Release 3.8.3

.github/workflows/ci.yml

@@ -189,7 +189,7 @@ jobs:
         with:
           # Pinned — matches `packageManager` in web/package.json.
           # Bump together with that field, never alone.
-          version: 12.9.1
+          version: 12.14.0
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24

CHANGELOG.md

@@ -11,6 +11,45 @@ target.
 
 ## [Unreleased]
 
+## [3.8.3] — 2026-10-20
+
+Tool-call inspection in streamed answers now decides only on arguments
+that have settled, and a hit that is recorded carries the whole call. The
+thinkwatch-core crates move from v0.75.0 to v0.77.0. The web image is
+built with Node.js 24.22.0 and pnpm 12.14.0.
+
+No setting, schema or API route changes.
+
+### Changed
+
+- The thinkwatch-core crates move from v0.75.0 to v0.77.0.
+- Since a recorded hit now waits for the complete call, a streamed tool
+  call that never completes (the upstream stream breaks off, or the client
+  leaves, in the middle of it) leaves no tool-inspection row. Such a call
+  was never whole on the client side either. Rules that cut still check
+  the arguments while they arrive.
+- The web image's build stage uses Node.js 24.22.0 and pnpm 12.14.0. The
+  served image (nginx) is unchanged.
+- The development compose file (`deploy/docker-compose.dev.yml`) runs
+  Zitadel v4.19.5.
+
+### Fixed
+
+- **Tool-call inspection no longer judges arguments that are still
+  arriving.** A streamed tool call was checked against its arguments as
+  far as they had come in. A host cut off in the middle of its name
+  (`http://127` before `.0.0.1`) looked external, and a pattern anchored
+  at the end could match the half-received tail. A hit now counts only
+  once it is settled; rules that cut still act as early as possible.
+- **A recorded hit carries the whole call.** A hit that is only recorded,
+  and every hit in observe mode, was recorded with the arguments as they
+  stood at the first match. It is now recorded once the call is complete.
+  A Chat Completions call with no `finish_reason` or `[DONE]` is checked
+  when the stream ends.
+- **`-T` is an upload only in curl.** The upload rule took any `-T` for
+  `curl -T`, so `docker compose exec -T` next to a URL was recorded as a
+  file upload.
+
 ## [3.8.2] — 2026-10-16
 
 Tool-call inspection now checks every choice of an answer, not only the
@@ -2450,7 +2489,8 @@ unreleased builds should: stop the gateway, run `db/schema.sql`
 against PostgreSQL, restart against this tag. The schema is
 idempotent end-to-end, so the apply is safe to repeat.
 
-[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.8.2...HEAD
+[Unreleased]: https://github.com/ThinkWatchProject/ThinkWatch/compare/v3.8.3...HEAD
+[3.8.3]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.8.3
 [3.8.2]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.8.2
 [3.8.1]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.8.1
 [3.8.0]: https://github.com/ThinkWatchProject/ThinkWatch/releases/tag/v3.8.0

Cargo.toml

@@ -10,7 +10,7 @@ members = [
 ]
 
 [workspace.package]
-version = "3.8.2"
+version = "3.8.3"
 edition = "2024"
 # The MSRV: the newest `rust-version` among the locked dependencies
 # (sqlx 0.9 and the aws-smithy crates under aws-sigv4). Without it,
@@ -70,10 +70,10 @@ opt-level = 3
 # never re-exported through a local shim. And the reverse: something only
 # this side uses (the at-rest crypto, IMDSv2 credentials, the gateway error)
 # lives here, not in core.
-tw-bedrock = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.75.0" }
-tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.75.0" }
-tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.75.0" }
-tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.75.0" }
+tw-bedrock = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.77.0" }
+tw-breaker = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.77.0" }
+tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.77.0" }
+tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.77.0" }
 
 # Web framework
 axum = { version = "0.8", features = ["macros", "ws"] }

crates/gateway/src/lifecycle/mod.rs

@@ -334,7 +334,12 @@ pub(crate) fn build_chat_pump(
         out.extend(shaper.finish());
         // The converter's last bytes can complete a tool call (the block's
         // stop), so they are inspected too.
-        let stop = inspector.as_mut().and_then(|i| i.check(&out));
+        // A Chat call with no `finish_reason` or `[DONE]` completes only
+        // as the stream closes; one that stops it keeps the tail back.
+        let stop = inspector.as_mut().and_then(|i| {
+            i.check(&out)
+                .or_else(|| i.finish().map(|err| (err, 0)))
+        });
         if let Some((err, safe)) = stop {
             let out = cut(&shaper, None, client, &out[..safe], &err);
             tell(&mut done_tx, StreamOutcome::UpstreamError {

crates/gateway/src/tool_inspection.rs

@@ -59,8 +59,16 @@ impl ToolInspection {
     }
 
     /// A wall for an SSE stream in the client's format. `None` when off.
+    ///
+    /// Only the rules that can stop the response are checked while a call
+    /// is still arriving, and only on what has settled (a host cut off at
+    /// `http://127` is not yet an external one). Everything else waits for
+    /// the call to complete, so a recorded hit carries the whole call. In
+    /// observe nothing can stop it, so every rule waits.
     pub fn stream(&self) -> Option<Wall> {
-        self.mode.detects().then(|| Wall::new(self.rules.clone()))
+        self.mode
+            .detects()
+            .then(|| Wall::new(self.rules.clone()).cut_early(self.mode.acts()))
     }
 
     /// Inspect a whole response. Empty when off.
@@ -128,6 +136,29 @@ impl StreamInspector {
         }
         None
     }
+
+    /// The stream ran to its end. A Chat call that never got its
+    /// `finish_reason` or `[DONE]` is complete only now: the client runs it
+    /// when the stream closes. Returns the refusal when one stops it; the
+    /// rest of the stream should not go out then.
+    pub fn finish(&mut self) -> Option<crate::error::GatewayError> {
+        for v in self.wall.finish() {
+            let blocked = self.inspection.blocks(&v);
+            record(
+                &self.audit,
+                &self.caller,
+                &self.provider,
+                &v,
+                blocked,
+                self.inspection.mode,
+                &self.mask,
+            );
+            if blocked {
+                return Some(refusal(&v));
+            }
+        }
+        None
+    }
 }
 
 /// What the caller is told when a response is cut. Names the tool and the
@@ -364,6 +395,59 @@ mod tests {
         assert_eq!(found[0].rule, "upload-file-to-host");
     }
 
+    /// A hit that is only recorded waits for the call to complete: the
+    /// audit row carries the command the client got, not the piece that had
+    /// arrived when the rule first matched.
+    #[test]
+    fn a_recorded_hit_waits_for_the_whole_call() {
+        let t = ToolInspection::default();
+        let mut wall = t.stream().expect("on by default");
+        let ev = |name: &str, d: serde_json::Value| format!("event: {name}\ndata: {d}\n\n");
+        let delta = |part: &str| {
+            ev(
+                "content_block_delta",
+                serde_json::json!({"type": "content_block_delta", "index": 0,
+                    "delta": {"type": "input_json_delta", "partial_json": part}}),
+            )
+        };
+        wall.feed(
+            ev(
+                "content_block_start",
+                serde_json::json!({"type": "content_block_start", "index": 0,
+                    "content_block": {"type": "tool_use", "id": "t1", "name": "bash", "input": {}}}),
+            )
+            .as_bytes(),
+        );
+        assert!(
+            wall.feed(delta(r#"{"command":"rm -rf / "#).as_bytes())
+                .is_empty()
+        );
+        assert!(wall.feed(delta(r#"&& echo done"}"#).as_bytes()).is_empty());
+        let found = wall.feed(
+            ev(
+                "content_block_stop",
+                serde_json::json!({"type": "content_block_stop", "index": 0}),
+            )
+            .as_bytes(),
+        );
+        assert_eq!(found.len(), 1, "{found:?}");
+        assert_eq!(found[0].rule, "rm-rf-root");
+        assert_eq!(found[0].arguments, r#"{"command":"rm -rf / && echo done"}"#);
+    }
+
+    /// `-T` is an upload only in curl: `docker compose exec -T` turns off
+    /// the terminal.
+    #[test]
+    fn a_dash_t_outside_curl_is_not_an_upload() {
+        let t = ToolInspection::default();
+        assert!(
+            t.whole(&call(
+                "docker compose exec -T postgres psql -c 'select 1'; open https://docs.example.com"
+            ))
+            .is_empty()
+        );
+    }
+
     #[test]
     fn the_excerpt_a_hit_reports_can_be_masked() {
         let key = "sk-ant-api03-AAAAAAAAAAAAAAAAAAAAAAAAAAAA";

deploy/docker-compose.dev.yml

@@ -112,7 +112,7 @@ services:
 
   # --- Zitadel (OIDC / SSO provider for development) ---
   zitadel:
-    image: ghcr.io/zitadel/zitadel:v4.19.4
+    image: ghcr.io/zitadel/zitadel:v4.19.5
     command: start-from-init --masterkeyFromEnv --tlsMode disabled
     environment:
       ZITADEL_MASTERKEY: "${ZITADEL_MASTERKEY:?ZITADEL_MASTERKEY is required (32 chars)}"

deploy/docker/Dockerfile.web

@@ -6,7 +6,7 @@
 # `pnpm install` and `pnpm build` under QEMU: the build alone took 260s
 # against 23s natively, and when Node crashed there with SIGILL the step
 # never exited — the CI job sat idle until GitHub's six-hour limit.
-FROM --platform=$BUILDPLATFORM node:24.21.0-alpine AS builder
+FROM --platform=$BUILDPLATFORM node:24.22.0-alpine AS builder
 
 # Pin pnpm to a known-good 12.x, matching `packageManager` in
 # web/package.json. The workspace YAML's `allowBuilds` field requires
@@ -15,7 +15,7 @@ FROM --platform=$BUILDPLATFORM node:24.21.0-alpine AS builder
 # a non-reproducible dist/. pnpm 12 is a native binary: Corepack fetches
 # the `pnpm` wrapper, whose first run downloads the musl build from the
 # npm registry and checks it against npm's signature before running it.
-RUN corepack enable && corepack prepare pnpm@12.9.1 --activate
+RUN corepack enable && corepack prepare pnpm@12.14.0 --activate
 
 WORKDIR /app
 # pnpm-workspace.yaml carries the install-script allowlist (see its

deploy/helm/think-watch/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: think-watch
 description: Enterprise AI API Gateway & MCP Management Platform
 type: application
-version: 3.8.2
-appVersion: "3.8.2"
+version: 3.8.3
+appVersion: "3.8.3"
 keywords:
   - ai
   - gateway

web/package.json

@@ -1,9 +1,9 @@
 {
   "name": "web",
   "private": true,
-  "version": "3.8.2",
+  "version": "3.8.3",
   "type": "module",
-  "packageManager": "pnpm@12.9.1",
+  "packageManager": "pnpm@12.14.0",
   "scripts": {
     "dev": "vite",
     "build": "node scripts/check-i18n.mjs && tsc -b && vite build",