the call    output check (redacted in place in enforce mode),
+ *                       streamed answers through the bounded stream scanner;
+ *                       tokens and cost counted for limits
+ *   LangChain           retrievers (checkRetrieval, pageContent stripped in
+ *                       place) and tools (permission before, injection check
+ *                       of the result after)
+ *   LlamaIndex          retrievers
+ *   MCP client          listTools (pinning, poisoning), callTool (refused
+ *                       tools, permissions, injection check of text results)
+ *
+ * Every hook fails open: if anything inside it throws (other than a block
+ * the policy asked for), the call proceeds as if the hook were not there.
+ *
+ * Supported module loading: CommonJS require, and ESM imports that resolve
+ * to the same CommonJS build. Each patch function also takes the module
+ * object, for apps that load it another way.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/ai_security/_hooks.py
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareRequest = prepareRequest;
+exports.finishResponse = finishResponse;
+exports.wrapStream = wrapStream;
+exports.patchOpenAI = patchOpenAI;
+exports.patchAnthropic = patchAnthropic;
+exports.patchLangChainRetrievers = patchLangChainRetrievers;
+exports.patchLangChainTools = patchLangChainTools;
+exports.patchLlamaIndex = patchLlamaIndex;
+exports.patchMcpClient = patchMcpClient;
+exports.setupAiSecurity = setupAiSecurity;
+const config_1 = __importDefault(require("../config"));
+const helpers_1 = __importDefault(require("../helpers"));
+const index_1 = require("./index");
+const tools_1 = require("./tools");
+const PATCHED = Symbol.for('shield360.aiSecurity.patched');
+function wrap(proto, method, make) {
+    if (!proto || typeof proto[method] !== 'function' || proto[method][PATCHED])
+        return false;
+    const original = proto[method];
+    const wrapped = make(original);
+    wrapped[PATCHED] = true;
+    proto[method] = wrapped;
+    return true;
+}
+const pass = (fn, fallback) => {
+    try {
+        return fn();
+    }
+    catch (e) {
+        if (e instanceof index_1.AiSecurityBlockedError)
+            throw e;
+        return fallback;
+    }
+};
+function textOf(content) {
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .map((b) => (typeof b === 'string' ? b : b && typeof b === 'object' && typeof b.text === 'string' ? b.text : ''))
+            .filter(Boolean)
+            .join('\n');
+    }
+    return '';
+}
+/** Checks and, in enforce mode, rewrites a request's messages. @internal exported for tests */
+function prepareRequest(params, provider) {
+    if (!params || typeof params !== 'object')
+        return { params, systemPrompt: '' };
+    (0, index_1.checkLimits)();
+    const out = { ...params };
+    const system = [];
+    const userTurns = [];
+    if (provider === 'anthropic')
+        system.push(textOf(params.system));
+    if (typeof params.instructions === 'string')
+        system.push(params.instructions);
+    const list = Array.isArray(params.messages) ? params.messages : Array.isArray(params.input) ? params.input : null;
+    if (typeof params.input === 'string')
+        userTurns.push(params.input);
+    if (list) {
+        const key = Array.isArray(params.messages) ? 'messages' : 'input';
+        out[key] = list.map((m) => {
+            if (!m || typeof m !== 'object')
+                return m;
+            const role = m.role;
+            if (role === 'system' || role === 'developer') {
+                system.push(textOf(m.content));
+                return m;
+            }
+            if (role === 'tool') {
+                const scan = (0, index_1.scanContext)(textOf(m.content), { source: 'tool_result', tool: m.name });
+                return scan.action === 'stripped' ? { ...m, content: scan.text } : m;
+            }
+            if (m.type === 'function_call_output' && typeof m.output === 'string') {
+                const scan = (0, index_1.scanContext)(m.output, { source: 'tool_result' });
+                return scan.action === 'stripped' ? { ...m, output: scan.text } : m;
+            }
+            if (role === 'user') {
+                if (Array.isArray(m.content)) {
+                    let changed = false;
+                    const blocks = m.content.map((b) => {
+                        if (b && b.type === 'tool_result') {
+                            const scan = (0, index_1.scanContext)(textOf(b.content), { source: 'tool_result' });
+                            if (scan.action === 'stripped') {
+                                changed = true;
+                                return { ...b, content: scan.text };
+                            }
+                            return b;
+                        }
+                        return b;
+                    });
+                    const text = m.content.filter((b) => b && b.type !== 'tool_result').map((b) => (typeof b === 'string' ? b : b?.text || '')).join('\n');
+                    if (text.trim())
+                        userTurns.push(text);
+                    return changed ? { ...m, content: blocks } : m;
+                }
+                userTurns.push(textOf(m.content));
+            }
+            return m;
+        });
+    }
+    if (userTurns.length)
+        (0, index_1.checkPrompt)(userTurns);
+    return { params: out, systemPrompt: system.filter(Boolean).join('\n') };
+}
+function outputTextAndSetter(response) {
+    if (Array.isArray(response?.choices)) {
+        const msg = response.choices[0]?.message;
+        if (msg && typeof msg.content === 'string')
+            return { text: msg.content, set: (t) => (msg.content = t) };
+        return null;
+    }
+    if (Array.isArray(response?.output)) {
+        const blocks = [];
+        for (const item of response.output)
+            if (Array.isArray(item?.content))
+                for (const b of item.content)
+                    if (typeof b?.text === 'string')
+                        blocks.push(b);
+        if (!blocks.length)
+            return null;
+        return {
+            text: blocks.map((b) => b.text).join('\n'),
+            set: (t) => {
+                blocks[0].text = t;
+                for (const b of blocks.slice(1))
+                    b.text = '';
+                if (typeof response.output_text === 'string')
+                    response.output_text = t;
+            },
+        };
+    }
+    if (Array.isArray(response?.content)) {
+        const blocks = response.content.filter((b) => typeof b?.text === 'string');
+        if (!blocks.length)
+            return null;
+        return {
+            text: blocks.map((b) => b.text).join('\n'),
+            set: (t) => {
+                blocks[0].text = t;
+                for (const b of blocks.slice(1))
+                    b.text = '';
+            },
+        };
+    }
+    return null;
+}
+function countUsage(params, response) {
+    pass(() => {
+        const u = response?.usage;
+        if (!u)
+            return (0, index_1.recordUsage)({ requests: 1 });
+        const input = Number(u.prompt_tokens ?? u.input_tokens ?? 0) || 0;
+        const output = Number(u.completion_tokens ?? u.output_tokens ?? 0) || 0;
+        const model = String(response?.model || params?.model || '');
+        let cost = 0;
+        try {
+            cost = helpers_1.default.getChatModelCost(model, config_1.default.pricingInfo, input, output) || 0;
+        }
+        catch {
+            cost = 0;
+        }
+        (0, index_1.recordUsage)({ requests: 1, tokens: input + output, costUsd: cost });
+    }, undefined);
+}
+/** Checks a whole answer; redacts it in place. @internal exported for tests */
+function finishResponse(response, prepared) {
+    const target = pass(() => outputTextAndSetter(response), null);
+    if (target && target.text) {
+        const res = (0, index_1.scanOutput)(target.text, { systemPrompt: prepared.systemPrompt });
+        if (res.action === 'redacted')
+            pass(() => target.set(res.text), undefined);
+    }
+    countUsage(prepared.params, response);
+    return response;
+}
+/** Wraps a streamed answer (OpenAI chunks or Anthropic events) with the stream scanner. @internal exported for tests */
+function wrapStream(stream, prepared) {
+    if (!stream || typeof stream[Symbol.asyncIterator] !== 'function')
+        return stream;
+    const scanner = (0, index_1.streamScanner)({ systemPrompt: prepared.systemPrompt });
+    const source = stream;
+    let usage = null;
+    let model = '';
+    async function* iterate() {
+        let last = null;
+        for await (const chunk of source) {
+            last = chunk;
+            if (chunk?.usage)
+                usage = chunk.usage;
+            if (chunk?.model)
+                model = chunk.model;
+            if (chunk?.type === 'message_delta' && chunk.usage)
+                usage = { ...(usage || {}), ...chunk.usage };
+            if (chunk?.type === 'message_start' && chunk.message?.usage)
+                usage = chunk.message.usage;
+            // OpenAI chat completion chunk
+            const delta = chunk?.choices?.[0]?.delta;
+            if (delta && typeof delta.content === 'string') {
+                let text = scanner.push(delta.content);
+                if (chunk.choices[0].finish_reason)
+                    text += scanner.end();
+                delta.content = text;
+                yield chunk;
+                continue;
+            }
+            if (chunk?.choices?.[0]?.finish_reason) {
+                const rest = scanner.end();
+                if (rest && chunk.choices[0].delta)
+                    chunk.choices[0].delta.content = rest;
+                yield chunk;
+                continue;
+            }
+            // Anthropic events
+            if (chunk?.type === 'content_block_delta' && typeof chunk.delta?.text === 'string') {
+                chunk.delta.text = scanner.push(chunk.delta.text);
+                yield chunk;
+                continue;
+            }
+            if (chunk?.type === 'content_block_stop' || chunk?.type === 'message_stop') {
+                const rest = scanner.end();
+                if (rest)
+                    yield { type: 'content_block_delta', index: chunk.index ?? 0, delta: { type: 'text_delta', text: rest } };
+                yield chunk;
+                continue;
+            }
+            // OpenAI responses stream
+            if (chunk?.type === 'response.output_text.delta' && typeof chunk.delta === 'string') {
+                chunk.delta = scanner.push(chunk.delta);
+                yield chunk;
+                continue;
+            }
+            if (chunk?.type === 'response.output_text.done' || chunk?.type === 'response.completed') {
+                const rest = scanner.end();
+                if (rest)
+                    yield { type: 'response.output_text.delta', delta: rest };
+                yield chunk;
+                continue;
+            }
+            yield chunk;
+        }
+        const rest = scanner.end();
+        if (rest && last?.choices)
+            yield { ...last, choices: [{ index: 0, delta: { content: rest }, finish_reason: null }] };
+        countUsage({ ...prepared.params, model: model || prepared.params?.model }, { usage, model });
+    }
+    const wrapped = Object.create(source);
+    wrapped[Symbol.asyncIterator] = () => iterate();
+    return wrapped;
+}
+function providerWrapper(provider) {
+    return (original) => async function (...args) {
+        let prepared = { params: args[0], systemPrompt: '' };
+        prepared = pass(() => prepareRequest(args[0], provider), prepared);
+        args[0] = prepared.params;
+        const response = await original.apply(this, args);
+        if (prepared.params?.stream === true)
+            return pass(() => wrapStream(response, prepared), response);
+        return pass(() => finishResponse(response, prepared), response);
+    };
+}
+function patchOpenAI(mod) {
+    const done = [];
+    const OpenAI = mod?.OpenAI || mod?.default || mod;
+    if (wrap(OpenAI?.Chat?.Completions?.prototype, 'create', providerWrapper('openai')))
+        done.push('openai.chat.completions');
+    if (wrap(OpenAI?.Responses?.prototype, 'create', providerWrapper('openai')))
+        done.push('openai.responses');
+    return done;
+}
+function patchAnthropic(mod) {
+    const Anthropic = mod?.Anthropic || mod?.default || mod;
+    return wrap(Anthropic?.Messages?.prototype, 'create', providerWrapper('anthropic')) ? ['anthropic.messages'] : [];
+}
+// ---------------------------------------------------------------------------
+// LangChain.
+function patchLangChainRetrievers(mod) {
+    const BaseRetriever = mod?.BaseRetriever;
+    const ok = wrap(BaseRetriever?.prototype, 'invoke', (original) => async function (input, ...rest) {
+        const docs = await original.call(this, input, ...rest);
+        if (!Array.isArray(docs))
+            return docs;
+        const query = typeof input === 'string' ? input : typeof input?.query === 'string' ? input.query : '';
+        const res = (0, index_1.checkRetrieval)(docs, {
+            query,
+            toChunk: (d) => ({ text: String(d?.pageContent ?? ''), id: d?.id, metadata: d?.metadata }),
+            setText: (d, t) => {
+                d.pageContent = t;
+                return d;
+            },
+        });
+        return res.chunks;
+    });
+    return ok ? ['langchain.retriever'] : [];
+}
+function patchLangChainTools(mod) {
+    const StructuredTool = mod?.StructuredTool;
+    const ok = wrap(StructuredTool?.prototype, 'invoke', (original) => async function (input, ...rest) {
+        const name = String(this?.name || 'tool');
+        const d = pass(() => (0, index_1.authorizeTool)(name), { runs: true });
+        if (!d.runs)
+            return JSON.stringify({ error: 'permission_denied', tool: name, message: tools_1.TOOL_DENIED_MESSAGE });
+        const result = await original.call(this, input, ...rest);
+        if (typeof result === 'string') {
+            const scan = (0, index_1.scanContext)(result, { source: 'tool_result', tool: name });
+            return scan.action === 'stripped' ? scan.text : result;
+        }
+        if (result && typeof result === 'object' && typeof result.content === 'string') {
+            const scan = (0, index_1.scanContext)(result.content, { source: 'tool_result', tool: name });
+            if (scan.action === 'stripped')
+                result.content = scan.text;
+        }
+        return result;
+    });
+    return ok ? ['langchain.tool'] : [];
+}
+// ---------------------------------------------------------------------------
+// LlamaIndex.
+function patchLlamaIndex(mod) {
+    const BaseRetriever = mod?.BaseRetriever;
+    const ok = wrap(BaseRetriever?.prototype, 'retrieve', (original) => async function (params, ...rest) {
+        const nodes = await original.call(this, params, ...rest);
+        if (!Array.isArray(nodes))
+            return nodes;
+        const query = typeof params === 'string' ? params : typeof params?.query === 'string' ? params.query : '';
+        const textOfNode = (n) => {
+            const node = n?.node ?? n;
+            if (typeof node?.text === 'string')
+                return node.text;
+            try {
+                return typeof node?.getContent === 'function' ? String(node.getContent()) : '';
+            }
+            catch {
+                return '';
+            }
+        };
+        const res = (0, index_1.checkRetrieval)(nodes, {
+            query,
+            toChunk: (n) => ({ text: textOfNode(n), id: (n?.node ?? n)?.id_ ?? (n?.node ?? n)?.id, metadata: (n?.node ?? n)?.metadata }),
+            setText: (n, t) => {
+                const node = n?.node ?? n;
+                if (node && typeof node.text === 'string')
+                    node.text = t;
+                return n;
+            },
+        });
+        return res.chunks;
+    });
+    return ok ? ['llamaindex.retriever'] : [];
+}
+// ---------------------------------------------------------------------------
+// MCP client.
+function serverOf(client) {
+    try {
+        const info = typeof client?.getServerVersion === 'function' ? client.getServerVersion() : null;
+        if (info?.name)
+            return { name: String(info.name), version: info.version ? String(info.version) : undefined };
+    }
+    catch {
+        // unknown
+    }
+    return { name: 'unknown' };
+}
+function patchMcpClient(mod) {
+    const Client = mod?.Client;
+    const done = [];
+    if (wrap(Client?.prototype, 'listTools', (original) => async function (...args) {
+        const result = await original.apply(this, args);
+        if (!result || !Array.isArray(result.tools))
+            return result;
+        const { tools } = (0, index_1.checkMcpTools)(serverOf(this), result.tools);
+        return tools.length === result.tools.length ? result : { ...result, tools };
+    }))
+        done.push('mcp.listTools');
+    if (wrap(Client?.prototype, 'callTool', (original) => async function (params, ...rest) {
+        const server = serverOf(this).name;
+        const name = String(params?.name || '');
+        const refused = (message) => ({ isError: true, content: [{ type: 'text', text: message }] });
+        if (pass(() => (0, index_1.mcpCallRefused)(server, name), false))
+            return refused('This tool is not approved for use.');
+        const d = pass(() => (0, index_1.authorizeTool)(name), { runs: true });
+        if (!d.runs)
+            return refused(tools_1.TOOL_DENIED_MESSAGE);
+        const result = await original.call(this, params, ...rest);
+        if (result && Array.isArray(result.content)) {
+            let changed = false;
+            const content = result.content.map((b) => {
+                if (b?.type !== 'text' || typeof b.text !== 'string')
+                    return b;
+                const scan = (0, index_1.scanContext)(b.text, { source: 'tool_result', tool: name });
+                if (scan.action !== 'stripped')
+                    return b;
+                changed = true;
+                return { ...b, text: scan.text };
+            });
+            return changed ? { ...result, content } : result;
+        }
+        return result;
+    }))
+        done.push('mcp.callTool');
+    return done;
+}
+// ---------------------------------------------------------------------------
+const MODULES = [
+    ['openai', patchOpenAI],
+    ['@anthropic-ai/sdk', patchAnthropic],
+    ['@langchain/core/retrievers', patchLangChainRetrievers],
+    ['@langchain/core/tools', patchLangChainTools],
+    ['llamaindex', patchLlamaIndex],
+    ['@modelcontextprotocol/sdk/client/index.js', patchMcpClient],
+];
+/** Patches every installed module it knows. Returns what was wired. */
+function setupAiSecurity() {
+    const done = [];
+    for (const [name, patch] of MODULES) {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            done.push(...patch(require(name)));
+        }
+        catch {
+            // not installed
+        }
+    }
+    return done;
+}
+//# sourceMappingURL=hooks.js.map