A complete walkthrough of what happens on every LLM call when Guard is active. Click any step to expand.
Every pattern uses bounded quantifiers (ReDoS-safe). Inspection runs in microseconds per call.
Returns a Proxy (TS) or wrapper class (Python) that intercepts .messages.create() and .chat.completions.create(). Detects sync vs async client by class name. Pops stream=True and calls synchronously for inspection.
Runs pattern arrays against text content. Caps input at 20K chars. Returns findings with truncated 160-char context windows — never the full text. Pattern arrays are compiled once at import time.
Two methods: inspectToolCall() scans argument values (flattened, truncated to 500 chars each). inspectToolResult() is the critical path — scans tool output for injected instructions before the model sees them.
SHA-256 hashes the system prompt on first call. Compares on every subsequent call. If the hash changes, returns a SYSTEM_PROMPT_DRIFT finding (severity: high). Never stores the actual prompt text.
Maintains a rolling window of tool call history (last 15). Checks against 6 known-bad sequences. Tracks unique tools seen — flags new tools after 3+ established. Monitors calls-per-30s for volume spikes.
Appends one JSONL line per event. Silently fails on write errors (never crashes the agent). Never includes raw content — only finding metadata, session IDs, event types, and timestamps.