Guardrails

import { createHmac, timingSafeEqual } from "node:crypto";
import type { IncomingMessage, ServerResponse } from "node:http";

interface GuardrailAsk {
  customer_id: string;
  agent_id: string;
  call_id: string;
  turn_id: string;
  role: string;
  text: string;
  policy: string;
}

const MAX_SKEW_SECONDS = 5 * 60;

function verifyGuardrailWebhook(
  secret: string,
  timestamp: string,
  signature: string,
  body: Buffer,
): boolean {
  if (!secret || !timestamp || !signature) return false;

  // Check the age first: a valid signature on an old request is a replay.
  if (!/^[+-]?\d+$/.test(timestamp)) return false;
  const age = Date.now() / 1000 - Number(timestamp);
  if (Math.abs(age) > MAX_SKEW_SECONDS) return false;

  const expected = Buffer.from(
    createHmac("sha256", secret)
      .update(`${timestamp}.`)
      .update(body)
      .digest("hex"),
  );
  const given = Buffer.from(signature);
  return given.length === expected.length && timingSafeEqual(expected, given);
}

async function guardrail(req: IncomingMessage, res: ServerResponse) {
  const chunks: Buffer[] = [];
  for await (const chunk of req) chunks.push(chunk);
  const body = Buffer.concat(chunks);

  if (
    !verifyGuardrailWebhook(
      process.env.STREAM_API_SECRET ?? "",
      req.headers["x-timestamp"]?.toString() ?? "",
      req.headers["x-signature"]?.toString() ?? "",
      body,
    )
  ) {
    res.writeHead(401).end("not from the guardrail");
    return;
  }

  let ask: GuardrailAsk;
  try {
    ask = JSON.parse(body.toString());
  } catch (err) {
    res.writeHead(400).end(String(err));
    return;
  }

  res.writeHead(200, { "Content-Type": "application/json" });
  res.end(JSON.stringify({ allow: allowed(ask) }));
}

func guardrail(w http.ResponseWriter, r *http.Request) {
	body, _ := io.ReadAll(r.Body)
	if !agents.VerifyGuardrailWebhook(os.Getenv("STREAM_API_SECRET"),
		r.Header.Get(agents.GuardrailTimestampHeader),
		r.Header.Get(agents.GuardrailSignatureHeader), body) {
		http.Error(w, "not from the guardrail", http.StatusUnauthorized)
		return
	}

	var ask agents.GuardrailAsk
	if err := json.Unmarshal(body, &ask); err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	answer := agents.GuardrailAnswer{Allow: allowed(ask)}
	json.NewEncoder(w).Encode(answer)
}

import { readFile } from "node:fs/promises";
import { Agent, Client } from "@stream-io/stream-agents";

const policy = await readFile("agents/support/guardrail.md", "utf8");
await new Client().agent("support").updateConfig({ guardrail: policy });

const agent = new Agent({ name: "support", pipeline: { config: "support" } });

agent = GetStream::VisionAgents::Agent.new(
  config: "support",
  guardrail: File.read("agents/support/guardrail.md")
)

use GetStream\VisionAgents\Agent;

$policy = file_get_contents('agents/support/guardrail.md');
if ($policy === false) {
    throw new RuntimeException('cannot read agents/support/guardrail.md');
}

$agent = new Agent(name: 'support', guardrail: $policy);

policy, err := os.ReadFile("agents/support/guardrail.md")
if err != nil {
	return err
}

guardrail := string(policy)

api, err := client.New(stream.Backend{})
if err != nil {
	return err
}
_, err = api.Agent("support").UpdateConfig(ctx, acceleration.AgentConfigPatch{Guardrail: &guardrail})
if err != nil {
	return err
}

var policy = await File.ReadAllTextAsync("agents/support/guardrail.md");

var agent = new Agent(new AgentOptions
{
    Name = "support",
    Guardrail = policy,
});

let policy = std::fs::read_to_string("agents/support/guardrail.md")?;

let agent = Agent::named("support").llm("llm-fast").guardrail(policy);