agentsec_core/web/sanitize/
mod.rs

1//! Two-layer sanitize pipeline for fetched URL content.
2//!
3//! Layer order is fixed:
4//!
5//! 1. [`regex_layer::strip`] — fast, local, Aho-Corasick over a static
6//!    pattern list. Replaces matches with the literal `[STRIPPED]`.
7//! 2. [`semantic_layer::review`] — optional LLM review via Anthropic
8//!    Messages API. **Fails open** when `ANTHROPIC_API_KEY` is unset or
9//!    the API returns non-2xx: regex-only output is passed through
10//!    unchanged.
11//! 3. [`wrap::envelope`] — wrap into `<untrusted_content>` so the caller
12//!    LLM physically separates instruction from data.
13
14pub mod regex_layer;
15pub mod semantic_layer;
16pub mod wrap;
17
18use crate::LlmConfig;
19use crate::error::Result;
20
21/// Run the 2-layer sanitize pipeline and return `(envelope, removed)`.
22///
23/// `envelope` is the wrapped `<untrusted_content>...</untrusted_content>`
24/// string ready to hand to the caller LLM; `removed` is the cumulative
25/// list of pattern labels stripped by both layers.
26///
27/// # Errors
28///
29/// Returns [`crate::Error::Http`] only if the semantic layer's HTTP call
30/// fails before the fail-open fallback engages (e.g. TLS handshake
31/// failure). API non-2xx is **not** an error here — see
32/// [`semantic_layer::review`].
33pub async fn run(llm: &LlmConfig, url: &str, raw: &str) -> Result<(String, Vec<String>)> {
34    // 1st layer: regex (cheap, local).
35    let (stripped, mut removed) = regex_layer::strip(raw);
36
37    // 2nd layer: semantic check via Anthropic API (Haiku / Sonnet).
38    // Fails open if `llm.api_key` is `None` (see semantic_layer).
39    let (cleaned, semantic_removed) = semantic_layer::review(llm, &stripped).await?;
40    removed.extend(semantic_removed);
41
42    // Wrap into <untrusted_content> envelope.
43    let envelope = wrap::envelope(url, &cleaned, &removed);
44    Ok((envelope, removed))
45}
agentsec_core/web/sanitize/mod.rs

agentsec_core/web/sanitize/
mod.rs
