theorum 0.1.7 → 0.1.10

package/esm/src/guardrails/injection.js

@@ -7,6 +7,7 @@
  * @module
  */
 import { blobAt, spansFromPatterns } from '../observability/spans.js';
+import { normalizeForDetection } from './normalize.js';
 const IGNORE_PREVIOUS = /ignore\s+(all\s+)?(previous|prior)\s+((?:safety|security|system|operational|internal|core|original|initial|existing|given|stated|provided|defined|specified|established)\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
 const DISREGARD_INSTRUCTIONS = /disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
 const FORGET_INSTRUCTIONS = /forget\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
@@ -15,8 +16,8 @@ const DO_NOT_FOLLOW = /do\s+not\s+follow\s+(the\s+)?(system|developer|previous|o
 const SUPERSEDE_INSTRUCTIONS = /supersedes?\s+(all\s+)?(prior|previous)\s+(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
 const VOID_INSTRUCTIONS = /(all\s+)?(previous|prior)\s+instructions?\s+(are|is)\s+(void|invalid|null|obsolete|cancelled|revoked)/gi;
 const DEVELOPER_MODE = /you\s+are\s+now\s+(in\s+)?developer\s+mode/gi;
-const ENTER_SPECIAL_MODE = /enter\s+(developer|admin|debug|maintenance)\s+mode/gi;
-const ACTIVATE_SPECIAL_MODE = /activate\s+(developer|admin|debug|jailbreak)\s+mode/gi;
+const ENTER_SPECIAL_MODE = /enter\s+(developer|admin|debug|maintenance)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
+const ACTIVATE_SPECIAL_MODE = /activate\s+(developer|admin|debug|jailbreak)\s+mode(?!\s+(?:in|on|via|through|from|using|for)\b)/gi;
 const SYSTEM_OVERRIDE = /\bsystem\s+override\b/gi;
 const OVERRIDE_INSTRUCTIONS = /override\s+(your\s+)?(instructions?|rules?|guidelines?|constraints?|directives?)/gi;
 const REVEAL_PROMPT = /reveal\s+((?:your?|yoru|yuor|the|my|its|his|her|our|their)\s+)?((?:(?:full|hidden|complete|internal|secret|original|entire|exact|actual|real)\s+){0,2})((?:system|systme|sysetm|systemp?)\s+)?prompt\b/gi;
@@ -32,7 +33,7 @@ const DAN_JAILBREAK = /\bDAN\b[\s\S]{0,120}\bdo\s+anything\s+now\b/g;
 const JAILBREAK_MODE = /jailbreak(ed)?\s+(mode|prompt)/gi;
 const DO_ANYTHING_NOW = /\bdo\s+anything\s+now\b/gi;
 const BYPASS_SAFETY = /bypass\s+(your\s+)?(safety|security|content|ethical)\s+(filters?|measures?|guidelines?|restrictions?)/gi;
-const DISABLE_SAFETY = /disable\s+(your\s+)?(safety|security|content)\s+(filters?|measures?)/gi;
+const DISABLE_SAFETY = /(disable|delete|remove|turn\s+off|eliminate)\s+(all\s+)?(your\s+)?(safety|security|content)\s+(filters?|measures?|rules?|guidelines?|restrictions?)/gi;
 const IGNORE_SAFETY = /(ignore|disregard)\s+(all\s+)?(your\s+)?(safety|security|ethical|content)\s+(guidelines?|rules?|restrictions?|measures?|filters?|polic(?:y|ies)|protocols?)/gi;
 const SYSTEM_TAG = /<\s*\/?\s*system\s*\/?>/gi;
 const ROLE_TAG = /<\s*\/?\s*(assistant|developer|tool|function)\s*\/?>/gi;
@@ -40,10 +41,11 @@ const ROLE_DELIMITER = /\]\s*\n\s*\[?(system|assistant|user)\]?:/gi;
 const BRACKETED_ROLE = /\[\s*(System\s*Message|System|Assistant|Internal)\s*\]/gi;
 const SYSTEM_YOU_ARE = /^\s*System:\s+(you\s+are|ignore|override)/gim;
 const CONTROL_TOKEN = /<\|(?:im_start|im_end|eot_id|start_header_id|end_header_id|endoftext)\|>/g;
-const DEEPSEEK_CONTROL = /<\uFF5C(?:end\u2581of\u2581sentence|begin\u2581of\u2581sentence)\uFF5C>/g;
+const DEEPSEEK_CONTROL = /<｜(?:end▁of▁sentence|begin▁of▁sentence)｜>/g;
 const LLAMA_INST = /\[\/?INST\]/gi;
 const IGNORE_YOUR_INSTRUCTIONS = /ignore\s+(all\s+)?(your\s+)?(instructions?|rules?)\b/gi;
 const UNRESTRICTED_MODE = /\bunrestricted\s+(ai|mode|model)\b/gi;
+const IGNORE_MULTILANG = /\b(?:ignorieren|ignorez|ignora|ignorer|oubliez|vergessen|olvida|desestima|missachten)\b[\s\S]{0,50}\b(?:anweisungen|instructions?|instrucciones|directives?|r[eè]gles|reglas)\b/gi;
 const INJECTION_PATTERNS = [
     IGNORE_PREVIOUS,
     DISREGARD_INSTRUCTIONS,
@@ -82,6 +84,7 @@ const INJECTION_PATTERNS = [
     LLAMA_INST,
     IGNORE_YOUR_INSTRUCTIONS,
     UNRESTRICTED_MODE,
+    IGNORE_MULTILANG,
 ];
 const TYPO_TARGETS = [
     'ignore',
@@ -92,6 +95,19 @@ const TYPO_TARGETS = [
     'system',
     'prompt',
     'instructions',
+    'safety',
+    'security',
+    'filters',
+    'rules',
+    'previous',
+    'guidelines',
+    'restrictions',
+    'disregard',
+    'forget',
+    'jailbreak',
+    'developer',
+    'disable',
+    'measures',
 ];
 const BASE64_BLOB = /[A-Za-z0-9+/]{16,}={0,2}/g;
 const HEX_BLOB = /(?:[0-9a-f]{2}[\s]?){8,}/gi;
@@ -105,6 +121,10 @@ const CODE_SPACE = 32;
 const CODE_DEL = 127;
 const HEX_RADIX = 16;
 const HEX_STEP = 2;
+const ROT13_OFFSET = 13;
+const ALPHA_COUNT = 26;
+const UPPER_A_CODE = 65;
+const LOWER_A_CODE = 97;
 function injectionSpansOn(text) {
     return spansFromPatterns(text, INJECTION_PATTERNS, 'injection');
 }
@@ -154,12 +174,6 @@ function isMostlyPrintable(value) {
     }
     return ok / value.length >= PRINTABLE_MIN;
 }
-function decodedHits(decoded) {
-    if (!isMostlyPrintable(decoded)) {
-        return false;
-    }
-    return injectionSpansOn(decoded).length > 0;
-}
 function tryBase64(blob) {
     try {
         return atob(blob);
@@ -168,6 +182,18 @@ function tryBase64(blob) {
         return undefined;
     }
 }
+function decodedHits(decoded) {
+    if (!isMostlyPrintable(decoded)) {
+        return false;
+    }
+    if (injectionSpansOn(decoded).length > 0)
+        return true;
+    const doubleDecoded = tryBase64(decoded);
+    if (doubleDecoded && isMostlyPrintable(doubleDecoded) && injectionSpansOn(doubleDecoded).length > 0) {
+        return true;
+    }
+    return false;
+}
 function tryHex(blob) {
     const hex = blob.replaceAll(/\s/g, '');
     if (hex.length % HEX_STEP !== 0) {
@@ -208,13 +234,80 @@ function spacedSpans(text) {
     }
     return spans;
 }
-/** Detect prompt-injection spans in a string. */
+// ── Encoding evasion decoders ────────────────────────────────────────
+function tryRot13(text) {
+    return text.replace(/[a-zA-Z]/g, (c) => {
+        const base = c.charCodeAt(0) < LOWER_A_CODE ? UPPER_A_CODE : LOWER_A_CODE;
+        return String.fromCharCode(((c.charCodeAt(0) - base + ROT13_OFFSET) % ALPHA_COUNT) + base);
+    });
+}
+function tryUrlDecode(text) {
+    if (!text.includes('%'))
+        return undefined;
+    try {
+        const decoded = decodeURIComponent(text);
+        return decoded !== text ? decoded : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function tryReverse(text) {
+    return [...text].reverse().join('');
+}
+const LEET_MAP = {
+    '0': 'o', '1': 'i', '3': 'e', '4': 'a', '5': 's', '7': 't', '8': 'b',
+    '@': 'a', '!': 'i',
+};
+const LEET_CHARS = /[013457@!]/g;
+function tryLeet(text) {
+    if (!LEET_CHARS.test(text))
+        return undefined;
+    LEET_CHARS.lastIndex = 0;
+    const decoded = text.replace(LEET_CHARS, (c) => LEET_MAP[c] ?? c);
+    return decoded !== text ? decoded : undefined;
+}
+function decodedTextSpans(text) {
+    const attempts = [
+        tryRot13(text),
+        tryUrlDecode(text),
+        tryLeet(text),
+    ];
+    const reversed = tryReverse(text);
+    if (reversed !== text) {
+        attempts.push(reversed);
+    }
+    for (const decoded of attempts) {
+        if (decoded && decoded !== text && injectionSpansOn(decoded).length > 0) {
+            return [{ start: 0, end: text.length, kind: 'injection' }];
+        }
+    }
+    return [];
+}
+// ── Main entry point ─────────────────────────────────────────────────
 function injectionSpans(text) {
+    const direct = injectionSpansOn(text);
     const shadow = typoNormalize(text);
     let typo = [];
     if (shadow !== text) {
         typo = injectionSpansOn(shadow);
     }
-    return [...injectionSpansOn(text), ...typo, ...encodedSpans(text), ...spacedSpans(text)];
+    const normalized = normalizeForDetection(text);
+    let unicodeHits = [];
+    if (normalized !== text) {
+        const normalizedTypo = typoNormalize(normalized);
+        if (injectionSpansOn(normalized).length > 0 ||
+            (normalizedTypo !== normalized && injectionSpansOn(normalizedTypo).length > 0)) {
+            unicodeHits = [{ start: 0, end: text.length, kind: 'injection' }];
+        }
+    }
+    return [
+        ...direct,
+        ...typo,
+        ...unicodeHits,
+        ...encodedSpans(text),
+        ...spacedSpans(text),
+        ...decodedTextSpans(text),
+    ];
 }
 export { injectionSpans };

package/esm/src/guardrails/normalize.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Unicode normalization for injection detection preprocessing.
+ *
+ * Strips invisible characters, normalizes homoglyphs, fullwidth, math
+ * variants, and Unicode spaces so regex-based injection patterns can
+ * match evasion attempts that use visually similar substitutions.
+ *
+ * @module
+ */
+declare function normalizeForDetection(text: string): string;
+export { normalizeForDetection };

package/esm/src/guardrails/normalize.js

@@ -0,0 +1,110 @@
+/**
+ * Unicode normalization for injection detection preprocessing.
+ *
+ * Strips invisible characters, normalizes homoglyphs, fullwidth, math
+ * variants, and Unicode spaces so regex-based injection patterns can
+ * match evasion attempts that use visually similar substitutions.
+ *
+ * @module
+ */
+const STRIP_CODES = [
+    0x200B, 0x200C, 0x200D, 0xFEFF, 0x00AD,
+    0x200E, 0x200F,
+    0x202A, 0x202B, 0x202C, 0x202D, 0x202E,
+    0x2060, 0x2061, 0x2062, 0x2063, 0x2064,
+    0x034F, 0x061C, 0x180E,
+    0x2066, 0x2067, 0x2068, 0x2069,
+];
+const STRIP_SET = new Set(STRIP_CODES);
+const SPACE_CODES = [
+    0x00A0, 0x1680,
+    0x2000, 0x2001, 0x2002, 0x2003, 0x2004, 0x2005,
+    0x2006, 0x2007, 0x2008, 0x2009, 0x200A,
+    0x202F, 0x205F, 0x3000,
+];
+const SPACE_SET = new Set(SPACE_CODES);
+const HOMOGLYPH_MAP = new Map([
+    [0x0430, 'a'], [0x0441, 'c'], [0x0435, 'e'], [0x0456, 'i'],
+    [0x043E, 'o'], [0x0440, 'p'], [0x0455, 's'], [0x0443, 'y'],
+    [0x0445, 'x'], [0x043A, 'k'], [0x043D, 'h'],
+    [0x0410, 'A'], [0x0412, 'B'], [0x0415, 'E'], [0x041D, 'H'],
+    [0x041E, 'O'], [0x041A, 'K'], [0x041C, 'M'], [0x0420, 'P'],
+    [0x0421, 'C'], [0x0422, 'T'], [0x0425, 'X'],
+    [0x03B1, 'a'], [0x03B5, 'e'], [0x03B9, 'i'], [0x03BF, 'o'],
+    [0x03C1, 'p'],
+    [0x2071, 'i'], [0x207F, 'n'],
+    [0x1D43, 'a'], [0x1D47, 'b'], [0x1D48, 'd'], [0x1D49, 'e'],
+    [0x1D4D, 'g'], [0x1D4F, 'k'], [0x1D50, 'm'], [0x1D52, 'o'],
+    [0x1D56, 'p'], [0x1D57, 't'], [0x1D58, 'u'], [0x1D5B, 'v'],
+]);
+const FULLWIDTH_LO = 0xFF01;
+const FULLWIDTH_HI = 0xFF5E;
+const FULLWIDTH_OFFSET = 0xFEE0;
+const COMBINING_LO = 0x0300;
+const COMBINING_HI = 0x036F;
+const MATH_ALPHA = [
+    [0x1D400, 0x1D41A], [0x1D434, 0x1D44E], [0x1D468, 0x1D482],
+    [0x1D49C, 0x1D4B6], [0x1D4D0, 0x1D4EA], [0x1D504, 0x1D51E],
+    [0x1D538, 0x1D552], [0x1D56C, 0x1D586], [0x1D5A0, 0x1D5BA],
+    [0x1D5D4, 0x1D5EE], [0x1D608, 0x1D622], [0x1D63C, 0x1D656],
+    [0x1D670, 0x1D68A],
+];
+const MATH_DIGIT = [
+    0x1D7CE, 0x1D7D8, 0x1D7E2, 0x1D7EC, 0x1D7F6,
+];
+const ALPHA_SIZE = 26;
+const DIGIT_SIZE = 10;
+const UPPER_A = 0x41;
+const LOWER_A = 0x61;
+const DIGIT_0 = 0x30;
+function mapMath(code) {
+    for (const [upper, lower] of MATH_ALPHA) {
+        if (code >= upper && code < upper + ALPHA_SIZE) {
+            return String.fromCodePoint(UPPER_A + code - upper);
+        }
+        if (code >= lower && code < lower + ALPHA_SIZE) {
+            return String.fromCodePoint(LOWER_A + code - lower);
+        }
+    }
+    for (const start of MATH_DIGIT) {
+        if (code >= start && code < start + DIGIT_SIZE) {
+            return String.fromCodePoint(DIGIT_0 + code - start);
+        }
+    }
+    return undefined;
+}
+const EMOJI_BETWEEN = /(?<=[a-zA-Z])[\u{1F300}-\u{1FFFF}\u{2600}-\u{27BF}\u{FE00}-\u{FE0F}\u{231A}-\u{23FF}]+(?=[a-zA-Z])/gu;
+const BACKSLASH_BEFORE_ALPHA = /\\(?=[a-zA-Z])/g;
+function normalizeForDetection(text) {
+    let out = '';
+    for (const ch of text) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (STRIP_SET.has(code))
+            continue;
+        if (code >= COMBINING_LO && code <= COMBINING_HI)
+            continue;
+        if (code >= FULLWIDTH_LO && code <= FULLWIDTH_HI) {
+            out += String.fromCodePoint(code - FULLWIDTH_OFFSET);
+            continue;
+        }
+        const math = mapMath(code);
+        if (math !== undefined) {
+            out += math;
+            continue;
+        }
+        const homo = HOMOGLYPH_MAP.get(code);
+        if (homo !== undefined) {
+            out += homo;
+            continue;
+        }
+        if (SPACE_SET.has(code)) {
+            out += ' ';
+            continue;
+        }
+        out += ch;
+    }
+    return out
+        .replace(EMOJI_BETWEEN, '')
+        .replace(BACKSLASH_BEFORE_ALPHA, '');
+}
+export { normalizeForDetection };

package/esm/src/guardrails/sanitize.d.ts

@@ -7,16 +7,24 @@
  *
  * @module
  */
-import type { NormalizedTurnRequest, TurnRequest } from '../kernel/types.js';
+import type { DynamicToolDeclaration, NormalizedTurnRequest, TurnRequest } from '../kernel/types.js';
 /** Sanitize one text value using prompt-injection and sensitive-data detectors. */
 declare function sanitizeText(text: string, options?: {
     sanitizeInput?: boolean;
     redactSensitive?: boolean;
 }): string;
+/** Redact only sensitive data (credentials, PII) — skip injection patterns.
+ *  Use for model output text that never contained user-authored injection attempts. */
+declare function redactSensitiveOnly(text: string): string;
 /** Maximum retained length for trace-safe host project ids. */
 declare const PROJECT_ID_MAX = 128;
 /** Return a trace-safe project id or `undefined` when the input is unsafe. */
 declare function sanitizeProjectId(id: string | undefined): string | undefined;
+/** Sanitize description and parameter schema text in dynamic tool declarations. */
+declare function sanitizeDynamicTools(tools: DynamicToolDeclaration[] | undefined, options?: {
+    sanitizeInput?: boolean;
+    redactSensitive?: boolean;
+}): DynamicToolDeclaration[] | undefined;
 /** Sanitize all user-controlled text and blobs in a turn request. */
 declare function sanitizeTurnRequest(req: TurnRequest): NormalizedTurnRequest;
-export { PROJECT_ID_MAX, sanitizeProjectId, sanitizeText, sanitizeTurnRequest };
+export { PROJECT_ID_MAX, redactSensitiveOnly, sanitizeDynamicTools, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, };

package/esm/src/guardrails/sanitize.js

@@ -26,6 +26,14 @@ function sanitizeText(text, options) {
     ];
     return applySpans(text, spans);
 }
+/** Redact only sensitive data (credentials, PII) — skip injection patterns.
+ *  Use for model output text that never contained user-authored injection attempts. */
+function redactSensitiveOnly(text) {
+    const spans = sensitiveSpans(text);
+    if (spans.length === 0)
+        return text;
+    return applySpans(text, spans);
+}
 function sanitizeSlots(slots, options) {
     if (!slots) {
         return slots;
@@ -85,6 +93,23 @@ function sanitizeHistory(history, options) {
         ...(m.metadata ? { metadata: m.metadata } : {}),
     }));
 }
+function sanitizeDynamicTool(decl, options) {
+    const clean = { ...decl };
+    if (clean.description !== undefined) {
+        clean.description = sanitizeText(clean.description, options);
+    }
+    if (clean.parameters !== undefined) {
+        clean.parameters = sanitizeArgs(clean.parameters, options);
+    }
+    return clean;
+}
+/** Sanitize description and parameter schema text in dynamic tool declarations. */
+function sanitizeDynamicTools(tools, options) {
+    if (!tools || tools.length === 0) {
+        return tools;
+    }
+    return tools.map((decl) => sanitizeDynamicTool(decl, options));
+}
 /** Sanitize all user-controlled text and blobs in a turn request. */
 function sanitizeTurnRequest(req) {
     let profileGuardrails;
@@ -118,6 +143,7 @@ function sanitizeTurnRequest(req) {
         ...req,
         system,
         projectId: sanitizeProjectId(req.projectId),
+        dynamicTools: sanitizeDynamicTools(req.dynamicTools, options),
         input: {
             ...input,
             text,
@@ -130,4 +156,4 @@ function sanitizeTurnRequest(req) {
         toolInvoke: invoke,
     };
 }
-export { PROJECT_ID_MAX, sanitizeProjectId, sanitizeText, sanitizeTurnRequest };
+export { PROJECT_ID_MAX, redactSensitiveOnly, sanitizeDynamicTools, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, };

package/esm/src/guardrails/sensitive.js

@@ -8,14 +8,15 @@
  */
 import { blobAt, spansFromPatterns } from '../observability/spans.js';
 const SSN = /\b\d{3}-\d{2}-\d{4}\b/g;
+const SSN_CONTEXTUAL = /(?:SSN|social\s*security(?:\s*number)?)[:\s]+(?:\d[-\s]*){9}/gi;
 const ITIN = /\b9\d{2}-\d{2}-\d{4}\b/g;
 const EIN = /\b\d{2}-\d{7}\b/g;
 const IBAN = /\b[A-Z]{2}\d{2}[A-Z0-9]{13,30}\b/g;
 const IPV4 = /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g;
 const IPV6 = /\b(?:[0-9a-f]{1,4}:){7}[0-9a-f]{1,4}\b/gi;
-const AWS_ACCESS = /\bAKIA[0-9A-Z]{16}\b/g;
+const AWS_ACCESS = /\bAKIA[0-9A-Z]{16,20}\b/g;
 const GOOGLE_API = /\bAIza[0-9A-Za-z_-]{35}\b/g;
-const OPENAI_KEY = /\bsk-[A-Za-z0-9]{20,}\b/g;
+const OPENAI_KEY = /\bsk-\s*[A-Za-z0-9]{20,}\b/g;
 const ANTHROPIC_KEY = /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g;
 const OPENROUTER_KEY = /\bsk-or-[A-Za-z0-9_-]{20,}\b/g;
 const GITHUB_PAT = /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g;
@@ -23,9 +24,10 @@ const GITHUB_TOKEN = /\bghp_[A-Za-z0-9]{36}\b/g;
 const SLACK_TOKEN = /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g;
 const BEARER = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
 const PEM_KEY = /-----BEGIN (?:RSA )?PRIVATE KEY-----[\s\S]+?-----END (?:RSA )?PRIVATE KEY-----/g;
-const CARD_CANDIDATE = /\b(?:\d[ -]*?){13,19}\b/g;
+const CARD_CANDIDATE = /\b(?:\d[\s.\-]*?){13,19}\b/g;
 const KEY_PATTERNS = [
     SSN,
+    SSN_CONTEXTUAL,
     ITIN,
     EIN,
     IBAN,

package/esm/src/kernel/engine/boundary.js

@@ -33,17 +33,17 @@ function bindCanary(system, canary) {
     }
     return `${system}\n\n${note}`;
 }
-function haystack(event) {
-    const chunks = [
-        event.text,
-        event.error,
-        JSON.stringify(event.structured),
-        JSON.stringify(event.tool),
-    ];
-    return chunks.join('\u0000');
-}
 function eventHasCanary(event, canary) {
-    return haystack(event).includes(canary);
+    if (event.text?.includes(canary))
+        return true;
+    if (event.error?.includes(canary))
+        return true;
+    if (event.structured !== undefined && JSON.stringify(event.structured).includes(canary)) {
+        return true;
+    }
+    if (event.tool !== undefined && JSON.stringify(event.tool).includes(canary))
+        return true;
+    return false;
 }
 function redactCanary(event, canary) {
     const next = mapStrings(event, (text) => text.replaceAll(canary, OMIT_CANARY));

package/esm/src/kernel/engine/runner/mod.js

@@ -46,8 +46,9 @@ async function* runTurn(req, provider, sink = noopSink()) {
     let canary = '';
     let system;
     let generation;
+    let safe;
     try {
-        const safe = sanitizeTurnRequest(req);
+        safe = sanitizeTurnRequest(req);
         throwIfAborted(safe.signal);
         const { profile, generation: gen } = resolveTurn(safe);
         generation = gen;
@@ -87,6 +88,7 @@ async function* runTurn(req, provider, sink = noopSink()) {
             canary,
             system,
             generation,
+            sanitizedReq: safe,
         }));
         throw err;
     }
@@ -100,6 +102,7 @@ async function* runTurn(req, provider, sink = noopSink()) {
         canary,
         system,
         generation,
+        sanitizedReq: safe,
     }));
 }
 export { runTurn };

package/esm/src/kernel/engine/runner/tools.js

@@ -1,14 +1,19 @@
 import { toErrorEvent } from '../../../guardrails/error.js';
+import { sanitizeDynamicTools, sanitizeText } from '../../../guardrails/sanitize.js';
 import { CATALOG } from '../../registry/catalog.js';
 import { executeTool } from '../../registry/tools.js';
 function formatToolFinding(res) {
+    let raw;
     if (res.finding) {
-        return res.finding;
+        raw = res.finding;
     }
-    if (res.data) {
-        return JSON.stringify(res.data);
+    else if (res.data) {
+        raw = JSON.stringify(res.data);
     }
-    return 'ok';
+    else {
+        return 'ok';
+    }
+    return sanitizeText(raw);
 }
 function* invokeFromUi(profile, req) {
     const invoke = req.toolInvoke;
@@ -159,13 +164,14 @@ async function executeDynamicToolLoader(args) {
             finding: `Tool '${decl.name}' is marked as a loader but no loader is configured.`,
         };
     }
-    const loaded = await loader({
+    const rawLoaded = await loader({
         name: decl.name,
         args: toolArgs,
         profile,
         currentTools: generation.dynamicTools ?? [],
         sessionPermissions: generation.sessionPermissions,
     });
+    const loaded = sanitizeDynamicTools(rawLoaded) ?? [];
     generation.dynamicTools = mergeDynamicTools(generation.dynamicTools, loaded);
     return {
         status: 'ok',

package/esm/src/kernel/types.d.ts

@@ -16,7 +16,7 @@ export type BuiltinToolId = string;
 /** Harness custom tool that ships with THEORUM. */
 export type HarnessToolId = 'askUser';
 /** Host-owned or harness custom tool id. */
-export type CustomToolId = HarnessToolId | (string & {});
+export type CustomToolId = HarnessToolId | (string & Record<never, never>);
 /** Any tool id accepted by profile allowlists and per-turn gates. */
 export type ToolId = BuiltinToolId | CustomToolId;
 /** Id of a host-registered structured output schema. */

package/esm/src/observability/trace-record.d.ts

@@ -108,6 +108,7 @@ declare function buildRecord(args: {
     canary?: string;
     system?: string;
     generation?: ResolvedGeneration;
+    sanitizedReq?: TurnRequest;
 }): Promise<TraceRecord>;
 export type { TraceRecord };
 export { buildRecord };

package/esm/src/observability/trace-record.js

@@ -7,7 +7,7 @@
  * @module
  */
 import { isAbortError, publicError } from '../guardrails/error.js';
-import { sanitizeText, sanitizeTurnRequest } from '../guardrails/sanitize.js';
+import { redactSensitiveOnly, sanitizeText, sanitizeTurnRequest } from '../guardrails/sanitize.js';
 import { OMIT_CANARY } from '../kernel/engine/boundary.js';
 import { sha256 } from '../kernel/engine/hash.js';
 import { attachResolved, attachTape, attachUsage } from './trace-attach.js';
@@ -26,13 +26,13 @@ function hashBlobs(blobs) {
 async function snapshotEvent(event) {
     const row = { type: event.type };
     if (event.text) {
-        row.text = sanitizeText(event.text);
+        row.text = redactSensitiveOnly(event.text);
     }
     if (event.error) {
         row.error = event.error;
     }
     if (event.errorInternal) {
-        row.errorInternal = sanitizeText(event.errorInternal);
+        row.errorInternal = redactSensitiveOnly(event.errorInternal);
     }
     if (event.structured !== undefined) {
         row.structured = event.structured;
@@ -103,7 +103,7 @@ function attachFailure(record, thrown, lastErr, canary) {
 }
 async function buildRecord(args) {
     const { req, events, started, model, bucket, thrown, gemini, canary, system, generation } = args;
-    const safe = requestForTrace(req);
+    const safe = args.sanitizedReq ?? requestForTrace(req);
     const input = safe.input ?? {};
     const snapped = await Promise.all(events.map((event) => snapshotEvent(event)));
     const lastErr = [...snapped].reverse().find((row) => row.type === 'error');

package/esm/src/providers/create-provider.js

@@ -10,6 +10,7 @@ import { TheorumError } from '../guardrails/error.js';
 import { createOpenRouterProvider } from './openrouter.js';
 import { createInteractionsProvider } from './provider.js';
 import { createSpeechProvider } from './speech.js';
+import { exposeForTests } from './expose-for-tests.js';
 function isSpeechRole(profile) {
     return profile.outputs.speech !== undefined;
 }
@@ -36,3 +37,4 @@ export function createProvider(profile, options = {}) {
     }
     throw new TheorumError(`createProvider: unsupported protocol/provider pair '${protocol}'/'${provider}'`);
 }
+exposeForTests('create-provider', { isSpeechRole, createProvider });

package/esm/src/providers/expose-for-tests.d.ts

@@ -0,0 +1 @@
+export declare function exposeForTests(bucket: string, api: Record<string, unknown>): void;

package/esm/src/providers/expose-for-tests.js

@@ -0,0 +1,21 @@
+/**
+ * Side-channel for repo unit/mutation tests. Not part of the public package API
+ * (not listed in package exports). Enabled only when THEORUM_TEST_INTERNALS=1.
+ *
+ * @module
+ */
+import * as dntShim from "../../_dnt.shims.js";
+export function exposeForTests(bucket, api) {
+    let enabled = false;
+    try {
+        enabled = typeof dntShim.Deno !== 'undefined' && dntShim.Deno.env.get('THEORUM_TEST_INTERNALS') === '1';
+    }
+    catch {
+        // Missing --allow-env, or non-Deno runtime: never expose.
+    }
+    if (!enabled)
+        return;
+    const g = dntShim.dntGlobalThis;
+    const root = (g.__theorumTestInternals ??= {});
+    root[bucket] = api;
+}

package/esm/src/providers/gemini-tape.js

@@ -1,6 +1,7 @@
 import { OMIT_CANARY } from '../kernel/engine/boundary.js';
 import { sha256 } from '../kernel/engine/hash.js';
 import { mapStrings } from '../kernel/engine/tree.js';
+import { exposeForTests } from './expose-for-tests.js';
 function isImageBlob(rec) {
     if (rec.type === 'image' || rec.type === 'media') {
         return true;
@@ -44,3 +45,11 @@ async function tapeGemini(value, canary) {
     return redactCanaryInTree(await scrubGemini(value), canary);
 }
 export { tapeGemini };
+exposeForTests('gemini-tape', {
+    isImageBlob,
+    scrubEntry,
+    scrubRecord,
+    scrubGemini,
+    redactCanaryInTree,
+    tapeGemini,
+});

package/esm/src/providers/google-tap.js

@@ -1,3 +1,4 @@
+import { exposeForTests } from './expose-for-tests.js';
 const SECRET_HEADER = /key|auth|cookie|secret|token/i;
 function tapeHeaderValue(key, value) {
     if (SECRET_HEADER.test(key)) {
@@ -46,3 +47,4 @@ function tapFetch(tap, send = fetch) {
     };
 }
 export { tapFetch };
+exposeForTests('google-tap', { tapeHeaderValue, tapeHeaders, throwRow, tapFetch });

package/esm/src/providers/interactions.js

@@ -1,6 +1,7 @@
 import { TheorumError } from '../guardrails/error.js';
 import { getTool } from '../kernel/registry/catalog.js';
 import { getStructured } from '../kernel/registry/schemas.js';
+import { exposeForTests } from './expose-for-tests.js';
 function camelToSnake(key) {
     return key.replaceAll(/[A-Z]/g, (ch) => `_${ch.toLowerCase()}`);
 }
@@ -151,3 +152,18 @@ function toInteractionsBody(req) {
     return toGoogleValue(camel);
 }
 export { camelToSnake, toInteractionsBody };
+exposeForTests('interactions', {
+    camelToSnake,
+    toGoogleValue,
+    wirePart,
+    userInputStep,
+    historyStep,
+    systemHoldsUserInput,
+    jsonResponseFormat,
+    attachResponseFormat,
+    attachSpeechConfig,
+    inputStepsFromRequest,
+    applyOptionalRequestFields,
+    baseInteractionsBody,
+    toInteractionsBody,
+});