Taint guard

import { createGnl, TaintedSideEffectError, readRunTaint, type RunLimits } from '@gnldev/durable';

// 'fetchPage' is marked untrusted: true — its OUTPUT is external, attacker-authorable
// content (whatever the fetched page contains). A successful call taints the run.
const fetchPage = { execute: async (a) => fetch(a.url).then((r) => r.text()), untrusted: true };

const limits: RunLimits = { taintedSideEffects: 'block' };

try {
  // A prompt-injected instruction inside the fetched page tells the model to email an
  // attacker. 'sendMail' is a side effect firing AFTER untrusted content entered the run.
  await gnl.run('research', { runId: 'task-9', prompt: 'summarize this page', limits });
} catch (e) {
  if (e instanceof TaintedSideEffectError) {
    // e.detail.taintSource → which tool call introduced the taint
    console.log('tainted side effect blocked:', e.detail.toolName, e.detail.taintSource);
  }
}

// Unlike the duplicate guard's 'reflect', the nudge here is per distinct (tool, args)
// pair. An identical retry AFTER the nudge EXECUTES (journaled as a 'warn' record) —
// it does NOT escalate to a block.
const limits: RunLimits = { taintedSideEffects: 'reflect' };

// Inspect the taint that caused a block, or set taint dynamically from a processor
// (e.g. a tool that scans its own output for injected instructions):
const taint = await readRunTaint(journal, runId);
if (taint) console.log('tainted by', taint.toolName, taint.source, taint.reason);

await markRunTainted(journal, runId, {
  toolCallId,
  toolName: 'customScan',
  source: 'processor',
  reason: 'injection pattern detected',
});

// Turn 1: fetchPage taints THIS run. Turn 2 is a SEPARATE run on the same threadId
// asking the model to act on what was fetched — without taintScope: 'thread' the new
// run starts clean and the injected instruction is not gated.
const limits: RunLimits = { taintedSideEffects: 'block', taintScope: 'thread' };

await gnl.run('research', { runId: 'turn-1', threadId: 'conv-42', prompt: 'fetch this page', limits });

// Later, same conversation — turn-2 inherits the taint from turn-1, so a side-effect
// tool call here also runs the ladder, even though turn-2 never called fetchPage:
await gnl.run('research', { runId: 'turn-2', threadId: 'conv-42', prompt: 'send it to my team', limits });

// Same thread, taint inherited from an earlier run — but this run's loaded messages
// (recent + recalled) no longer include the tainting content, and working memory is
// empty: the taint EXPIRES for this run, and the ladder does not fire on it.
const limits: RunLimits = {
  taintedSideEffects: 'block',
  taintScope: 'thread',
  taintLifetime: 'content-window',
};

// If a later recall step pulls the tainting message BACK into this run's context, or
// a tool wrote it to working memory, the taint is revived / kept alive for this run.

import { taintGuardian } from '@gnldev/durable';

// The expensive judge runs ONLY when BOTH conditions hold: the run is tainted AND the
// tool being called is listed in sensitiveTools. Every other call is allowed without
// paying for the check.
const guard = taintGuardian({
  sensitiveTools: ['sendMail', 'transfer'],
  onTainted: async (call) => {
    // call.tainted holds the taint context — set on EVERY GuardCall, not just here.
    return { action: 'require-approval', reason: call.tainted?.reason };
  },
  otherwise: { action: 'allow' },
});

await gnl.run('research', { runId: 'r1', prompt: 'summarize and email it', guard, limits });