shrike-guard 1.3.3 → 4.0.0

package/README.md

@@ -4,7 +4,7 @@
 [![Node.js 18+](https://img.shields.io/badge/node-18+-green.svg)](https://nodejs.org/)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-**Shrike Guard** is a TypeScript SDK for the [Shrike](https://shrikesecurity.com) platform — AI governance for every AI interaction. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically evaluate all prompts against policy before they reach the LLM. Whether you're governing a customer-facing chatbot, securing developer AI tools, or managing autonomous agent actions — the same multi-layered cognitive pipeline evaluates every interaction.
+**Shrike Guard** is a TypeScript SDK for the [Shrike](https://shrikesecurity.com) platform — AI governance for every AI interaction. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically evaluate all prompts against policy before they reach the LLM. Whether you're governing a customer-facing chatbot, securing developer AI tools, or managing autonomous agent actions — the same 9-layer cognitive pipeline evaluates every interaction.
 
 ## Features
 
@@ -15,14 +15,14 @@
   - Jailbreak attempts
   - SQL injection
   - Path traversal
-- **Fail-safe modes**: Choose between fail-open (default) or fail-closed behavior
+- **Fail-safe modes**: Defaults to fail-closed (Zero Trust posture); opt into fail-open explicitly when availability outranks enforcement
 - **CJS + ESM**: Dual build via tsup, works everywhere
 - **Subpath imports**: `shrike-guard/openai`, `shrike-guard/anthropic`, `shrike-guard/gemini`
 - **Zero code changes**: Just replace your import
 
 ## What Shrike Detects
 
-Shrike's backend runs a multi-stage detection pipeline with security rules across **7 compliance frameworks**:
+Shrike's 9-layer cognitive pipeline includes sensitive-data detection aligned to 5 major regulatory frameworks:
 
 | Framework | Coverage |
 |-----------|----------|
@@ -31,10 +31,8 @@ Shrike's backend runs a multi-stage detection pipeline with security rules acros
 | **ISO 27001** | Information security — passwords, tokens, certificates |
 | **SOC 2** | Secrets, credentials, API keys, cloud tokens |
 | **NIST** | AI risk management (IR 8596), cybersecurity framework (CSF 2.0) |
-| **PCI-DSS** | Cardholder data — PAN, CVV, expiry, track data |
-| **WebMCP** | MCP tool description injection, data exfiltration |
 
-Plus built-in detection for prompt injection, jailbreaks, social engineering, and dangerous requests.
+Detection coverage is not a certification claim — see [shrikesecurity.com/compliance](https://shrikesecurity.com/compliance) for our current certification status. Plus built-in detection for prompt injection, jailbreaks, social engineering, and dangerous requests.
 
 ### Tiers
 
@@ -42,7 +40,7 @@ Detection depth depends on your tier. All tiers get the same SDK wrappers — ti
 
 | | Anonymous | Community | Pro | Enterprise |
 |---|---|---|---|---|
-| Detection Layers | L1-L5 | L1-L7 | L1-L8 | L1-L9 |
+| Detection Layers | L1-L5 | L1-L7 | L1-L9 (full) | L1-L9 (full) |
 | API Key | Not needed | Free signup | Paid | Paid |
 | Rate Limit | — | 10/min | 100/min | 1,000/min |
 | Scans/month | — | 1,000 | 25,000 | 1,000,000 |
@@ -128,20 +126,22 @@ Choose how the SDK behaves when the security scan fails (timeout, network error,
 ```typescript
 import { ShrikeOpenAI } from 'shrike-guard/openai';
 
-// Fail-open (default): Allow requests if scan fails
-// Best for: Most applications where availability is important
+// Fail-closed (default): Block requests if scan fails
+// Best for: Production security workloads. If the Shrike backend is down,
+// the SDK raises ShrikeScanError instead of allowing traffic through unguarded.
 const client = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'open',
+  failMode: 'closed', // This is the default
 });
 
-// Fail-closed: Block requests if scan fails
-// Best for: Security-critical applications
-const strictClient = new ShrikeOpenAI({
+// Fail-open: Allow requests if scan fails
+// Best for: Non-production experiments, internal tools where availability must
+// outrank enforcement. Trades the guard's enforcement promise for uptime.
+const permissiveClient = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'closed',
+  failMode: 'open',
 });
 ```
 
@@ -302,9 +302,9 @@ Looking for an AI security SDK? Here's how Shrike Guard compares:
 | Feature | Shrike Guard | Lakera | Prompt Armor |
 |---|---|---|---|
 | Drop-in OpenAI/Anthropic/Gemini wrapper | Yes | No | No |
-| Multi-layered evaluation pipeline | Yes | Limited | Limited |
+| 9-layer cognitive pipeline | Yes | Limited | Limited |
 | PII detection + redaction | Yes | Partial | No |
-| Session correlation | Yes (Enterprise) | No | No |
+| Session correlation | Yes (Pro+) | No | No |
 | Free tier (no API key) | Yes | No | No |
 | Open source client | Yes (Apache 2.0) | No | No |
 

package/dist/anthropic/index.d.mts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-CkCXFY3H.mjs';
+import { F as FailMode, S as ScanResult } from '../scanner-RWQR_jcB.mjs';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.d.ts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-CkCXFY3H.js';
+import { F as FailMode, S as ScanResult } from '../scanner-RWQR_jcB.js';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.js

@@ -74,9 +74,11 @@ var THREAT_TYPE_MAP = {
   completion_baiting: "jailbreak",
   override: "jailbreak",
   manipulate: "jailbreak",
-  tonality_drift_profanity: "jailbreak",
+  // L8 tonality drift — backend normalizes profanity + hostile as toxic_content;
+  // casual stays as jailbreak (matches platform/common/models/response.go:309-313).
+  tonality_drift_profanity: "toxic_content",
+  tonality_drift_hostile: "toxic_content",
   tonality_drift_casual: "jailbreak",
-  tonality_drift_hostile: "jailbreak",
   // System prompt leak
   system_prompt_leak: "system_prompt_leak",
   system_prompt_extraction: "system_prompt_leak",
@@ -132,9 +134,11 @@ var THREAT_TYPE_MAP = {
   suspicious_tld: "blocked_domain",
   suspicious_domain: "blocked_domain",
   malicious_url: "blocked_domain",
-  // Toxicity
-  toxicity: "toxicity",
-  harmful_content: "toxicity",
+  // Toxic content (canonical name as of the L7 rewrite). `toxicity` kept as a
+  // legacy alias so older backend builds + customer code don't break.
+  toxic_content: "toxic_content",
+  toxicity: "toxic_content",
+  harmful_content: "toxic_content",
   // Malicious code
   malicious_content: "malicious_code",
   malicious_code: "malicious_code",
@@ -155,6 +159,12 @@ var THREAT_TYPE_MAP = {
   privilege_escalation: "privilege_escalation",
   // Destructive operation
   destructive_operation: "destructive_operation",
+  // L9 multi-turn correlation — the pseudo-category emitted when any
+  // multi_turn_* pattern fires (crescendo, blocked_retry, trust-building,
+  // memory_poisoning, etc.). The normalizeThreatType prefix check below
+  // handles the specific pattern names; this entry catches the pseudo
+  // value if the backend pre-normalizes.
+  multi_turn_attack: "multi_turn_attack",
   // Errors
   scan_error: "scan_error",
   size_limit_exceeded: "size_limit_exceeded",
@@ -171,7 +181,9 @@ var THREAT_GUIDANCE = {
   secrets_exposure: "This content contains patterns matching API keys, tokens, or credentials.",
   pii_exposure: "This content contains personally identifiable information.",
   blocked_domain: "This web search targets a restricted domain.",
+  toxic_content: "This content contains potentially harmful or inappropriate language.",
   toxicity: "This content contains potentially harmful or inappropriate language.",
+  multi_turn_attack: "A pattern was detected across multiple turns of this session that suggests a coordinated attempt to bypass safety controls.",
   malicious_code: "This content contains patterns associated with malicious code.",
   harmful_intent: "This request contains content associated with harmful intent.",
   social_engineering: "This prompt contains social engineering patterns.",
@@ -191,7 +203,9 @@ var THREAT_SEVERITY = {
   secrets_exposure: "critical",
   pii_exposure: "high",
   blocked_domain: "medium",
+  toxic_content: "medium",
   toxicity: "medium",
+  multi_turn_attack: "high",
   malicious_code: "critical",
   harmful_intent: "high",
   social_engineering: "medium",
@@ -201,12 +215,31 @@ var THREAT_SEVERITY = {
   size_limit_exceeded: "low",
   unknown: "medium"
 };
+var INTERNAL_FIELDS = /* @__PURE__ */ new Set([
+  "detected_by",
+  "policy_id",
+  "policy_name",
+  "matched_pattern",
+  "matched_text",
+  "pattern",
+  "scan_stage",
+  "ai_reasoning",
+  "llm_analysis",
+  "performance_metrics",
+  "performance"
+]);
 function normalizeThreatType(rawType) {
   if (!rawType) {
     return "unknown";
   }
   const normalized = rawType.toLowerCase().replace(/-/g, "_");
-  return THREAT_TYPE_MAP[normalized] || "unknown";
+  if (THREAT_TYPE_MAP[normalized]) {
+    return THREAT_TYPE_MAP[normalized];
+  }
+  if (normalized.startsWith("multi_turn_")) {
+    return "multi_turn_attack";
+  }
+  return "unknown";
 }
 function deriveSeverity(threatType, rawSeverity) {
   const validSeverities = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
@@ -227,20 +260,59 @@ function bucketConfidence(score) {
   }
   return "low";
 }
+var PRESERVED_GOVERNANCE_FIELDS = [
+  "action",
+  "refuse_tier",
+  "recovery",
+  "session_state",
+  "content_type",
+  "approval_info",
+  "client_session_rotation"
+];
+function sanitizeViolation(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const source = raw;
+  const out = {};
+  for (const [k, v] of Object.entries(source)) {
+    if (!INTERNAL_FIELDS.has(k)) {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 function sanitizeScanResponse(raw) {
   const safe = raw.safe !== false;
-  const approvalInfo = raw.approval_info;
+  const result = { safe };
+  for (const field of PRESERVED_GOVERNANCE_FIELDS) {
+    const value = raw[field];
+    if (value !== void 0 && value !== null) {
+      result[field] = value;
+    }
+  }
+  const rawViolations = raw.violations;
+  if (Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const cleaned = rawViolations.map((v) => sanitizeViolation(v)).filter((v) => v !== null);
+    if (cleaned.length > 0) {
+      result.violations = cleaned;
+    }
+  }
   if (safe) {
-    const result2 = {
-      safe: true,
-      reason: raw.reason || ""
-    };
-    if (approvalInfo) {
-      result2.approval_info = approvalInfo;
+    result.reason = raw.reason || "";
+    return result;
+  }
+  let rawThreatType = raw.threat_type;
+  if (!rawThreatType && Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const first = rawViolations[0];
+    if (first && typeof first === "object" && !Array.isArray(first)) {
+      const firstThreat = first.threat_type;
+      if (typeof firstThreat === "string") {
+        rawThreatType = firstThreat;
+      }
     }
-    return result2;
   }
-  const threatType = normalizeThreatType(raw.threat_type);
+  const threatType = normalizeThreatType(rawThreatType);
   const confidence = bucketConfidence(
     typeof raw.confidence === "number" ? raw.confidence : void 0
   );
@@ -249,22 +321,16 @@ function sanitizeScanResponse(raw) {
     typeof raw.severity === "string" ? raw.severity : void 0
   );
   const guidance = THREAT_GUIDANCE[threatType] || THREAT_GUIDANCE["unknown"];
-  const result = {
-    safe: false,
-    threat_type: threatType,
-    severity,
-    confidence,
-    reason: raw.reason || guidance,
-    guidance
-  };
-  if (approvalInfo) {
-    result.approval_info = approvalInfo;
-  }
+  result.threat_type = threatType;
+  result.severity = severity;
+  result.confidence = confidence;
+  result.reason = raw.reason || guidance;
+  result.guidance = guidance;
   return result;
 }
 
 // src/version.ts
-var VERSION = "1.3.1";
+var VERSION = "1.5.0";
 function generateUUID() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
     const r = Math.random() * 16 | 0;
@@ -281,6 +347,18 @@ function getScanHeaders(shrikeApiKey, requestId) {
     "X-Shrike-Request-ID": generateUUID()
   };
 }
+function isBlocked(verdict) {
+  const action = verdict.action;
+  if (typeof action === "string" && action.length > 0) {
+    if (action === "allow" || action === "warn") return false;
+    if (action === "block" || action === "require_approval") return true;
+  }
+  const safe = verdict.safe;
+  if (typeof safe === "boolean") {
+    return !safe;
+  }
+  return false;
+}
 function maybeAddSignupHint(result, apiKey) {
   if (apiKey) return result;
   if (result.upgrade_hint) return result;
@@ -353,7 +431,7 @@ var ShrikeAnthropic = class {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this._scanTimeout);
     try {
-      const response = await fetch(`${this._shrikeEndpoint}/scan`, {
+      const response = await fetch(`${this._shrikeEndpoint}/api/scan/enforce`, {
         method: "POST",
         headers: getScanHeaders(this._shrikeApiKey),
         body: JSON.stringify({
@@ -412,7 +490,7 @@ var MessagesNamespace = class {
     const scanResult = await this._client._scanMessages(
       params.messages
     );
-    if (!scanResult.safe) {
+    if (isBlocked(scanResult)) {
       throw new ShrikeBlockedError(
         `Request blocked: ${scanResult.reason || "Security threat detected"}`,
         scanResult.threat_type,