shrike-guard 1.3.1 → 4.0.0

package/LICENSE

@@ -48,7 +48,7 @@
       "Contribution" shall mean any work of authorship, including
       the original version of the Work and any modifications or additions
       to that Work or Derivative Works thereof, that is intentionally
-      submitted to the Licensor for inclusion in the Work by the copyright owner
+      submitted to Licensor for inclusion in the Work by the copyright owner
       or by an individual or Legal Entity authorized to submit on behalf of
       the copyright owner. For the purposes of this definition, "submitted"
       means any form of electronic, verbal, or written communication sent
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2024 Shrike Security
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

package/README.md

@@ -1,14 +1,10 @@
-# Shrike Guard — TypeScript SDK
-
-> **Public repo:** https://github.com/Shrike-Security/shrike-guard-js
->
-> This directory is mirrored from the public repository. For the latest version, issues, and contributions, please use the public repo.
+# Shrike Guard
 
 [![npm version](https://badge.fury.io/js/shrike-guard.svg)](https://badge.fury.io/js/shrike-guard)
 [![Node.js 18+](https://img.shields.io/badge/node-18+-green.svg)](https://nodejs.org/)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-**Shrike Guard** is a TypeScript SDK that provides security protection for your LLM applications. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically scan all prompts for security threats before they reach the LLM.
+**Shrike Guard** is a TypeScript SDK for the [Shrike](https://shrikesecurity.com) platform — AI governance for every AI interaction. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically evaluate all prompts against policy before they reach the LLM. Whether you're governing a customer-facing chatbot, securing developer AI tools, or managing autonomous agent actions — the same 9-layer cognitive pipeline evaluates every interaction.
 
 ## Features
 
@@ -19,11 +15,38 @@
   - Jailbreak attempts
   - SQL injection
   - Path traversal
-- **Fail-safe modes**: Choose between fail-open (default) or fail-closed behavior
+- **Fail-safe modes**: Defaults to fail-closed (Zero Trust posture); opt into fail-open explicitly when availability outranks enforcement
 - **CJS + ESM**: Dual build via tsup, works everywhere
 - **Subpath imports**: `shrike-guard/openai`, `shrike-guard/anthropic`, `shrike-guard/gemini`
 - **Zero code changes**: Just replace your import
 
+## What Shrike Detects
+
+Shrike's 9-layer cognitive pipeline includes sensitive-data detection aligned to 5 major regulatory frameworks:
+
+| Framework | Coverage |
+|-----------|----------|
+| **GDPR** | EU personal data — names, addresses, national IDs |
+| **HIPAA** | Protected health information (PHI) |
+| **ISO 27001** | Information security — passwords, tokens, certificates |
+| **SOC 2** | Secrets, credentials, API keys, cloud tokens |
+| **NIST** | AI risk management (IR 8596), cybersecurity framework (CSF 2.0) |
+
+Detection coverage is not a certification claim — see [shrikesecurity.com/compliance](https://shrikesecurity.com/compliance) for our current certification status. Plus built-in detection for prompt injection, jailbreaks, social engineering, and dangerous requests.
+
+### Tiers
+
+Detection depth depends on your tier. All tiers get the same SDK wrappers — tiers control which backend layers run.
+
+| | Anonymous | Community | Pro | Enterprise |
+|---|---|---|---|---|
+| Detection Layers | L1-L5 | L1-L7 | L1-L9 (full) | L1-L9 (full) |
+| API Key | Not needed | Free signup | Paid | Paid |
+| Rate Limit | — | 10/min | 100/min | 1,000/min |
+| Scans/month | — | 1,000 | 25,000 | 1,000,000 |
+
+**Anonymous** (no API key): Pattern-based detection (L1-L5). **Community** (free): Adds LLM-powered semantic analysis. Register at [shrikesecurity.com/signup](https://shrikesecurity.com/signup) — instant, no credit card.
+
 ## Installation
 
 ```bash
@@ -103,20 +126,22 @@ Choose how the SDK behaves when the security scan fails (timeout, network error,
 ```typescript
 import { ShrikeOpenAI } from 'shrike-guard/openai';
 
-// Fail-open (default): Allow requests if scan fails
-// Best for: Most applications where availability is important
+// Fail-closed (default): Block requests if scan fails
+// Best for: Production security workloads. If the Shrike backend is down,
+// the SDK raises ShrikeScanError instead of allowing traffic through unguarded.
 const client = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'open',
+  failMode: 'closed', // This is the default
 });
 
-// Fail-closed: Block requests if scan fails
-// Best for: Security-critical applications
-const strictClient = new ShrikeOpenAI({
+// Fail-open: Allow requests if scan fails
+// Best for: Non-production experiments, internal tools where availability must
+// outrank enforcement. Trades the guard's enforcement promise for uptime.
+const permissiveClient = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'closed',
+  failMode: 'open',
 });
 ```
 
@@ -132,18 +157,16 @@ const client = new ShrikeOpenAI({
 
 ### Custom Endpoint
 
-For enterprise customers with a dedicated Shrike deployment (VPC or single-tenant):
+For self-hosted Shrike deployments:
 
 ```typescript
 const client = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  shrikeEndpoint: 'https://your-org.shrike.internal',
+  shrikeEndpoint: 'https://your-shrike-instance.com',
 });
 ```
 
-Dedicated endpoints are provisioned by Shrike during enterprise onboarding. Contact sales@shrikesecurity.com for details.
-
 ## SQL and File Scanning
 
 The OpenAI client also provides standalone scanning for SQL queries and file paths:
@@ -233,20 +256,9 @@ if (result.safe) {
 export OPENAI_API_KEY="sk-..."
 export ANTHROPIC_API_KEY="sk-ant-..."
 export SHRIKE_API_KEY="shrike-..."
-export SHRIKE_ENDPOINT="https://your-org.shrike.internal"  # Enterprise/VPC deployments only
+export SHRIKE_ENDPOINT="https://your-shrike-instance.com"
 ```
 
-## Pricing Tiers
-
-| | Community (Free) | Pro ($99/mo) | Enterprise |
-|---|---|---|---|
-| Scans/month | 1,000 | 50,000 | Unlimited |
-| Detection layers | L1-L4 (regex) | L1-L8 (full pipeline) | L1-L8 + custom |
-| LLM analysis | No | Yes | Yes |
-| Rate limit | 10 req/min | 100 req/min | 1,000 req/min |
-
-Get a free Community API key at [shrikesecurity.com](https://api.shrikesecurity.com/dashboard/api/v1/community/register) or via [GCP Marketplace](https://console.cloud.google.com/marketplace/product/shrike-security/shrike).
-
 ## Scope and Limitations
 
 | Scanned | Not Scanned |
@@ -258,10 +270,43 @@ Get a free Community API key at [shrikesecurity.com](https://api.shrikesecurity.
 
 ### Why Input-Only Scanning?
 
-Shrike Guard focuses on **pre-flight protection** - blocking malicious prompts BEFORE they reach the LLM. This:
+Shrike Guard focuses on **pre-flight protection** — blocking malicious prompts BEFORE they reach the LLM. This:
 - Prevents prompt injection attacks at the source
 - Has zero latency impact on LLM responses
-- Catches 95%+ of threats (attacks are in the INPUT)
+- Catches the vast majority of threats at the input layer
+
+## Other Integration Surfaces
+
+Shrike Guard is one of several ways to integrate with the Shrike platform:
+
+- **MCP Server** — `npx shrike-mcp` ([GitHub](https://github.com/Shrike-Security/shrike-mcp))
+- **Python SDK** — `pip install shrike-guard` ([GitHub](https://github.com/Shrike-Security/shrike-guard-python))
+- **REST API** — `POST https://api.shrikesecurity.com/agent/scan`
+- **LLM Gateway** — Change one URL, scan everything
+- **Browser Extension** — Chrome/Edge for ChatGPT, Claude, Gemini
+- **Dashboard** — [shrikesecurity.com](https://shrikesecurity.com)
+
+## Use Cases
+
+| Scenario | How Shrike Guard Helps |
+|---|---|
+| **Customer chatbot** | Wrap your OpenAI/Anthropic client. Every user message scanned for injection before it reaches the model. |
+| **Internal RAG pipeline** | Scan retrieved context + user queries for PII leakage and injection attempts. |
+| **AI coding assistant** | Scan prompts for proprietary code patterns before they leave your environment. |
+| **Agent orchestration** | Scan every tool call and LLM request in your LangChain/CrewAI/AutoGen pipeline. |
+
+## Alternatives
+
+Looking for an AI security SDK? Here's how Shrike Guard compares:
+
+| Feature | Shrike Guard | Lakera | Prompt Armor |
+|---|---|---|---|
+| Drop-in OpenAI/Anthropic/Gemini wrapper | Yes | No | No |
+| 9-layer cognitive pipeline | Yes | Limited | Limited |
+| PII detection + redaction | Yes | Partial | No |
+| Session correlation | Yes (Pro+) | No | No |
+| Free tier (no API key) | Yes | No | No |
+| Open source client | Yes (Apache 2.0) | No | No |
 
 ## License
 
@@ -269,6 +314,8 @@ Apache 2.0
 
 ## Support
 
-- Documentation: https://docs.shrike.security/sdk/typescript
-- Issues: https://github.com/shrike-security/shrike-guard/issues
-- Email: support@shrikesecurity.com
+- [Shrike](https://shrikesecurity.com) — Sign up, dashboard, docs
+- [Documentation](https://shrikesecurity.com/docs) — Quick start, API reference
+- [GitHub Issues](https://github.com/Shrike-Security/shrike-guard-js/issues) — Bug reports
+- [MCP Server](https://github.com/Shrike-Security/shrike-mcp) — For MCP/agent integration
+- [Python SDK](https://github.com/Shrike-Security/shrike-guard-python) — Python equivalent

package/dist/anthropic/index.d.mts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-Bz7j8OSD.mjs';
+import { F as FailMode, S as ScanResult } from '../scanner-RWQR_jcB.mjs';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.d.ts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-Bz7j8OSD.js';
+import { F as FailMode, S as ScanResult } from '../scanner-RWQR_jcB.js';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.js

@@ -74,9 +74,11 @@ var THREAT_TYPE_MAP = {
   completion_baiting: "jailbreak",
   override: "jailbreak",
   manipulate: "jailbreak",
-  tonality_drift_profanity: "jailbreak",
+  // L8 tonality drift — backend normalizes profanity + hostile as toxic_content;
+  // casual stays as jailbreak (matches platform/common/models/response.go:309-313).
+  tonality_drift_profanity: "toxic_content",
+  tonality_drift_hostile: "toxic_content",
   tonality_drift_casual: "jailbreak",
-  tonality_drift_hostile: "jailbreak",
   // System prompt leak
   system_prompt_leak: "system_prompt_leak",
   system_prompt_extraction: "system_prompt_leak",
@@ -132,9 +134,11 @@ var THREAT_TYPE_MAP = {
   suspicious_tld: "blocked_domain",
   suspicious_domain: "blocked_domain",
   malicious_url: "blocked_domain",
-  // Toxicity
-  toxicity: "toxicity",
-  harmful_content: "toxicity",
+  // Toxic content (canonical name as of the L7 rewrite). `toxicity` kept as a
+  // legacy alias so older backend builds + customer code don't break.
+  toxic_content: "toxic_content",
+  toxicity: "toxic_content",
+  harmful_content: "toxic_content",
   // Malicious code
   malicious_content: "malicious_code",
   malicious_code: "malicious_code",
@@ -155,6 +159,12 @@ var THREAT_TYPE_MAP = {
   privilege_escalation: "privilege_escalation",
   // Destructive operation
   destructive_operation: "destructive_operation",
+  // L9 multi-turn correlation — the pseudo-category emitted when any
+  // multi_turn_* pattern fires (crescendo, blocked_retry, trust-building,
+  // memory_poisoning, etc.). The normalizeThreatType prefix check below
+  // handles the specific pattern names; this entry catches the pseudo
+  // value if the backend pre-normalizes.
+  multi_turn_attack: "multi_turn_attack",
   // Errors
   scan_error: "scan_error",
   size_limit_exceeded: "size_limit_exceeded",
@@ -171,7 +181,9 @@ var THREAT_GUIDANCE = {
   secrets_exposure: "This content contains patterns matching API keys, tokens, or credentials.",
   pii_exposure: "This content contains personally identifiable information.",
   blocked_domain: "This web search targets a restricted domain.",
+  toxic_content: "This content contains potentially harmful or inappropriate language.",
   toxicity: "This content contains potentially harmful or inappropriate language.",
+  multi_turn_attack: "A pattern was detected across multiple turns of this session that suggests a coordinated attempt to bypass safety controls.",
   malicious_code: "This content contains patterns associated with malicious code.",
   harmful_intent: "This request contains content associated with harmful intent.",
   social_engineering: "This prompt contains social engineering patterns.",
@@ -191,7 +203,9 @@ var THREAT_SEVERITY = {
   secrets_exposure: "critical",
   pii_exposure: "high",
   blocked_domain: "medium",
+  toxic_content: "medium",
   toxicity: "medium",
+  multi_turn_attack: "high",
   malicious_code: "critical",
   harmful_intent: "high",
   social_engineering: "medium",
@@ -201,12 +215,31 @@ var THREAT_SEVERITY = {
   size_limit_exceeded: "low",
   unknown: "medium"
 };
+var INTERNAL_FIELDS = /* @__PURE__ */ new Set([
+  "detected_by",
+  "policy_id",
+  "policy_name",
+  "matched_pattern",
+  "matched_text",
+  "pattern",
+  "scan_stage",
+  "ai_reasoning",
+  "llm_analysis",
+  "performance_metrics",
+  "performance"
+]);
 function normalizeThreatType(rawType) {
   if (!rawType) {
     return "unknown";
   }
   const normalized = rawType.toLowerCase().replace(/-/g, "_");
-  return THREAT_TYPE_MAP[normalized] || "unknown";
+  if (THREAT_TYPE_MAP[normalized]) {
+    return THREAT_TYPE_MAP[normalized];
+  }
+  if (normalized.startsWith("multi_turn_")) {
+    return "multi_turn_attack";
+  }
+  return "unknown";
 }
 function deriveSeverity(threatType, rawSeverity) {
   const validSeverities = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
@@ -227,20 +260,59 @@ function bucketConfidence(score) {
   }
   return "low";
 }
+var PRESERVED_GOVERNANCE_FIELDS = [
+  "action",
+  "refuse_tier",
+  "recovery",
+  "session_state",
+  "content_type",
+  "approval_info",
+  "client_session_rotation"
+];
+function sanitizeViolation(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const source = raw;
+  const out = {};
+  for (const [k, v] of Object.entries(source)) {
+    if (!INTERNAL_FIELDS.has(k)) {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 function sanitizeScanResponse(raw) {
   const safe = raw.safe !== false;
-  const approvalInfo = raw.approval_info;
+  const result = { safe };
+  for (const field of PRESERVED_GOVERNANCE_FIELDS) {
+    const value = raw[field];
+    if (value !== void 0 && value !== null) {
+      result[field] = value;
+    }
+  }
+  const rawViolations = raw.violations;
+  if (Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const cleaned = rawViolations.map((v) => sanitizeViolation(v)).filter((v) => v !== null);
+    if (cleaned.length > 0) {
+      result.violations = cleaned;
+    }
+  }
   if (safe) {
-    const result2 = {
-      safe: true,
-      reason: raw.reason || ""
-    };
-    if (approvalInfo) {
-      result2.approval_info = approvalInfo;
+    result.reason = raw.reason || "";
+    return result;
+  }
+  let rawThreatType = raw.threat_type;
+  if (!rawThreatType && Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const first = rawViolations[0];
+    if (first && typeof first === "object" && !Array.isArray(first)) {
+      const firstThreat = first.threat_type;
+      if (typeof firstThreat === "string") {
+        rawThreatType = firstThreat;
+      }
     }
-    return result2;
   }
-  const threatType = normalizeThreatType(raw.threat_type);
+  const threatType = normalizeThreatType(rawThreatType);
   const confidence = bucketConfidence(
     typeof raw.confidence === "number" ? raw.confidence : void 0
   );
@@ -249,22 +321,16 @@ function sanitizeScanResponse(raw) {
     typeof raw.severity === "string" ? raw.severity : void 0
   );
   const guidance = THREAT_GUIDANCE[threatType] || THREAT_GUIDANCE["unknown"];
-  const result = {
-    safe: false,
-    threat_type: threatType,
-    severity,
-    confidence,
-    reason: raw.reason || guidance,
-    guidance
-  };
-  if (approvalInfo) {
-    result.approval_info = approvalInfo;
-  }
+  result.threat_type = threatType;
+  result.severity = severity;
+  result.confidence = confidence;
+  result.reason = raw.reason || guidance;
+  result.guidance = guidance;
   return result;
 }
 
 // src/version.ts
-var VERSION = "1.3.1";
+var VERSION = "1.5.0";
 function generateUUID() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
     const r = Math.random() * 16 | 0;
@@ -281,11 +347,24 @@ function getScanHeaders(shrikeApiKey, requestId) {
     "X-Shrike-Request-ID": generateUUID()
   };
 }
+function isBlocked(verdict) {
+  const action = verdict.action;
+  if (typeof action === "string" && action.length > 0) {
+    if (action === "allow" || action === "warn") return false;
+    if (action === "block" || action === "require_approval") return true;
+  }
+  const safe = verdict.safe;
+  if (typeof safe === "boolean") {
+    return !safe;
+  }
+  return false;
+}
 function maybeAddSignupHint(result, apiKey) {
   if (apiKey) return result;
+  if (result.upgrade_hint) return result;
   return {
     ...result,
-    _note: "Running without API key (regex-only). For LLM-powered analysis and session correlation, run: npx shrike-mcp --signup"
+    _note: "Running without API key (L1-L5 only). Register free for cognitive threat detection: npx shrike-mcp --signup"
   };
 }
 
@@ -352,7 +431,7 @@ var ShrikeAnthropic = class {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this._scanTimeout);
     try {
-      const response = await fetch(`${this._shrikeEndpoint}/scan`, {
+      const response = await fetch(`${this._shrikeEndpoint}/api/scan/enforce`, {
         method: "POST",
         headers: getScanHeaders(this._shrikeApiKey),
         body: JSON.stringify({
@@ -411,7 +490,7 @@ var MessagesNamespace = class {
     const scanResult = await this._client._scanMessages(
       params.messages
     );
-    if (!scanResult.safe) {
+    if (isBlocked(scanResult)) {
       throw new ShrikeBlockedError(
         `Request blocked: ${scanResult.reason || "Security threat detected"}`,
         scanResult.threat_type,