LangChain.js

Shield has two LangChain.js integrations, both in @zeroleaks/shield/langchain. Both require @langchain/core.

1. shieldChatModel wraps a chat model, such as ChatOpenAI or ChatAnthropic. It hardens system messages, checks human and tool messages, and guards the model's text and tool call arguments on every call, streamed or not. Use this integration by default.
2. ShieldCallbackHandler checks the runs it is attached to: messages sent to chat models, tool outputs, retrieved documents, and model output. It can stop a run, but it can't harden a prompt or redact output. Use it for chains and agents whose model you can't wrap.

shieldChatModelCopy Anchor Link

import { ChatOpenAI } from "@langchain/openai";
import { shieldChatModel } from "@zeroleaks/shield/langchain";

const model = shieldChatModel(new ChatOpenAI({ model: "gpt-5.5" }), {
  systemPrompt: "You are a support agent...",
});

const reply = await model.invoke([
  ["system", "You are a support agent..."],
  ["human", userInput],
]);

The wrapped model retains your model's type and class, supports bindTools() and withStructuredOutput(), and can be used in a chain or agent. Passing something that is not a chat model (one without _generate) throws a TypeError.

How it worksCopy Anchor Link

Every call on a LangChain chat model, whether invoke, batch, stream, streamEvents, or a call from a chain or agent, ultimately calls the model's _generate or _streamResponseChunks method. shieldChatModel returns a Proxy over your model that guards those two methods. On each call, Shield:

1. Hardens every system message, a SystemMessage or a ChatMessage with role system or developer (unless harden: false), adding the canary if you set one. It makes a new message of the same class: string content stays a string, and in content blocks the text blocks are joined with newlines into the first one and hardened, and other blocks stay where they were. Your messages are not modified.
2. Runs detection on every human message (unless detect: false) and every tool and function message (unless scanToolResults: false), including earlier turns. Text blocks are joined; other blocks are ignored. AI messages are not scanned.
3. Calls the model's own method.
4. Guards each AI message in the result: its text, as a string or its text blocks joined and written back over the same blocks, is checked for prompt leaks (unless sanitize: false or there is no system prompt) and passed through the output guard (unless output: false), and so is every string in each tool_calls entry's args.
5. Updates the other copies of the tool call arguments that providers keep: tool_use, tool_call, tool_call_chunk, and function_call content blocks, tool_call_chunks, and OpenAI's additional_kwargs.tool_calls. Each takes the guarded arguments of the tool call with the same id, so a finding is reported once. A copy that matches no tool call, and each of invalid_tool_calls, is guarded on its own.
6. When anything was redacted, rebuilds the generation's text and removes logprobs from its generationInfo and the message's response_metadata.

For prompt leak checks, Shield uses systemPrompt if provided. Otherwise, it uses the text of the first system message before hardening.

A secondaryDetector in the detect or scanToolResults options runs before a request is blocked, and detection results are reused for text already checked, as described under Shared behavior.

Runnables made from the modelCopy Anchor Link

Other methods run with the wrapped model as this, so the runnables they build call the guarded model: bindTools(), withConfig(), withStructuredOutput(), pipe(), withRetry(), withFallbacks(), and the rest. If a method returns a new chat model instead, or a runnable bound to one, as some bindTools() implementations do, that model is wrapped with the same options.

const withTools = model.bindTools([searchTool]); // still guarded
const extractor = model.withStructuredOutput(schema); // still guarded

OptionsCopy Anchor Link

shieldChatModel takes the shared options. systemPrompt defaults to the text of the first system message, before hardening. streamingChunkSize is not used.

StreamingCopy Anchor Link

See Streaming for the three streamingSanitize modes. Here they work like this:

Tokens the model reports to callback handlers through handleLLMNewToken are also buffered, then replayed for the chunks that are yielded. Callback handlers, streamEvents(), and LangGraph's messages stream mode therefore only see guarded text. A model that streams inside _generate has its tokens buffered the same way, and each generation's guarded text is then sent as one token.

streamEvents() without a version produces LangChain's content block events. Shield builds them from the guarded chunks with LangChain's base implementation, in place of the provider's own.

What is not coveredCopy Anchor Link

• The wrapped model is a Proxy. Methods other than _generate and _streamResponseChunks run with the Proxy as this. A model class that keeps state in JavaScript private fields (#field) and reads them in those methods throws a TypeError through the Proxy. A model that produces output without going through _generate or _streamResponseChunks is not guarded.
• Cache hits: with a LangChain cache, a hit returns the stored response without calling the model, so neither the input check nor the output guard runs for it.
• A provider's own content block events are not used; see Streaming.
• Reasoning and thinking blocks in the output are not scanned, and images, audio, and files in messages are not read.
• Other parts of a chain: only the wrapped model is guarded. Tools, retrievers, and other models in the chain are not; attach a ShieldCallbackHandler to check tool outputs and retrieved documents.

ShieldCallbackHandlerCopy Anchor Link

import { ShieldCallbackHandler } from "@zeroleaks/shield/langchain";

const shield = new ShieldCallbackHandler({
  throwOnLeak: true,
  blockOnOutputFindings: true,
});

const result = await agent.invoke(input, { callbacks: [shield] });

The handler checks what passes through the runs it is attached to:

With onDetection: "warn", injections are reported to onInjectionDetected and nothing throws.

The handler sets raiseError, so LangChain waits for it and passes its errors on to the run, after logging them with console.error. A framework that catches tool errors and reports them to the model, as LangGraph's ToolNode does by default, sends the model the error message instead of the tool output.

It can block, but it can't redact. A callback observes the run but cannot modify it: prompts are not hardened, output is not redacted, and output with a finding either stops the run or passes through unchanged. With streaming, handleLLMEnd runs after the text has been streamed, so it can fail the run but cannot retract that text. Use shieldChatModel wherever you can wrap the model.

OptionsCopy Anchor Link

ShieldCallbackHandler takes the shared options except harden, streamingSanitize, and streamingChunkSize. Since it can't add anything to the prompt, canary only finds a token you put in the prompt yourself; canary: true creates a token that never appears.

What is not coveredCopy Anchor Link

LLM runs with a plain string prompt (handleLLMStart), chain inputs and outputs, and anything the handler isn't attached to are not checked. See What is not scanned for what no integration scans.