Changelog

Tier 2 scores every string in a tool result, and on list-shaped responses (many short fields with the occasional long one) most of that work was spent on padding rather than content. Strings are now grouped into fixed-width length buckets before batching, which is faster on exactly those responses. It also makes a string's score depend only on the string itself rather than on whichever other strings happened to share its batch, so verdicts near a threshold no longer shift between payloads.

Tier 3's verdict text is the model's own top pick, which is an implicit even split that nobody chose. Setting the new tier3.blockThreshold makes the defender decide on the score instead, so you can put the operating point where your risk tolerance actually is. It is opt-in: left unset, behaviour is identical to before, because a score's direction is not guaranteed across providers and blind thresholding could otherwise invert a decision.

Tier 3 providers can now report token counts on the verdict, so callers can attribute spend per request instead of digging through a raw response. The field is optional and additive, so providers that ignore it keep working unchanged.

Adds the optional Tier 3 review layer. The package ships the provider interface and the orchestration only, so the model endpoint stays in your code rather than being baked in. Two modes: cascade, which escalates to Tier 3 only when Tier 2 lands in an uncertain band, and a Tier 3 only mode. Both default off, and a provider error records a reason on the result rather than failing the call.

The bundled Tier 2 classifier gains a second head and ships its own calibration alongside it, so you get well-behaved probabilities without tuning thresholds yourself. Also fixes a reporting inconsistency: tier2Score now reports the score that actually drove the decision, with the unadjusted value kept on tier2RawScore for debugging. The result is that tier2Score, riskLevel and allowed always tell one coherent story.

Two fixes worth calling out. A single alarming sentence inside otherwise ordinary text, the kind of line a legitimate security-alert email contains, no longer dominates the score for the whole result. And Tier 2 now scans every string in a tool result rather than only the fields Tier 1 flagged, which closes a gap: fields outside Tier 1's rules were still visible to the model, so skipping them left a path through. Object traversal also refuses prototype-polluting keys and records any it drops.