shrike-guard 1.3.3 → 4.0.2

package/CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+## [4.0.2] - 2026-07-16
+
+### Security
+- **Fail-open verdicts now carry `degraded: true` on every provider wrapper.** Previously the OpenAI, Anthropic, and Gemini wrappers returned a plain allow verdict when `failMode: 'open'` was set and the backend was unreachable, so a caller could not distinguish "scanned and clean" from "not scanned, enforcement skipped." All fail-open returns now route through a single `failOpenResult()` constructor, and `degraded?: boolean` is part of the exported `ScanResult` type. The default remains fail-**closed**; this affects only callers who explicitly opt into fail-open.
+
+### Fixed
+- **Gemini wrapper now works against `@google/genai`.** It previously required `@google/genai` but instantiated the legacy `@google/generative-ai` class (`GoogleGenerativeAI`) and called `getGenerativeModel()`, so it threw at construction against the package it declared. Migrated to the current v2 SDK surface (`GoogleGenAI` + `ai.models.generateContent(...)` / `ai.chats.create(...)`); the public `getGenerativeModel().generateContent()` facade is unchanged. Dependency raised to `@google/genai >=1.0.0` (tested against 2.12). Added a real-package shape test so an SDK rename can't silently ship broken again.
+- Corrected the `ShrikeScanError` docstring, which incorrectly described `fail_mode='open'` as the default. The default is `fail_mode='closed'` (secure by default across the 4.x line) — behavior unchanged; documentation-only. (Supersedes the unreleased 4.0.1.)
+
+## [4.0.0] - 2026-07-13
+
+### Version alignment (no breaking changes)
+All Shrike client surfaces — MCP server (`shrike-mcp`), TypeScript SDK, and Python SDK — now share a single version line starting at 4.0.0. The major-version jump from 1.5.0 signals the alignment, not an API break: every 1.5.0 program runs unchanged on 4.0.0.
+
+### Added
+- **Client-side auto-chunk for large inputs.** Prompts over 20KB are automatically split on natural boundaries (paragraph → line → hard cut) into ~8KB chunks and scanned sequentially with fail-fast on the first blocking verdict. Applies to `ScanClient.scan()`. New `chunker` module exports `AUTO_CHUNK_THRESHOLD`, `CHUNK_TARGET_SIZE`, `chunkContent()`, and `aggregateChunkResults()` for callers who want to drive chunking directly.
+- **Aggregation contract:** worst-action wins across chunks; violations dedup by (threat_type, severity, action); `session_state` from the last scanned chunk; `recovery` from the first blocking chunk.
+
+### Why
+Large single-shot scan inputs (agent transcripts, RAG context dumps, file contents) previously rode through the cascade as one oversized request — slower verdicts and more LLM-layer tokens burned per scan. Chunked inputs land in the backend cascade's small-content band, which allows earlier early-exit on clean content and cheaper verdicts on both sides of the wire. Fail-fast on the first blocked chunk means a threat at the top of a large document blocks without paying to scan the rest.
+
+## [1.5.0] - 2026-07-06
+
+### Added
+- **Resilience primitives — `CircuitBreaker`, `CircuitOpenError`, `CircuitState`, `retryWithBackoff`** (mirrors Python SDK). Three-state breaker with configurable `failureThreshold` (5), `successThreshold` (2), `timeout` (30s), and `maxHalfOpenRequests` (3). Under a partial backend outage the breaker short-circuits repeated failures fast rather than letting `fail_mode: "closed"` produce a blocked-response storm. `retryWithBackoff` treats `CircuitOpenError` as non-retryable by default.
+- **`AuthClient` re-exported at package root** (previously only reachable via `shrike-guard/api`). Matches the Python SDK's placement — `import { AuthClient } from 'shrike-guard'` now works.
+
+### Why
+Cross-language SDK parity. The Python SDK ships `CircuitBreaker` + `retry_with_backoff`; this brings the TypeScript SDK to feature-equivalence so customers flipping between languages see identical failure semantics under real outage conditions.
+
+## [1.4.0] - 2026-07-02
+
+### Added
+- **Client-side PII redaction.** `redactPII()`, `rehydratePII()`, `getRedactionSummary()`, `updatePIIPatterns()`, and `getPIIPatternCount()` exported from the root entry point. Detects and tokenizes 20+ PII types (SSN, credit card, email, phone, address, medical record, wallet, etc.) BEFORE the prompt leaves customer environment — Shrike backend never sees the raw PII.
+- **`syncPIIPatterns({ endpoint, apiKey })`** — one-shot startup call fetches the canonical Presidio-derived pattern set from the Shrike backend so client-side detection stays uniform with the server-side scan. Fails safe: on any error (network / timeout / malformed) the bootstrap patterns stay in place; sync never blocks scans.
+- **Backend-owned prefix contract.** The recognizer ships its client-side redaction tag (e.g. `[IP_1]`) as part of the pattern payload; the client uses it verbatim. When the backend omits the field (pre-2026-07-02 releases), the SDK derives the prefix from the threat_type. No pattern is ever silently dropped for an unmapped prefix. Adding a new backend pattern requires zero SDK changes.
+
+### Why
+Client-side redaction removes PII before it crosses the network to Shrike's backend — defense-in-depth for HIPAA / PCI / GLBA / CMMC workloads on top of the BAA/DPA that already covers transmission. The `syncPIIPatterns` step keeps client patterns in step with backend patterns without shipping SDK updates every time Presidio adds a recognizer.
+
+### Fixed
+- gemini-client test mock import matches the runtime `@google/genai` package (upstream renamed from `@google/generative-ai`).
+
+## [1.1.0] - 2026-02-19
+
+### Added
+- "What Shrike Detects" section in README: 86+ rules across 6 compliance frameworks
+- CHANGELOG.md
+
+### Changed
+- Updated backend tier description: all tiers now get full 9-layer cascade (L1-L8)
+
+## [1.0.1] - 2026-01-20
+
+### Fixed
+- Minor bug fixes and documentation updates
+
+## [1.0.0] - 2026-01-15
+
+### Added
+- Initial release
+- Drop-in OpenAI, Anthropic, and Gemini client wrappers
+- Automatic prompt scanning via Shrike backend
+- Fail-open and fail-closed modes
+- Subpath imports (shrike-guard/openai, /anthropic, /gemini)
+- SQL injection and file scanning
+- Response sanitization (IP protection)
+- API management clients (auth, policies, agents, sandbox)

package/README.md

@@ -4,7 +4,7 @@
 [![Node.js 18+](https://img.shields.io/badge/node-18+-green.svg)](https://nodejs.org/)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
-**Shrike Guard** is a TypeScript SDK for the [Shrike](https://shrikesecurity.com) platform — AI governance for every AI interaction. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically evaluate all prompts against policy before they reach the LLM. Whether you're governing a customer-facing chatbot, securing developer AI tools, or managing autonomous agent actions — the same multi-layered cognitive pipeline evaluates every interaction.
+**Shrike Guard** is a TypeScript SDK for the [Shrike](https://shrikesecurity.com) platform — AI governance for every AI interaction. It wraps OpenAI, Anthropic (Claude), and Google Gemini clients to automatically evaluate all prompts against policy before they reach the LLM. Whether you're governing a customer-facing chatbot, securing developer AI tools, or managing autonomous agent actions — the same 9-layer cognitive pipeline evaluates every interaction.
 
 ## Features
 
@@ -15,14 +15,14 @@
   - Jailbreak attempts
   - SQL injection
   - Path traversal
-- **Fail-safe modes**: Choose between fail-open (default) or fail-closed behavior
+- **Fail-safe modes**: Defaults to fail-closed (Zero Trust posture); opt into fail-open explicitly when availability outranks enforcement
 - **CJS + ESM**: Dual build via tsup, works everywhere
 - **Subpath imports**: `shrike-guard/openai`, `shrike-guard/anthropic`, `shrike-guard/gemini`
 - **Zero code changes**: Just replace your import
 
 ## What Shrike Detects
 
-Shrike's backend runs a multi-stage detection pipeline with security rules across **7 compliance frameworks**:
+Shrike's 9-layer cognitive pipeline includes sensitive-data detection aligned to 5 major regulatory frameworks:
 
 | Framework | Coverage |
 |-----------|----------|
@@ -31,10 +31,8 @@ Shrike's backend runs a multi-stage detection pipeline with security rules acros
 | **ISO 27001** | Information security — passwords, tokens, certificates |
 | **SOC 2** | Secrets, credentials, API keys, cloud tokens |
 | **NIST** | AI risk management (IR 8596), cybersecurity framework (CSF 2.0) |
-| **PCI-DSS** | Cardholder data — PAN, CVV, expiry, track data |
-| **WebMCP** | MCP tool description injection, data exfiltration |
 
-Plus built-in detection for prompt injection, jailbreaks, social engineering, and dangerous requests.
+Detection coverage is not a certification claim — see [shrikesecurity.com/compliance](https://shrikesecurity.com/compliance) for our current certification status. Plus built-in detection for prompt injection, jailbreaks, social engineering, and dangerous requests.
 
 ### Tiers
 
@@ -42,7 +40,7 @@ Detection depth depends on your tier. All tiers get the same SDK wrappers — ti
 
 | | Anonymous | Community | Pro | Enterprise |
 |---|---|---|---|---|
-| Detection Layers | L1-L5 | L1-L7 | L1-L8 | L1-L9 |
+| Detection Layers | L1-L5 | L1-L7 | L1-L9 (full) | L1-L9 (full) |
 | API Key | Not needed | Free signup | Paid | Paid |
 | Rate Limit | — | 10/min | 100/min | 1,000/min |
 | Scans/month | — | 1,000 | 25,000 | 1,000,000 |
@@ -128,20 +126,22 @@ Choose how the SDK behaves when the security scan fails (timeout, network error,
 ```typescript
 import { ShrikeOpenAI } from 'shrike-guard/openai';
 
-// Fail-open (default): Allow requests if scan fails
-// Best for: Most applications where availability is important
+// Fail-closed (default): Block requests if scan fails
+// Best for: Production security workloads. If the Shrike backend is down,
+// the SDK raises ShrikeScanError instead of allowing traffic through unguarded.
 const client = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'open',
+  failMode: 'closed', // This is the default
 });
 
-// Fail-closed: Block requests if scan fails
-// Best for: Security-critical applications
-const strictClient = new ShrikeOpenAI({
+// Fail-open: Allow requests if scan fails
+// Best for: Non-production experiments, internal tools where availability must
+// outrank enforcement. Trades the guard's enforcement promise for uptime.
+const permissiveClient = new ShrikeOpenAI({
   apiKey: 'sk-...',
   shrikeApiKey: 'shrike-...',
-  failMode: 'closed',
+  failMode: 'open',
 });
 ```
 
@@ -302,9 +302,9 @@ Looking for an AI security SDK? Here's how Shrike Guard compares:
 | Feature | Shrike Guard | Lakera | Prompt Armor |
 |---|---|---|---|
 | Drop-in OpenAI/Anthropic/Gemini wrapper | Yes | No | No |
-| Multi-layered evaluation pipeline | Yes | Limited | Limited |
+| 9-layer cognitive pipeline | Yes | Limited | Limited |
 | PII detection + redaction | Yes | Partial | No |
-| Session correlation | Yes (Enterprise) | No | No |
+| Session correlation | Yes (Pro+) | No | No |
 | Free tier (no API key) | Yes | No | No |
 | Open source client | Yes (Apache 2.0) | No | No |
 

package/dist/anthropic/index.d.mts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-CkCXFY3H.mjs';
+import { F as FailMode, S as ScanResult } from '../scanner-cxA3LnQR.mjs';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.d.ts

@@ -1,6 +1,6 @@
 import Anthropic from '@anthropic-ai/sdk';
 import { MessageCreateParams, Message } from '@anthropic-ai/sdk/resources/messages';
-import { F as FailMode, S as ScanResult } from '../scanner-CkCXFY3H.js';
+import { F as FailMode, S as ScanResult } from '../scanner-cxA3LnQR.js';
 
 /**
  * ShrikeAnthropic - Drop-in replacement for Anthropic client with security scanning.

package/dist/anthropic/index.js

@@ -74,9 +74,11 @@ var THREAT_TYPE_MAP = {
   completion_baiting: "jailbreak",
   override: "jailbreak",
   manipulate: "jailbreak",
-  tonality_drift_profanity: "jailbreak",
+  // L8 tonality drift — backend normalizes profanity + hostile as toxic_content;
+  // casual stays as jailbreak (matches platform/common/models/response.go:309-313).
+  tonality_drift_profanity: "toxic_content",
+  tonality_drift_hostile: "toxic_content",
   tonality_drift_casual: "jailbreak",
-  tonality_drift_hostile: "jailbreak",
   // System prompt leak
   system_prompt_leak: "system_prompt_leak",
   system_prompt_extraction: "system_prompt_leak",
@@ -132,9 +134,11 @@ var THREAT_TYPE_MAP = {
   suspicious_tld: "blocked_domain",
   suspicious_domain: "blocked_domain",
   malicious_url: "blocked_domain",
-  // Toxicity
-  toxicity: "toxicity",
-  harmful_content: "toxicity",
+  // Toxic content (canonical name as of the L7 rewrite). `toxicity` kept as a
+  // legacy alias so older backend builds + customer code don't break.
+  toxic_content: "toxic_content",
+  toxicity: "toxic_content",
+  harmful_content: "toxic_content",
   // Malicious code
   malicious_content: "malicious_code",
   malicious_code: "malicious_code",
@@ -155,6 +159,12 @@ var THREAT_TYPE_MAP = {
   privilege_escalation: "privilege_escalation",
   // Destructive operation
   destructive_operation: "destructive_operation",
+  // L9 multi-turn correlation — the pseudo-category emitted when any
+  // multi_turn_* pattern fires (crescendo, blocked_retry, trust-building,
+  // memory_poisoning, etc.). The normalizeThreatType prefix check below
+  // handles the specific pattern names; this entry catches the pseudo
+  // value if the backend pre-normalizes.
+  multi_turn_attack: "multi_turn_attack",
   // Errors
   scan_error: "scan_error",
   size_limit_exceeded: "size_limit_exceeded",
@@ -171,7 +181,9 @@ var THREAT_GUIDANCE = {
   secrets_exposure: "This content contains patterns matching API keys, tokens, or credentials.",
   pii_exposure: "This content contains personally identifiable information.",
   blocked_domain: "This web search targets a restricted domain.",
+  toxic_content: "This content contains potentially harmful or inappropriate language.",
   toxicity: "This content contains potentially harmful or inappropriate language.",
+  multi_turn_attack: "A pattern was detected across multiple turns of this session that suggests a coordinated attempt to bypass safety controls.",
   malicious_code: "This content contains patterns associated with malicious code.",
   harmful_intent: "This request contains content associated with harmful intent.",
   social_engineering: "This prompt contains social engineering patterns.",
@@ -191,7 +203,9 @@ var THREAT_SEVERITY = {
   secrets_exposure: "critical",
   pii_exposure: "high",
   blocked_domain: "medium",
+  toxic_content: "medium",
   toxicity: "medium",
+  multi_turn_attack: "high",
   malicious_code: "critical",
   harmful_intent: "high",
   social_engineering: "medium",
@@ -201,12 +215,31 @@ var THREAT_SEVERITY = {
   size_limit_exceeded: "low",
   unknown: "medium"
 };
+var INTERNAL_FIELDS = /* @__PURE__ */ new Set([
+  "detected_by",
+  "policy_id",
+  "policy_name",
+  "matched_pattern",
+  "matched_text",
+  "pattern",
+  "scan_stage",
+  "ai_reasoning",
+  "llm_analysis",
+  "performance_metrics",
+  "performance"
+]);
 function normalizeThreatType(rawType) {
   if (!rawType) {
     return "unknown";
   }
   const normalized = rawType.toLowerCase().replace(/-/g, "_");
-  return THREAT_TYPE_MAP[normalized] || "unknown";
+  if (THREAT_TYPE_MAP[normalized]) {
+    return THREAT_TYPE_MAP[normalized];
+  }
+  if (normalized.startsWith("multi_turn_")) {
+    return "multi_turn_attack";
+  }
+  return "unknown";
 }
 function deriveSeverity(threatType, rawSeverity) {
   const validSeverities = /* @__PURE__ */ new Set(["critical", "high", "medium", "low"]);
@@ -227,20 +260,59 @@ function bucketConfidence(score) {
   }
   return "low";
 }
+var PRESERVED_GOVERNANCE_FIELDS = [
+  "action",
+  "refuse_tier",
+  "recovery",
+  "session_state",
+  "content_type",
+  "approval_info",
+  "client_session_rotation"
+];
+function sanitizeViolation(raw) {
+  if (!raw || typeof raw !== "object") {
+    return null;
+  }
+  const source = raw;
+  const out = {};
+  for (const [k, v] of Object.entries(source)) {
+    if (!INTERNAL_FIELDS.has(k)) {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 function sanitizeScanResponse(raw) {
   const safe = raw.safe !== false;
-  const approvalInfo = raw.approval_info;
+  const result = { safe };
+  for (const field of PRESERVED_GOVERNANCE_FIELDS) {
+    const value = raw[field];
+    if (value !== void 0 && value !== null) {
+      result[field] = value;
+    }
+  }
+  const rawViolations = raw.violations;
+  if (Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const cleaned = rawViolations.map((v) => sanitizeViolation(v)).filter((v) => v !== null);
+    if (cleaned.length > 0) {
+      result.violations = cleaned;
+    }
+  }
   if (safe) {
-    const result2 = {
-      safe: true,
-      reason: raw.reason || ""
-    };
-    if (approvalInfo) {
-      result2.approval_info = approvalInfo;
+    result.reason = raw.reason || "";
+    return result;
+  }
+  let rawThreatType = raw.threat_type;
+  if (!rawThreatType && Array.isArray(rawViolations) && rawViolations.length > 0) {
+    const first = rawViolations[0];
+    if (first && typeof first === "object" && !Array.isArray(first)) {
+      const firstThreat = first.threat_type;
+      if (typeof firstThreat === "string") {
+        rawThreatType = firstThreat;
+      }
     }
-    return result2;
   }
-  const threatType = normalizeThreatType(raw.threat_type);
+  const threatType = normalizeThreatType(rawThreatType);
   const confidence = bucketConfidence(
     typeof raw.confidence === "number" ? raw.confidence : void 0
   );
@@ -249,22 +321,19 @@ function sanitizeScanResponse(raw) {
     typeof raw.severity === "string" ? raw.severity : void 0
   );
   const guidance = THREAT_GUIDANCE[threatType] || THREAT_GUIDANCE["unknown"];
-  const result = {
-    safe: false,
-    threat_type: threatType,
-    severity,
-    confidence,
-    reason: raw.reason || guidance,
-    guidance
-  };
-  if (approvalInfo) {
-    result.approval_info = approvalInfo;
-  }
+  result.threat_type = threatType;
+  result.severity = severity;
+  result.confidence = confidence;
+  result.reason = raw.reason || guidance;
+  result.guidance = guidance;
   return result;
 }
 
 // src/version.ts
-var VERSION = "1.3.1";
+var VERSION = "1.5.0";
+function failOpenResult(reason) {
+  return { safe: true, reason, degraded: true };
+}
 function generateUUID() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (c) => {
     const r = Math.random() * 16 | 0;
@@ -281,6 +350,18 @@ function getScanHeaders(shrikeApiKey, requestId) {
     "X-Shrike-Request-ID": generateUUID()
   };
 }
+function isBlocked(verdict) {
+  const action = verdict.action;
+  if (typeof action === "string" && action.length > 0) {
+    if (action === "allow" || action === "warn") return false;
+    if (action === "block" || action === "require_approval") return true;
+  }
+  const safe = verdict.safe;
+  if (typeof safe === "boolean") {
+    return !safe;
+  }
+  return false;
+}
 function maybeAddSignupHint(result, apiKey) {
   if (apiKey) return result;
   if (result.upgrade_hint) return result;
@@ -353,7 +434,7 @@ var ShrikeAnthropic = class {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), this._scanTimeout);
     try {
-      const response = await fetch(`${this._shrikeEndpoint}/scan`, {
+      const response = await fetch(`${this._shrikeEndpoint}/api/scan/enforce`, {
         method: "POST",
         headers: getScanHeaders(this._shrikeApiKey),
         body: JSON.stringify({
@@ -368,7 +449,7 @@ var ShrikeAnthropic = class {
       });
       if (!response.ok) {
         if (this._failMode === "open" /* OPEN */) {
-          return { safe: true, reason: `Scan API error: ${response.status}` };
+          return failOpenResult(`Scan API error: ${response.status}`);
         }
         throw new ShrikeScanError(`Scan API returned error: ${response.status}`);
       }
@@ -381,12 +462,12 @@ var ShrikeAnthropic = class {
       if (errorMessage.includes("abort")) {
         if (this._failMode === "open" /* OPEN */) {
           logWarning("Scan request timed out, failing open (allowing request)");
-          return { safe: true, reason: "Scan timeout, failing open" };
+          return failOpenResult("Scan timeout, failing open");
         }
         throw new ShrikeScanError("Scan request timed out and fail_mode is 'closed'");
       }
       if (this._failMode === "open" /* OPEN */) {
-        return { safe: true, reason: `Scan error: ${errorMessage}` };
+        return failOpenResult(`Scan error: ${errorMessage}`);
       }
       throw new ShrikeScanError(`Scan failed: ${errorMessage}`);
     } finally {
@@ -412,7 +493,7 @@ var MessagesNamespace = class {
     const scanResult = await this._client._scanMessages(
       params.messages
     );
-    if (!scanResult.safe) {
+    if (isBlocked(scanResult)) {
       throw new ShrikeBlockedError(
         `Request blocked: ${scanResult.reason || "Security threat detected"}`,
         scanResult.threat_type,