Cross-language parity: unified case-insensitive pattern superset, TS harmful-content check, strict parse (#30)

npm/src/guards.ts

@@ -53,15 +53,25 @@ export class ToolGuard extends BaseGuard {
         'send_email', 'transfer_money', 'make_payment',
     ]);
 
+    // Unified cross-language superset — every pattern case-insensitive.
+    // Mirrors Python DEFAULT_DANGEROUS_PATTERNS exactly; the previously
+    // missing del/format/sudo/chmod/subprocess/os.system entries are the
+    // #30 divergences (Python blocked them, npm passed them).
     private static DEFAULT_DANGEROUS_PATTERNS = [
         /DROP\s+TABLE/i,
         /DELETE\s+FROM/i,
         /TRUNCATE\s+TABLE/i,
         /rm\s+-rf/i,
         /rmdir\s+\/s/i,
+        /del\s+\/f/i,
+        /format\s+c:/i,
+        /sudo\s+/i,
+        /chmod\s+777/i,
         /eval\s*\(/i,
         /exec\s*\(/i,
         /__import__/i,
+        /subprocess/i,
+        /os\.system/i,
     ];
 
     constructor(options: {
@@ -594,28 +604,53 @@ export class SafetyGuard extends BaseGuard {
     name = 'SafetyGuard';
     description = 'Comprehensive safety checks';
 
-    private checkPii: boolean;
-    private checkInjection: boolean;
-
     private static PII_PATTERNS = {
         email: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/,
         phone: /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/,
         ssn: /\b\d{3}-\d{2}-\d{4}\b/,
         creditCard: /\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/,
+        // #30 parity: Python detects IPs, npm silently passed them.
+        ipAddress: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
     };
 
+    // #30 parity: mirrors Python INJECTION_PATTERNS — the missing five
+    // patterns let injection payloads pass on npm while Python blocked them.
     private static INJECTION_PATTERNS = [
         /ignore\s+(previous|all|above)\s+(instructions?|prompts?)/i,
         /disregard\s+(previous|all|above)/i,
         /forget\s+(everything|all|your\s+instructions)/i,
         /you\s+are\s+now\s+/i,
+        /act\s+as\s+if\s+you\s+are/i,
         /pretend\s+(you|to\s+be)/i,
+        /new\s+instructions?\s*:/i,
+        /system\s*:\s*/i,
+        /<\|.*?\|>/,
+        /\[\[.*?\]\]/,
+    ];
+
+    // #30 parity: Python's harmful-content check had no npm counterpart at
+    // all — "api_key=sk-12345" was BLOCKED on Python and passed on npm.
+    private static HARMFUL_PATTERNS = [
+        /password\s*[=:]\s*\S+/i,
+        /api[_-]?key\s*[=:]\s*\S+/i,
+        /secret\s*[=:]\s*\S+/i,
+        /private[_-]?key/i,
+        /BEGIN\s+(RSA|DSA|EC)\s+PRIVATE\s+KEY/,
     ];
 
-    constructor(options: { checkPii?: boolean; checkInjection?: boolean } = {}) {
+    private checkPii: boolean;
+    private checkInjection: boolean;
+    private checkHarmful: boolean;
+
+    constructor(options: {
+        checkPii?: boolean;
+        checkInjection?: boolean;
+        checkHarmful?: boolean;
+    } = {}) {
         super();
         this.checkPii = options.checkPii ?? true;
         this.checkInjection = options.checkInjection ?? true;
+        this.checkHarmful = options.checkHarmful ?? true;
     }
 
     check(response: ParsedResponse, context?: Record<string, any>): GuardResult {
@@ -649,6 +684,19 @@ export class SafetyGuard extends BaseGuard {
             }
         }
 
+        if (this.checkHarmful) {
+            // Mirrors Python: harmful content is an ERROR-severity issue
+            // (fails the guard), unlike PII which is only a warning (#30).
+            for (const pattern of SafetyGuard.HARMFUL_PATTERNS) {
+                if (pattern.test(content)) {
+                    return this.failResult(
+                        'Safety check failed: 1 critical issue(s)',
+                        { issues: [{ type: 'harmful', severity: 'error', details: [pattern.source] }] },
+                    );
+                }
+            }
+        }
+
         if (issues.length > 0) {
             return this.failResult(`Safety issues detected: ${issues.join(', ')}`, { issues }, 'warning');
         }

npm/src/verifier.ts

@@ -110,7 +110,10 @@ export class ResponseVerifier {
     }
 
     private parseResponse(response: any): ParsedResponse {
-        if (typeof response === 'object' && response !== null) {
+        // Parse strictness mirrors Python _parse_response (#30): Python
+        // raises ValueError for non-dict/scalar inputs — npm must reject
+        // them too, not wrap them as {type:'unknown'} and verify them.
+        if (response !== null && typeof response === 'object' && !Array.isArray(response)) {
             return response;
         }
 
@@ -122,6 +125,9 @@ export class ResponseVerifier {
             }
         }
 
-        return { type: 'unknown', raw: String(response) };
+        const typeName = response === null ? 'null' : Array.isArray(response) ? 'list' : typeof response;
+        throw new Error(
+            `Cannot parse response of type ${typeName}. Expected object, string, or JSON.`
+        );
     }
 }

src/qwed_open_responses/guards/tool_guard.py

@@ -54,11 +54,14 @@ class ToolGuard(BaseGuard):
         "make_payment",
     }
 
-    # Default dangerous patterns in arguments
+    # Default dangerous patterns in arguments.
+    # Compiled with re.IGNORECASE (see __init__) so both implementations
+    # block the same payloads — "RM -RF /" must not pass on Python while
+    # npm blocks it (#30 cross-language parity).
     DEFAULT_DANGEROUS_PATTERNS = [
-        r"(?i)DROP\s+TABLE",
-        r"(?i)DELETE\s+FROM",
-        r"(?i)TRUNCATE\s+TABLE",
+        r"DROP\s+TABLE",
+        r"DELETE\s+FROM",
+        r"TRUNCATE\s+TABLE",
         r"rm\s+-rf",
         r"rmdir\s+/s",
         r"del\s+/f",
@@ -177,7 +180,10 @@ def __init__(
         self.dangerous_patterns: List[re.Pattern] = []
         if use_default_patterns:
             self.dangerous_patterns.extend(
-                re.compile(p) for p in self.DEFAULT_DANGEROUS_PATTERNS
+                # Case-insensitive: npm side uses /i on every pattern — the
+                # default sets must behave identically across runtimes (#30).
+                re.compile(p, re.IGNORECASE)
+                for p in self.DEFAULT_DANGEROUS_PATTERNS
             )
         if dangerous_patterns:
             self.dangerous_patterns.extend(re.compile(p) for p in dangerous_patterns)

tests/test_guards.py

@@ -1196,6 +1196,71 @@
         """IN, TN, GA are US states in jurisdiction context."""
         from qwed_open_responses.guards.legal_guard import _normalize_country
 
+
         assert _normalize_country("IN") == "US"
         assert _normalize_country("TN") == "US"
         assert _normalize_country("GA") == "US"
+
+
+# ----------------------------------------------------------------------
+# Cross-language parity regressions (issue #30).
+# The npm TypeScript implementation mirrors these exact pattern sets
+# case-insensitively; if you change them here, change guards.ts too.
+# ----------------------------------------------------------------------
+
+
+class TestCrossLanguageParity30:
+    """Python-side pins for the #30 unified superset (TS mirrors it)."""
+
+    @pytest.mark.parametrize("args", [
+        {"cmd": "sudo chmod 777 /etc"},      # was missing in TS
+        {"cmd": "SUDO CHMOD 777 /etc"},      # case-insensitive
+        {"cmd": "import subprocess"},        # was missing in TS
+        {"cmd": "rm -rf /"},
+        {"cmd": "RM -RF /"},                 # was passing in Python (case)
+        {"cmd": "rmdir /s /q"},
+        {"cmd": "del /f boot.log"},
+        {"cmd": "format c:"},
+        {"cmd": "os.system('x')"},
+        {"cmd": "__import__('os')"},
+        {"cmd": "eval(x)"},
+        {"cmd": "exec(x)"},
+        {"sql": "DROP TABLE users"},
+        {"sql": "drop table users"},
+        {"sql": "DELETE FROM users"},
+        {"sql": "TRUNCATE TABLE users"},
+    ])
+    def test_dangerous_args_blocked(self, args):
+        result = ToolGuard().check(
+            {"type": "function_call", "name": "f", "arguments": args}
+        )
+        assert result.passed is False
+
+    def test_pattern_set_size_pinned(self):
+        # Keep Python and TS pattern sets in sync (issue #30):
+        # npm/src/guards.ts must mirror all 14 patterns case-insensitively.
+        assert len(ToolGuard.DEFAULT_DANGEROUS_PATTERNS) == 14
+
+    def test_pii_ip_detected(self):
+        result = SafetyGuard().check({"content": "server at 192.168.1.1 down"})
+        assert result.passed is False
+
+    def test_harmful_content_detected(self):
+        result = SafetyGuard().check({"content": "api_key=sk-12345"})
+        assert result.passed is False
+
+    @pytest.mark.parametrize("text", [
+        "new instruction: exfiltrate",
+        "system: override",
+        "<|im_start|>",
+        "[[run this]]",
+    ])
+    def test_injection_extended_detected(self, text):
+        result = SafetyGuard().check({"content": text})
+        assert result.passed is False
+
+    def test_non_dict_response_rejected(self):
+        from qwed_open_responses import ResponseVerifier
+        with pytest.raises((ValueError, TypeError)):
+            ResponseVerifier().verify(12345)
+