@highflame/policy 2.0.9 → 2.0.10

package/dist/service-schemas.gen.d.ts

@@ -1,23 +1,17 @@
 /**
- * Overwatch (Guardian) Cedar schema
+ * Overwatch Cedar schema
  *
- * Full Cedar schema for IDE security, including:
- * - Actions: process_prompt, call_tool, connect_server, read_file, write_file
- * - Entities: User, Agent, LlmPrompt, Tool, Server, FilePath
- * - Context attributes for threat detection and workspace security
+ * Full Cedar schema for overwatch, embedded at codegen time.
  */
-export declare const OVERWATCH_SCHEMA = "// Overwatch (Guardian) Cedar Schema\n// ===================================\n// IDE Security & Policy Enforcement\n//\n// Overwatch protects IDE operations (prompts, tool calls, file access) by evaluating\n// threats detected by YARA and Javelin scanners against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 YARA/Javelin \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES\n// =============================================================================\n\n// Human user or service account making requests to the IDE\nentity User {\n  user_type: String,      // \"external\" or \"internal\"\n  email: String,          // User email (optional)\n};\n\n// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent {\n  agent_type: String,      // \"claude\", \"copilot\", etc.\n};\n\n// LLM prompt or session\nentity LlmPrompt {\n  prompt_type: String,     // \"user_prompt\", \"session\"\n};\n\n// MCP tool or native IDE tool\nentity Tool {\n  tool_name: String,       // \"shell\", \"read_file\", \"playwright\", etc.\n  risk_level: String,      // \"low\", \"medium\", \"high\"\n};\n\n// MCP server\nentity Server {\n  server_name: String,     // \"filesystem\", \"playwright\", etc.\n};\n\n// File system path\nentity FilePath {\n  path: String,\n  is_within_workspace: Bool,\n};\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Event & Source\n    content: String,                // Raw content being scanned\n    source: String,                 // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                  // Hook event name\n    user_email: String,             // User identifier\n\n    // Workspace\n    cwd: String,                   // Current working directory\n    workspace_root: String,        // Workspace/repository root\n\n    // Threat Detection\n    threat_count: Long,             // Total threats detected\n    highest_severity: String,       // \"critical\", \"high\", \"medium\", \"low\"\n    threat_categories: Set<String>, // Threat category names\n\n    yara_threats: Set<String>,      // YARA rule names\n    max_threat_severity: Long,      // Numeric severity (0-4)\n    contains_secrets: Bool,         // Whether secrets detected\n    prompt_text: String,           // Same as content (legacy)\n    response_content: String,      // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Event & Source\n    content: String,                // Raw content being scanned (e.g., shell command)\n    source: String,                 // IDE source\n    event: String,                  // Hook event name\n    user_email: String,             // User identifier\n\n    // Tool & MCP\n    tool_name: String,             // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server: String,            // MCP server name\n    mcp_tool: String,              // MCP tool name\n\n    // File & Path\n    path: String,                  // File path (if file operation)\n\n    // Workspace\n    cwd: String,\n    workspace_root: String,\n\n    // Threat Detection\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n\n    yara_threats: Set<String>,\n    max_threat_severity: Long,\n    contains_secrets: Bool,\n    response_content: String,\n  },\n};\n\n// Connect to an MCP server\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server: String,\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    max_threat_severity: Long,\n  },\n};\n\n// Read a file from disk\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path: String,\n    cwd: String,\n    workspace_root: String,\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    max_threat_severity: Long,\n    contains_secrets: Bool,\n  },\n};\n\n// Write a file to disk\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path: String,\n    cwd: String,\n    workspace_root: String,\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    max_threat_severity: Long,\n    contains_secrets: Bool,\n  },\n};\n\n}\n";
+export declare const OVERWATCH_SCHEMA = "// Overwatch (Guardian) Cedar Schema\n// ===================================\n// IDE Security & Policy Enforcement\n//\n// Overwatch protects IDE operations (prompts, tool calls, file access) by evaluating\n// threats detected by YARA and Javelin scanners against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 YARA/Javelin \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Organization Hierarchy (ReBAC)\n// =============================================================================\n\n// Top-level organization for multi-tenant policy enforcement\n// Enables policies like: principal in Overwatch::Organization::\"acme-corp\"\nentity Organization {\n  name: String,            // \"Acme Corp\", \"Highflame\"\n};\n\n// Team within an organization\n// Enables policies like: principal in Overwatch::Team::\"security-team\"\nentity Team in [Organization] {\n  name: String,            // \"security\", \"engineering\", \"devops\"\n};\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n// Human user or service account making requests to the IDE\nentity User in [Team] {\n  user_type: String,      // \"external\" or \"internal\"\n  email: String,          // User email (optional)\n};\n\n// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent in [Team] {\n  agent_type: String,      // \"claude\", \"copilot\", etc.\n};\n\n// LLM prompt or session\nentity LlmPrompt {\n  prompt_type: String,     // \"user_prompt\", \"session\"\n};\n\n// MCP tool or native IDE tool\nentity Tool {\n  tool_name: String,       // \"shell\", \"read_file\", \"playwright\", etc.\n  risk_level: String,      // \"low\", \"medium\", \"high\"\n};\n\n// MCP server\nentity Server {\n  server_name: String,     // \"filesystem\", \"playwright\", etc.\n};\n\n// File system path\nentity FilePath {\n  path: String,\n  is_within_workspace: Bool,\n};\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Event & Source\n    content: String,                // Raw content being scanned\n    source: String,                 // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                  // Hook event name\n    user_email: String,             // User identifier\n\n    // Workspace\n    cwd?: String,                   // Current working directory\n    workspace_root?: String,        // Workspace/repository root\n\n    // Threat Detection\n    threat_count: Long,             // Total threats detected\n    highest_severity: String,       // \"critical\", \"high\", \"medium\", \"low\"\n    threat_categories: Set<String>, // Threat category names\n    yara_threats: Set<String>,      // YARA rule names\n    max_threat_severity: Long,      // Numeric severity (0-4)\n    contains_secrets: Bool,         // Whether secrets detected\n    prompt_text?: String,           // Same as content (legacy)\n    response_content?: String,      // Response content (if available)\n\n    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)\n    // Required: content safety classifiers always run for prompt processing\n    violence_score: Long,           // Violence content detection score\n    weapons_score: Long,            // Weapons content detection score\n    hate_speech_score: Long,        // Hate speech detection score\n    crime_score: Long,              // Criminal content detection score\n    sexual_score: Long,             // Sexual content detection score\n    profanity_score: Long,          // Profanity detection score\n\n    // Detector Confidence Scores (0-100, ML classifier confidence)\n    // Required: ML classifiers always run for prompt processing\n    pii_confidence: Long,           // PII detection confidence\n    injection_confidence: Long,     // Prompt injection confidence\n    jailbreak_confidence: Long,     // Jailbreak detection confidence\n\n    // Agent Security (0-100)\n    // Required: agent security scanners always run for prompt processing\n    indirect_injection_score: Long,  // Indirect prompt injection risk\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Event & Source\n    content: String,                // Raw content being scanned (e.g., shell command)\n    source: String,                 // IDE source\n    event: String,                  // Hook event name\n    user_email: String,             // User identifier\n\n    // Tool & MCP\n    tool_name?: String,             // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,            // MCP server name\n    mcp_tool?: String,              // MCP tool name\n\n    // File & Path\n    path?: String,                  // File path (if file operation)\n\n    // Workspace\n    cwd?: String,\n    workspace_root?: String,\n\n    // Threat Detection (optional: scanning may not have run before tool call)\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    yara_threats?: Set<String>,\n    max_threat_severity?: Long,\n    contains_secrets?: Bool,\n    response_content?: String,\n\n    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)\n    // Optional: only present when trust/safety classifiers have run\n    violence_score?: Long,          // Violence content detection score\n    weapons_score?: Long,           // Weapons content detection score\n    hate_speech_score?: Long,       // Hate speech detection score\n    crime_score?: Long,             // Criminal content detection score\n    sexual_score?: Long,            // Sexual content detection score\n    profanity_score?: Long,         // Profanity detection score\n\n    // Detector Confidence Scores (0-100, ML classifier confidence)\n    // Optional: only present when ML classifiers have run\n    pii_confidence?: Long,          // PII detection confidence\n    injection_confidence?: Long,    // Prompt injection confidence\n    jailbreak_confidence?: Long,    // Jailbreak detection confidence\n\n    // Agent Security (0-100)\n    // Optional: only present when agent security scanners have run\n    tool_poisoning_score?: Long,    // Tool description manipulation risk\n    rug_pull_score?: Long,          // Tool behavior mismatch risk\n    indirect_injection_score?: Long, // Indirect prompt injection risk\n\n    // MCP Trust\n    // Optional: only present when MCP server verification has run\n    mcp_server_verified?: Bool,     // Whether server is from verified registry\n  },\n};\n\n// Connect to an MCP server\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    content?: String,               // No content to scan when connecting\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n    threat_count?: Long,            // Threat scanning may not run for connections\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // Agent Security (0-100)\n    // Optional: only present when agent security scanners have run\n    tool_poisoning_score?: Long,    // Tool description manipulation risk\n    rug_pull_score?: Long,          // Tool behavior mismatch risk\n    indirect_injection_score?: Long, // Indirect prompt injection risk\n\n    // MCP Trust\n    // Optional: only present when MCP server verification has run\n    mcp_server_verified?: Bool,     // Whether server is from verified registry\n  },\n};\n\n// Read a file from disk\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n    threat_count?: Long,             // Threat scanning may not have run\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n    contains_secrets?: Bool,\n  },\n};\n\n// Write a file to disk\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n    threat_count?: Long,             // Threat scanning may not have run\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n    contains_secrets?: Bool,\n  },\n};\n\n}\n";
 /**
  * Palisade Cedar schema
  *
- * Full Cedar schema for ML supply chain security, including:
- * - Actions: scan_artifact, validate_integrity, validate_provenance, quarantine_artifact, load_model, deploy_model
- * - Entities: Scanner, Artifact, Package
- * - Context attributes for ML security findings
+ * Full Cedar schema for palisade, embedded at codegen time.
  */
 export declare const PALISADE_SCHEMA = "// Palisade Cedar Schema\n// =====================\n// ML Supply Chain Security & Artifact Scanning\n//\n// Palisade scans ML model artifacts (safetensors, GGUF, pickle, PyTorch) for\n// security vulnerabilities and enforces policies based on findings.\n//\n// Architecture:\n//   Scanner \u2192 Validators (Pickle, SafeTensors, GGUF, etc.) \u2192 Cedar Policy \u2192 Allow/Deny/Quarantine\n//\n// Supported Formats:\n//   - SafeTensors (.safetensors)\n//   - GGUF (.gguf)\n//   - Pickle (.pkl, .pickle, .pt)\n//   - PyTorch (.pth, .pt)\n//   - ONNX (.onnx)\n\nnamespace Palisade {\n\n// =============================================================================\n// ENTITIES\n// =============================================================================\n\n// Security scanner service\nentity Scanner {\n  scanner_type: String,    // \"palisade\", \"redteam\", etc.\n};\n\n// ML model artifact\nentity Artifact {\n  artifact_format: String, // \"safetensors\", \"gguf\", \"pickle\", \"pytorch\", \"onnx\"\n  path: String,            // File path\n  signed: Bool,            // Whether digitally signed\n  signer: String,          // Who signed (if applicable)\n};\n\n// Software package (npm, PyPI, etc.)\nentity Package {\n  package_name: String,\n  package_version: String,\n};\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// Scan an ML artifact for security issues\naction scan_artifact appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    // Core Finding & Severity\n    finding_type: String,              // Type of finding (e.g., \"backdoor_detected\", \"safetensors_integrity_violation\")\n    severity: String,                  // \"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\", \"INFO\"\n    environment: String,               // \"production\", \"strict_production\", \"development\", \"permissive_development\", \"research\"\n\n    // Artifact Metadata\n    artifact_format: String,           // \"safetensors\", \"gguf\", \"pickle\", \"pytorch\", \"onnx\"\n    path: String,                      // File path to artifact\n    artifact_signed: Bool,             // Whether artifact is digitally signed\n    provenance_signer: String,         // \"unknown\", \"unsigned\", or signer name\n\n    // Pickle Security\n    pickle_exec_path_detected: Bool,  // Pickle RCE execution path detected (CRITICAL)\n\n    // Tokenizer Security\n    tokenizer_added_tokens_count: Long, // Number of added tokens (0-5000+)\n\n    // LoRA Security\n    adapter_base_digest_mismatch: Bool, // LoRA adapter base model digest mismatch\n\n    // GGUF Security\n    gguf_suspicious_metadata: Bool,   // GGUF metadata contains suspicious patterns\n\n    // SafeTensors Security\n    safetensors_integrity_violation: Bool, // SafeTensors file integrity violated\n\n    // General Metadata Security\n    metadata_malicious_pattern: Bool, // Metadata contains malicious patterns\n\n    // CoSAI Maturity\n    metadata_cosai_level_numeric: Long, // CoSAI maturity level (0-5, higher = more trustworthy)\n\n    // Backdoor Detection\n    match_count: Long,                // Number of behavioral backdoor indicator matches\n  },\n};\n\n// Validate artifact integrity (checksum, signature)\naction validate_integrity appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    artifact_format: String,\n    path: String,\n    artifact_signed: Bool,\n    provenance_signer: String,\n    safetensors_integrity_violation: Bool,\n    finding_type: String,\n    severity: String,\n  },\n};\n\n// Validate artifact provenance (signer, origin)\naction validate_provenance appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    artifact_format: String,\n    path: String,\n    artifact_signed: Bool,\n    provenance_signer: String,\n    metadata_cosai_level_numeric: Long,\n    finding_type: String,\n    severity: String,\n  },\n};\n\n// Quarantine a malicious artifact\naction quarantine_artifact appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    finding_type: String,\n    severity: String,\n    environment: String,\n    artifact_format: String,\n    path: String,\n  },\n};\n\n// Load an ML model into memory\naction load_model appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    artifact_format: String,\n    environment: String,\n    artifact_signed: Bool,\n    severity: String,\n  },\n};\n\n// Deploy an ML model to production\naction deploy_model appliesTo {\n  principal: [Scanner],\n  resource: [Artifact],\n  context: {\n    artifact_format: String,\n    environment: String,\n    artifact_signed: Bool,\n    provenance_signer: String,\n    severity: String,\n  },\n};\n\n// Scan a software package\naction scan_package appliesTo {\n  principal: [Scanner],\n  resource: [Package],\n  context: {\n    finding_type: String,\n    severity: String,\n    environment: String,\n  },\n};\n\n}\n";
 /**
- * Context attribute metadata for Overwatch actions.
+ * Context attribute metadata for service actions.
  * Used by PolicyBuilder UI to generate form fields.
  */
 export interface ContextAttribute {

package/dist/service-schemas.gen.js

@@ -5,15 +5,12 @@
 // Works in both browser and Node.js environments.
 //
 // Usage:
-//   import { OVERWATCH_SCHEMA, PALISADE_SCHEMA } from '@highflame/policy/types';
-//   import { OVERWATCH_CONTEXT, PALISADE_CONTEXT } from '@highflame/policy/types';
+//   import { OVERWATCH_SCHEMA, OVERWATCH_CONTEXT } from '@highflame/policy/types';
+//   import { PALISADE_SCHEMA, PALISADE_CONTEXT } from '@highflame/policy/types';
 /**
- * Overwatch (Guardian) Cedar schema
+ * Overwatch Cedar schema
  *
- * Full Cedar schema for IDE security, including:
- * - Actions: process_prompt, call_tool, connect_server, read_file, write_file
- * - Entities: User, Agent, LlmPrompt, Tool, Server, FilePath
- * - Context attributes for threat detection and workspace security
+ * Full Cedar schema for overwatch, embedded at codegen time.
  */
 export const OVERWATCH_SCHEMA = `// Overwatch (Guardian) Cedar Schema
 // ===================================
@@ -33,17 +30,33 @@ export const OVERWATCH_SCHEMA = `// Overwatch (Guardian) Cedar Schema
 namespace Overwatch {
 
 // =============================================================================
-// ENTITIES
+// ENTITIES - Organization Hierarchy (ReBAC)
+// =============================================================================
+
+// Top-level organization for multi-tenant policy enforcement
+// Enables policies like: principal in Overwatch::Organization::"acme-corp"
+entity Organization {
+  name: String,            // "Acme Corp", "Highflame"
+};
+
+// Team within an organization
+// Enables policies like: principal in Overwatch::Team::"security-team"
+entity Team in [Organization] {
+  name: String,            // "security", "engineering", "devops"
+};
+
+// =============================================================================
+// ENTITIES - Principals
 // =============================================================================
 
 // Human user or service account making requests to the IDE
-entity User {
+entity User in [Team] {
   user_type: String,      // "external" or "internal"
   email: String,          // User email (optional)
 };
 
 // AI agent (Claude, GitHub Copilot, etc.)
-entity Agent {
+entity Agent in [Team] {
   agent_type: String,      // "claude", "copilot", etc.
 };
 
@@ -85,19 +98,37 @@ action process_prompt appliesTo {
     user_email: String,             // User identifier
 
     // Workspace
-    cwd: String,                   // Current working directory
-    workspace_root: String,        // Workspace/repository root
+    cwd?: String,                   // Current working directory
+    workspace_root?: String,        // Workspace/repository root
 
     // Threat Detection
     threat_count: Long,             // Total threats detected
     highest_severity: String,       // "critical", "high", "medium", "low"
     threat_categories: Set<String>, // Threat category names
-
     yara_threats: Set<String>,      // YARA rule names
     max_threat_severity: Long,      // Numeric severity (0-4)
     contains_secrets: Bool,         // Whether secrets detected
-    prompt_text: String,           // Same as content (legacy)
-    response_content: String,      // Response content (if available)
+    prompt_text?: String,           // Same as content (legacy)
+    response_content?: String,      // Response content (if available)
+
+    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)
+    // Required: content safety classifiers always run for prompt processing
+    violence_score: Long,           // Violence content detection score
+    weapons_score: Long,            // Weapons content detection score
+    hate_speech_score: Long,        // Hate speech detection score
+    crime_score: Long,              // Criminal content detection score
+    sexual_score: Long,             // Sexual content detection score
+    profanity_score: Long,          // Profanity detection score
+
+    // Detector Confidence Scores (0-100, ML classifier confidence)
+    // Required: ML classifiers always run for prompt processing
+    pii_confidence: Long,           // PII detection confidence
+    injection_confidence: Long,     // Prompt injection confidence
+    jailbreak_confidence: Long,     // Jailbreak detection confidence
+
+    // Agent Security (0-100)
+    // Required: agent security scanners always run for prompt processing
+    indirect_injection_score: Long,  // Indirect prompt injection risk
   },
 };
 
@@ -113,26 +144,50 @@ action call_tool appliesTo {
     user_email: String,             // User identifier
 
     // Tool & MCP
-    tool_name: String,             // Normalized tool name ("shell", "read_file", etc.)
-    mcp_server: String,            // MCP server name
-    mcp_tool: String,              // MCP tool name
+    tool_name?: String,             // Normalized tool name ("shell", "read_file", etc.)
+    mcp_server?: String,            // MCP server name
+    mcp_tool?: String,              // MCP tool name
 
     // File & Path
-    path: String,                  // File path (if file operation)
+    path?: String,                  // File path (if file operation)
 
     // Workspace
-    cwd: String,
-    workspace_root: String,
-
-    // Threat Detection
-    threat_count: Long,
-    highest_severity: String,
-    threat_categories: Set<String>,
-
-    yara_threats: Set<String>,
-    max_threat_severity: Long,
-    contains_secrets: Bool,
-    response_content: String,
+    cwd?: String,
+    workspace_root?: String,
+
+    // Threat Detection (optional: scanning may not have run before tool call)
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    yara_threats?: Set<String>,
+    max_threat_severity?: Long,
+    contains_secrets?: Bool,
+    response_content?: String,
+
+    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)
+    // Optional: only present when trust/safety classifiers have run
+    violence_score?: Long,          // Violence content detection score
+    weapons_score?: Long,           // Weapons content detection score
+    hate_speech_score?: Long,       // Hate speech detection score
+    crime_score?: Long,             // Criminal content detection score
+    sexual_score?: Long,            // Sexual content detection score
+    profanity_score?: Long,         // Profanity detection score
+
+    // Detector Confidence Scores (0-100, ML classifier confidence)
+    // Optional: only present when ML classifiers have run
+    pii_confidence?: Long,          // PII detection confidence
+    injection_confidence?: Long,    // Prompt injection confidence
+    jailbreak_confidence?: Long,    // Jailbreak detection confidence
+
+    // Agent Security (0-100)
+    // Optional: only present when agent security scanners have run
+    tool_poisoning_score?: Long,    // Tool description manipulation risk
+    rug_pull_score?: Long,          // Tool behavior mismatch risk
+    indirect_injection_score?: Long, // Indirect prompt injection risk
+
+    // MCP Trust
+    // Optional: only present when MCP server verification has run
+    mcp_server_verified?: Bool,     // Whether server is from verified registry
   },
 };
 
@@ -141,15 +196,25 @@ action connect_server appliesTo {
   principal: [User, Agent],
   resource: [Server],
   context: {
-    content: String,
+    content?: String,               // No content to scan when connecting
     source: String,
     event: String,
     user_email: String,
-    mcp_server: String,
-    threat_count: Long,
-    highest_severity: String,
-    threat_categories: Set<String>,
-    max_threat_severity: Long,
+    mcp_server?: String,
+    threat_count?: Long,            // Threat scanning may not run for connections
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    max_threat_severity?: Long,
+
+    // Agent Security (0-100)
+    // Optional: only present when agent security scanners have run
+    tool_poisoning_score?: Long,    // Tool description manipulation risk
+    rug_pull_score?: Long,          // Tool behavior mismatch risk
+    indirect_injection_score?: Long, // Indirect prompt injection risk
+
+    // MCP Trust
+    // Optional: only present when MCP server verification has run
+    mcp_server_verified?: Bool,     // Whether server is from verified registry
   },
 };
 
@@ -162,14 +227,14 @@ action read_file appliesTo {
     source: String,
     event: String,
     user_email: String,
-    path: String,
-    cwd: String,
-    workspace_root: String,
-    threat_count: Long,
-    highest_severity: String,
-    threat_categories: Set<String>,
-    max_threat_severity: Long,
-    contains_secrets: Bool,
+    path?: String,
+    cwd?: String,
+    workspace_root?: String,
+    threat_count?: Long,             // Threat scanning may not have run
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    max_threat_severity?: Long,
+    contains_secrets?: Bool,
   },
 };
 
@@ -182,14 +247,14 @@ action write_file appliesTo {
     source: String,
     event: String,
     user_email: String,
-    path: String,
-    cwd: String,
-    workspace_root: String,
-    threat_count: Long,
-    highest_severity: String,
-    threat_categories: Set<String>,
-    max_threat_severity: Long,
-    contains_secrets: Bool,
+    path?: String,
+    cwd?: String,
+    workspace_root?: String,
+    threat_count?: Long,             // Threat scanning may not have run
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    max_threat_severity?: Long,
+    contains_secrets?: Bool,
   },
 };
 
@@ -198,10 +263,7 @@ action write_file appliesTo {
 /**
  * Palisade Cedar schema
  *
- * Full Cedar schema for ML supply chain security, including:
- * - Actions: scan_artifact, validate_integrity, validate_provenance, quarantine_artifact, load_model, deploy_model
- * - Entities: Scanner, Artifact, Package
- * - Context attributes for ML security findings
+ * Full Cedar schema for palisade, embedded at codegen time.
  */
 export const PALISADE_SCHEMA = `// Palisade Cedar Schema
 // =====================
@@ -377,7 +439,7 @@ action scan_package appliesTo {
  */
 export const OVERWATCH_CONTEXT = {
     "service": "overwatch",
-    "version": "1.0.0",
+    "version": "2.0.0",
     "description": "Overwatch (Guardian) IDE security & policy enforcement",
     "actions": [
         {
@@ -393,11 +455,22 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "threat_count", "type": "number", "required": true, "description": "Total number of threats detected by YARA/Javelin" },
                 { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level: critical, high, medium, low" },
                 { "key": "threat_categories", "type": "array", "required": true, "description": "Threat category names from aggregator" },
+                { "key": "threat_types", "type": "array", "required": true, "description": "YARA threat category names" },
                 { "key": "yara_threats", "type": "array", "required": true, "description": "YARA rule names that matched" },
                 { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4, where 4=CRITICAL)" },
                 { "key": "contains_secrets", "type": "boolean", "required": true, "description": "Whether secrets or credentials were detected" },
                 { "key": "prompt_text", "type": "string", "required": false, "description": "Same as content (legacy field)" },
-                { "key": "response_content", "type": "string", "required": false, "description": "Response content from AI (if available)" }
+                { "key": "response_content", "type": "string", "required": false, "description": "Response content from AI (if available)" },
+                { "key": "violence_score", "type": "number", "required": true, "description": "Violence content detection score (0-100)" },
+                { "key": "weapons_score", "type": "number", "required": true, "description": "Weapons content detection score (0-100)" },
+                { "key": "hate_speech_score", "type": "number", "required": true, "description": "Hate speech detection score (0-100)" },
+                { "key": "crime_score", "type": "number", "required": true, "description": "Criminal content detection score (0-100)" },
+                { "key": "sexual_score", "type": "number", "required": true, "description": "Sexual content detection score (0-100)" },
+                { "key": "profanity_score", "type": "number", "required": true, "description": "Profanity detection score (0-100)" },
+                { "key": "pii_confidence", "type": "number", "required": true, "description": "PII detection classifier confidence (0-100)" },
+                { "key": "injection_confidence", "type": "number", "required": true, "description": "Prompt injection classifier confidence (0-100)" },
+                { "key": "jailbreak_confidence", "type": "number", "required": true, "description": "Jailbreak detection classifier confidence (0-100)" },
+                { "key": "indirect_injection_score", "type": "number", "required": true, "description": "Indirect prompt injection risk score (0-100)" }
             ]
         },
         {
@@ -414,28 +487,46 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "path", "type": "string", "required": false, "description": "File path (if file operation)" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace/repository root path" },
-                { "key": "threat_count", "type": "number", "required": true, "description": "Total threats detected" },
-                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity: critical, high, medium, low" },
-                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat category names" },
-                { "key": "yara_threats", "type": "array", "required": true, "description": "YARA rule names" },
-                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4)" },
-                { "key": "contains_secrets", "type": "boolean", "required": true, "description": "Whether secrets detected" },
-                { "key": "response_content", "type": "string", "required": false, "description": "Response content (if available)" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity (if scanning ran)" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names (if scanning ran)" },
+                { "key": "threat_types", "type": "array", "required": false, "description": "YARA threat categories (if scanning ran)" },
+                { "key": "yara_threats", "type": "array", "required": false, "description": "YARA rule names (if scanning ran)" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" },
+                { "key": "response_content", "type": "string", "required": false, "description": "Response content (if available)" },
+                { "key": "violence_score", "type": "number", "required": false, "description": "Violence content detection score (0-100)" },
+                { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content detection score (0-100)" },
+                { "key": "hate_speech_score", "type": "number", "required": false, "description": "Hate speech detection score (0-100)" },
+                { "key": "crime_score", "type": "number", "required": false, "description": "Criminal content detection score (0-100)" },
+                { "key": "sexual_score", "type": "number", "required": false, "description": "Sexual content detection score (0-100)" },
+                { "key": "profanity_score", "type": "number", "required": false, "description": "Profanity detection score (0-100)" },
+                { "key": "pii_confidence", "type": "number", "required": false, "description": "PII detection classifier confidence (0-100)" },
+                { "key": "injection_confidence", "type": "number", "required": false, "description": "Prompt injection classifier confidence (0-100)" },
+                { "key": "jailbreak_confidence", "type": "number", "required": false, "description": "Jailbreak detection classifier confidence (0-100)" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100)" },
+                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavior mismatch risk score (0-100)" },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100)" },
+                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether MCP server is from a verified registry" }
             ]
         },
         {
             "name": "connect_server",
             "description": "Connect to an MCP server",
             "context_attributes": [
-                { "key": "content", "type": "string", "required": true, "description": "Raw content being scanned" },
+                { "key": "content", "type": "string", "required": false, "description": "Raw content being scanned (if available)" },
                 { "key": "source", "type": "string", "required": true, "description": "IDE source" },
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "mcp_server", "type": "string", "required": false, "description": "MCP server name" },
-                { "key": "threat_count", "type": "number", "required": true, "description": "Total threats detected" },
-                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level" },
-                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat category names" },
-                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4)" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names (if scanning ran)" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100)" },
+                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavior mismatch risk score (0-100)" },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100)" },
+                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether MCP server is from a verified registry" }
             ]
         },
         {
@@ -447,14 +538,13 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name (e.g., beforeReadFile)" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "path", "type": "string", "required": false, "description": "File path being read" },
-                { "key": "file_path", "type": "string", "required": false, "description": "Duplicate of path field" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace root path" },
-                { "key": "threat_count", "type": "number", "required": true, "description": "Total threats detected" },
-                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level" },
-                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat categories" },
-                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4)" },
-                { "key": "contains_secrets", "type": "boolean", "required": true, "description": "Whether secrets detected" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat categories (if scanning ran)" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" }
             ]
         },
         {
@@ -466,14 +556,13 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "path", "type": "string", "required": false, "description": "File path being written" },
-                { "key": "file_path", "type": "string", "required": false, "description": "Duplicate of path field" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace root path" },
-                { "key": "threat_count", "type": "number", "required": true, "description": "Total threats detected" },
-                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level" },
-                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat categories" },
-                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4)" },
-                { "key": "contains_secrets", "type": "boolean", "required": true, "description": "Whether secrets detected" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat categories (if scanning ran)" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" }
             ]
         }
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.0.9",
+  "version": "2.0.10",
   "description": "Highflame Cedar policy types and engine wrapper",
   "readme": "README.md",
   "main": "dist/index.js",