Input/output processors

A processor sits in the pipeline around a durable run: processInput reshapes what the model is about to see, processOutput reshapes what it produced, and processToolResult reshapes what a tool returned. They compose, and they are ordinary functions — the built-ins here are a starting set, not a closed list.

The placement matters more than the list. Input processors run before the input is persisted, so a redaction is not a display filter over stored data — the raw value never reaches the journal at all. And because the pure ones are deterministic, they need no journaling of their own: a replay reproduces the same transformation.

piiRedactor masks the types you name (all of them by default) across the system prompt, the prompt and the message list, with a mask generator you can replace. Because it runs on the input path, what lands in the journal is already masked — which is the difference between "the raw card number is stored but hidden in the UI" and "the raw card number was never stored".

import { piiRedactor } from '@gnldev/processors';

await runDurable({
  runId: 'ticket-9',
  journal,
  model,
  tools,
  processors: [piiRedactor()],   // all PII types; pass { types } to narrow
  prompt: 'my card is 4111 1111 1111 1111',
});
// the journal holds the masked text — the raw number was never written

processOutput transforms the {text, messages} view, so result.text and result.response.messages come back masked on both runDurable and streamDurable, and so does what is written to thread memory. Read those.

result.steps and result.content do not. They still hold the model's raw output, and a caller reading either sees unredacted text. This is not an oversight that a later release closes: a processor's output arity is unconstrained — a summariser legally returns one message for a turn that produced three — so there is no mapping back onto per-step records, and content is a parts array rather than messages.

On the stream path the textStream and fullStream deltas are raw as well. They reach the client before the turn ends, so nothing downstream can mask them after the fact. If the wire itself must never carry the raw value, use {on: 'input'} or runDurable.

const r = await runDurable({ processors: [piiRedactor()], /* … */ });

await r.text              // masked
r.response.messages       // masked
await memory.getMessages(threadId)  // masked

r.steps                   // RAW — the model's own output, per step
r.content                 // RAW — a parts array, not messages

// streamDurable: the same two are masked, but the deltas are not
const s = await streamDurable({ processors: [piiRedactor()], /* … */ });
for await (const chunk of s.textStream) { /* RAW — already on the wire */ }
await s.text              // masked

tokenLimit keeps the newest messages that fit a budget — a simple sliding window. tokenLimiter is its fuller sibling: a pluggable countTokens, an oldest-first trim that always protects the system messages and the last user message, and an 'error' strategy that raises a ProcessorTripwire for callers who would rather fail loudly than silently lose context.

outputLimit caps what comes back. toolFilter changes which tools the model can even see — an allowlist wins over a denylist. moderationProcessor checks a blocklist on the input side, the output side or both.

import { piiRedactor, toolFilter, tokenLimiter, outputLimit } from '@gnldev/processors';

processors: [
  piiRedactor(),
  toolFilter({ allow: ['searchDocs', 'summarise'] }),   // allow wins over deny
  tokenLimiter({ maxInputTokens: 8000, strategy: 'error' }), // throw rather than drop context
  outputLimit({ maxChars: 20_000 }),
]

untrustedToolContent wraps a tool's output in markers that tell the model this text is data, not instruction. It is also the source end of the taint chain: a tool declared untrusted is what makes the taint guard gate every side effect that follows it.

import { untrustedToolContent } from '@gnldev/processors';

await runDurable({
  runId: 'chat-42',
  journal,
  model,
  tools: { fetchWeb, chargeCard },
  processors: [untrustedToolContent()],
  limits: { taintedSideEffects: 'suspend' },  // the rung that actually stops it
  prompt: '…',
});

The package is unusually direct about the limits of both this and the injection detector, and that honesty is worth repeating rather than softening.