feat!: tw-guard, one guard engine for both gateways - #149

The guard side of the shared layer: outbound redaction and restoration, and inspection of the tool calls an upstream returns. It moves into one crate that the server edition can run on instead of its own copies. Two desktop bugs are fixed along the way.

Commit 1: one crate, and no tw-resil

• tw-guard has two parts:
  • redact: tw-redact, moved.
  • tools: the tool-call wall from tw-gateway, the rule engine from tw-scan, and the built-in rules.yaml from tw-config.
• The rule engine no longer knows config.yaml. tool_rules(disable, cut, custom) takes plain arguments. ToolPolicy::rules / one_builtin in tw-config translate the desktop policy into them, and the server edition will translate its system settings the same way. tw-scan's rules.rs is gone.
• tw-resil is deleted. Nothing here used it, and the server edition took back the two modules it used (refactor: take the circuit-breaker registry and metric labels back from core ThinkWatch#27).

Commit 2: placeholders by scheme, restoration by lane and format

• Placeholders follow a Scheme, and a custom rule may carry a label:
  • The desktop keeps <<TW_SECRET_1>>; the server edition gets {{EMAIL_1}}.
  • Numbers are issued per label ({{EMAIL_1}} {{PHONE_1}}).
• The stream restorer holds a tail only while it is a strict prefix of a placeholder this ledger issued. This is exact for either scheme: {{ name }} in templates is never held, and invented placeholders are not waited for.
• The SSE restorer knows the stream's format and keeps one lane per block, tool call or output item. Bug fixes:
  • A tail held at the end of a text block used to be prepended to the next block's tool-argument delta, corrupting the arguments. It now goes out in its own block, before that block's stop.
  • The end-of-stream tail was always written as an Anthropic delta, so Chat, Responses and Gemini clients dropped it. It is now written in the stream's own format.
  • Tool arguments are restored for Chat and Responses too. *.done frames and Gemini function calls get complete placeholders restored.
  • Thinking and its signature are left alone.
• FrameRestorer works on parsed frames for callers that frame the stream themselves. SseRestorer frames bytes and forwards frames it doesn't understand byte for byte.

Commits 3–5: what the server edition needs from this engine

• Both rule engines compile through one bounded compile, with the NFA and the lazy DFA each capped at 1 MiB. The server edition caps both today; tw-guard capped only the NFA, so moving it onto this engine would have loosened its guard.
• scan_text / redact_text match custom rules as written on decoded text. The server edition finds PII in the decoded request, so a hit may carry a quote (password="x"). Cutting it at the quote, as the wire-shaped scan_plain does, would replace password= and send the secret. restore_json puts such a value back escaped.
• GatewayError::PolicyBlocked (403) in tw-types, for refusing an answer by policy. The server edition is about to cut tool calls with it.

Tests

• cargo fmt --check and cargo clippy --workspace --all-targets -D warnings are clean.
• cargo test --workspace passes. New cases:
  • per-label numbering;
  • brace placeholders held while templates are not;
  • a tail kept in its own block;
  • Chat text and tool arguments;
  • the Chat tail written as a Chat chunk;
  • Responses text, arguments and done frames;
  • Gemini text with finishReason in the same frame, and Gemini function calls;
  • thinking left untouched;
  • replaced values never carrying a quote, so a whole-body restore stays valid JSON;
  • ToolPolicy reaching the rules.
• The m5_redact fake upstream now sends real Anthropic frames (with type, index and delta.type).
• scripts/smoke.sh: 55 passed, 0 failed, same as before the change.

Breaking

• tw-redact → tw_guard::redact (redact.rs is now replace.rs).
• Ledger::new(scheme) replaces Ledger::default().
• apply/redact take a ledger (*_into removed).
• sse::Body::new takes the stream's dialect.
• tw_scan::rules → tw_guard::tools::rules plus ToolPolicy::rules.
• tw-resil is removed.

Nothing changes for lite's UI: the control API is untouched.

🤖 Generated with Claude Code