Merge pull request #33 from QWED-AI/fix/fail-closed-verification-27-28-29

fix(core): fail-closed on zero guards + ToolGuard shape coverage + SafetyGuard recursive extraction (#27, #28, #29)

Author: rahuldass19

npm/package-lock.json

@@ -64,6 +64,6 @@
         "qs": "^6.15.2",
         "path-to-regexp": "^8.4.0",
         "brace-expansion": "^5.0.8",
-        "fast-uri": "^3.1.5"
+        "fast-uri": "^3.1.6"
     }
 }

npm/package.json

@@ -31,6 +31,25 @@ export class ResponseVerifier {
         const guardsToUse = guards ?? this.defaultGuards;
         const parsedResponse = this.parseResponse(response);
 
+        // Fail-closed: zero guards must never produce verified=true (#27).
+        if (guardsToUse.length === 0) {
+            return {
+                verified: false,
+                response: parsedResponse,
+                guardsPassed: 0,
+                guardsFailed: 0,
+                guardResults: [{
+                    guardName: 'ResponseVerifier',
+                    passed: false,
+                    message: 'No guards configured — verification cannot be performed. Pass at least one guard or set defaultGuards.',
+                    severity: 'error',
+                }],
+                blocked: this.strictMode,
+                blockReason: 'No guards configured — fail-closed (zero-guard verify).',
+                timestamp: new Date().toISOString(),
+            };
+        }
+
         const guardResults: GuardResult[] = [];
         let guardsPassed = 0;
         let guardsFailed = 0;

npm/src/guards.ts

@@ -5,7 +5,7 @@
 It orchestrates multiple guards to ensure responses are safe and correct.
 """
 
-from typing import Any, Dict, List, Optional, Union
+from typing import Any, Dict, List, Optional
 from dataclasses import dataclass, field
 from datetime import datetime
 import json
@@ -141,6 +141,27 @@ def verify(
         # Parse response if needed
         parsed_response = self._parse_response(response)
 
+        # Fail-closed: zero guards must never produce verified=True (#27).
+        # Absence of verification is not success — it is the opposite.
+        if not guards_to_use:
+            return VerificationResult(
+                verified=False,
+                response=parsed_response,
+                guards_passed=0,
+                guards_failed=0,
+                guard_results=[
+                    GuardResult(
+                        guard_name="ResponseVerifier",
+                        passed=False,
+                        message="No guards configured — verification cannot be performed. "
+                        "Pass at least one guard or set default_guards.",
+                        severity="error",
+                    )
+                ],
+                blocked=self.strict_mode,
+                block_reason="No guards configured — fail-closed (zero-guard verify).",
+            )
+
         # Run all guards
         guard_results: List[GuardResult] = []
         guards_passed = 0

npm/src/verifier.ts

@@ -183,8 +183,53 @@ def check(
 
         return self.pass_result(message="All safety checks passed")
 
-    def _extract_content(self, response: Dict) -> str:
-        """Extract text content from response."""
+    _MAX_CONTENT_DEPTH = 12
+    _KNOWN_CONTENT_KEYS = ("content", "output", "text", "arguments")
+
+    def _extract_content(self, response: Dict, _depth: int = 0) -> str:
+        """Extract text content from response — recursively (#29).
+
+        Walks all string values at any nesting depth (bounded to prevent
+        DoS on deeply-nested payloads) so the guard can see content inside
+        the canonical OpenAI shape (choices[].message.content), Anthropic
+        envelopes, and arbitrary nested structures.
+        """
+        parts = self._known_content_parts(response)
+
+        if _depth < self._MAX_CONTENT_DEPTH:
+            for key, value in response.items():
+                if not self._should_traverse(key, value):
+                    continue
+                parts.append(self._nested_content(value, _depth + 1))
+
+        return " ".join(parts)
+
+    def _should_traverse(self, key: str, value: Any) -> bool:
+        """Decide whether a response entry still needs recursive scanning.
+
+        - Unknown keys holding strings ARE scanned (nested scalars must be
+          checked for injection/PII — Greptile P1).
+        - Known content keys had their string forms collected verbatim above;
+          their container forms are traversed so nothing hides inside them.
+        - output/arguments dicts were already stringified above — skipping
+          avoids duplicate collection.
+        """
+        if isinstance(value, str):
+            # content/output/text strings were collected verbatim above;
+            # a string under 'arguments' was NOT (only dicts are) and must
+            # still be scanned for injection/PII.
+            if key == "arguments":
+                return True
+            return key not in self._KNOWN_CONTENT_KEYS
+        if isinstance(value, dict):
+            return key not in ("output", "arguments")
+        if isinstance(value, list):
+            return True
+        return False  # other scalars carry no scannable text
+
+    @staticmethod
+    def _known_content_parts(response: Dict) -> List[str]:
+        """Collect strings from the well-known top-level content keys."""
         parts = []
 
         if isinstance(response.get("content"), str):
@@ -200,7 +245,23 @@ def _extract_content(self, response: Dict) -> str:
         if isinstance(response.get("arguments"), dict):
             parts.append(str(response["arguments"]))
 
-        return " ".join(parts)
+        return parts
+
+    def _nested_content(self, value: Any, depth: int) -> str:
+        """Recursively collect strings from unrecognized nesting levels."""
+        if depth > self._MAX_CONTENT_DEPTH:
+            return ""
+        if isinstance(value, dict):
+            return self._extract_content(value, depth)
+        if isinstance(value, list):
+            # Increment depth for list children too — otherwise list-only
+            # nesting never reaches _MAX_CONTENT_DEPTH and a deeply (or
+            # cyclically) nested list recurses until RecursionError (T-Rex P1).
+            collected = [self._nested_content(item, depth + 1) for item in value]
+            return " ".join(collected)
+        if isinstance(value, str):
+            return value
+        return ""
 
     def _check_pii(self, content: str) -> List[str]:
         """Check for PII in content."""