@highflame/policy 2.1.1 → 2.1.2

package/dist/service-schemas.gen.js

@@ -141,15 +141,63 @@ namespace Guardrails {
         "contains_invisible_chars"?: Bool,
         "invisible_chars_score"?: Long,      // 0-100
 
-        // Additional detectors (optional)
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Bool,
+        "command_injection_type"?: String,       // "reverse_shell" | "privilege_escalation" | "code_execution" | "destructive_command" | "data_exfiltration"
+        "command_injection_score"?: Long,        // 0-100
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,      // "critical" | "high" | "medium" | "low" | "none"
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Bool,
+        "sql_injection_type"?: String,           // "tautology" | "union_based" | "destructive" | "blind" | "error_based"
+        "sql_injection_score"?: Long,            // 0-100
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,            // "cross_origin_tool" | "cross_origin_server" | "none"
+        "cross_origin_score"?: Long,             // 0-100
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Bool,
+        "encoded_types"?: Set<String>,           // ["base64", "hex", "unicode", "url", ...]
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,                  // 0-100
+
+        // Language & Script Detection (optional)
+        "detected_language"?: String,            // ISO language code
+        "is_english"?: Bool,
+        "language_confidence"?: Long,            // 0-100
+        "detected_script"?: String,              // "latin" | "cyrillic" | "arabic" | "unknown" | ...
+        "is_latin_script"?: Bool,
+        "script_confidence"?: Long,              // 0-100
+
+        // Content Analysis (optional)
         "hallucination_score"?: Long,
+        "factuality_score"?: Long,               // 0-100
         "sentiment_score"?: Long,
         "contains_code"?: Bool,
         "code_languages"?: Set<String>,
+        "code_ratio"?: Long,                     // 0-100, percentage of content that is code
         "keyword_matched"?: Bool,
         "keyword_categories"?: Set<String>,
-        "detected_language"?: String,
+        "keyword_count"?: Long,
+        "contains_non_ascii"?: Bool,
         "phishing_detected"?: Bool,
+        "content_safety_score"?: Long,           // 0-100
+        "content_safety_blocked"?: Bool,
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Bool,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
 
     };
 
@@ -196,6 +244,54 @@ namespace Guardrails {
         "pii_types"?: Set<String>,
         "injection_score"?: Long,
 
+        // Security - Pattern Detection (optional)
+        "command_injection_detected"?: Bool,
+        "command_injection_type"?: String,
+        "command_injection_score"?: Long,        // 0-100
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+        "sql_injection_detected"?: Bool,
+        "sql_injection_type"?: String,
+        "sql_injection_score"?: Long,            // 0-100
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,             // 0-100
+
+        // Security - Encoded Injection (optional)
+        "encoded_content_detected"?: Bool,
+        "encoded_types"?: Set<String>,
+        "encoded_count"?: Long,
+        "encoded_score"?: Long,                  // 0-100
+
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Bool,
+        "tool_poisoning_score"?: Long,           // 0-100
+        "tool_poisoning_type"?: String,          // "hidden_instructions" | "system_prompt_injection" | "authority_hijack"
+        "rug_pull_detected"?: Bool,
+        "rug_pull_score"?: Long,                 // 0-100
+        "rug_pull_type"?: String,                // "risk_spike" | "pattern_change" | "combined" | "none"
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Bool,
+        "mcp_risk_type"?: String,                // "inline_execution" | "suspicious_url" | "cross_origin"
+        "mcp_risk_score"?: Long,                 // 0-100
+
+        // Agentic - Multi-Turn Context (optional)
+        "conversation_turn"?: Long,
+        "multi_turn_detection"?: Bool,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for read_file action
@@ -210,6 +306,20 @@ namespace Guardrails {
         "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for write_file action
@@ -224,6 +334,20 @@ namespace Guardrails {
         "pii_detected"?: Bool,
         "pii_types"?: Set<String>,
 
+        // Security - Path Traversal (optional)
+        "path_traversal_detected"?: Bool,
+        "path_traversal_severity"?: String,
+        "path_traversal_type"?: String,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 
     /// Context for connect_server action (MCP server connections)
@@ -236,6 +360,30 @@ namespace Guardrails {
         "mcp_server"?: String,           // MCP server name (e.g., "github", "filesystem")
         "mcp_server_verified"?: Bool,    // Whether server is from verified registry
 
+        // Agentic - Agent Security (optional)
+        "tool_poisoning_detected"?: Bool,
+        "tool_poisoning_score"?: Long,
+        "tool_poisoning_type"?: String,
+
+        // Agentic - MCP Risk (optional)
+        "mcp_config_risk"?: Bool,
+        "mcp_risk_type"?: String,
+        "mcp_risk_score"?: Long,
+
+        // Security - Cross-Origin Escalation (optional)
+        "cross_origin_detected"?: Bool,
+        "cross_origin_type"?: String,
+        "cross_origin_score"?: Long,
+
+        // Session Detection History — cross-turn sticky flags (optional)
+        "session_pii_detected"?: Bool,
+        "session_pii_types"?: Set<String>,
+        "session_secrets_detected"?: Bool,
+        "session_secret_types"?: Set<String>,
+        "session_injection_detected"?: Bool,
+        "session_command_injection"?: Bool,
+        "session_threat_turns"?: Long,
+
     };
 }
 `;
@@ -244,213 +392,288 @@ namespace Guardrails {
  *
  * Full Cedar schema for overwatch, embedded at codegen time.
  */
-export const OVERWATCH_SCHEMA = `// Overwatch (Guardian) Cedar Schema
+export const OVERWATCH_SCHEMA = `// Overwatch Cedar Schema
 // ===================================
-// IDE Security & Policy Enforcement
+// IDE Agent Security & Policy Enforcement
 //
-// Overwatch protects IDE operations (prompts, tool calls, file access) by evaluating
-// threats detected by YARA and Javelin scanners against Cedar policies.
+// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)
+// by evaluating threats detected by the detection engine pipeline against Cedar policies.
 //
 // Architecture:
-//   User/Agent → IDE Hook → YARA/Javelin → Cedar Policy → Allow/Deny
+//   User/Agent → IDE Hook → Detection Engine → Cedar Policy → Allow/Deny
 //
 // Supported IDEs:
 //   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)
 //   - Claude Code (UserPromptSubmit, PreToolUse)
 //   - GitHub Copilot (userPromptSubmitted, preToolUse)
+//
+// Threat Coverage:
+//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)
+//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)
+//   - OWASP MCP Top 10 (MCP01-MCP05)
+//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)
 
 namespace Overwatch {
 
 // =============================================================================
-// ENTITIES - Organization Hierarchy (ReBAC)
+// ENTITIES - Tenant Hierarchy (ReBAC)
 // =============================================================================
+// Aligned with Guardrails entity hierarchy (Account → Project).
+// Overwatch does not have app-specific policies, so App is omitted.
+//
+// Entity hierarchy enables Cedar's \`in\` operator for policy scoping:
+//   Account (org root)
+//     └── Project in [Account]
+//           └── Tool/Server/FilePath/LlmPrompt in [Project]
+//
+// Policy scoping examples:
+//   resource == Overwatch::Tool::"shell"               → specific tool
+//   resource in Overwatch::Project::"<uuid>"            → project-wide
+//   resource in Overwatch::Account::"<uuid>"            → org-wide
 
-// Top-level organization for multi-tenant policy enforcement
-// Enables policies like: principal in Overwatch::Organization::"acme-corp"
-entity Organization {
-  name: String,            // "Acme Corp", "Highflame"
-};
+/// Account represents an organization (top-level tenant)
+entity Account;
 
-// Team within an organization
-// Enables policies like: principal in Overwatch::Team::"security-team"
-entity Team in [Organization] {
-  name: String,            // "security", "engineering", "devops"
-};
+/// Project represents a project within an account
+entity Project in [Account];
 
 // =============================================================================
 // ENTITIES - Principals
 // =============================================================================
 
-// Human user or service account making requests to the IDE
-entity User in [Team] {
-  user_type: String,      // "external" or "internal"
-  email: String,          // User email (optional)
-};
+/// Human user or service account making requests to the IDE
+entity User;
 
-// AI agent (Claude, GitHub Copilot, etc.)
-entity Agent in [Team] {
-  agent_type: String,      // "claude", "copilot", etc.
-};
+/// AI agent (Claude, GitHub Copilot, etc.)
+entity Agent;
 
-// LLM prompt or session
-entity LlmPrompt {
-  prompt_type: String,     // "user_prompt", "session"
-};
+// =============================================================================
+// ENTITIES - Resources (scoped under Project)
+// =============================================================================
 
-// MCP tool or native IDE tool
-entity Tool {
-  tool_name: String,       // "shell", "read_file", "playwright", etc.
-  risk_level: String,      // "low", "medium", "high"
-};
+/// LLM prompt or session — resource for process_prompt action
+entity LlmPrompt in [Project];
 
-// MCP server
-entity Server {
-  server_name: String,     // "filesystem", "playwright", etc.
-};
+/// MCP tool or native IDE tool — resource for call_tool action
+entity Tool in [Project];
 
-// File system path
-entity FilePath {
-  path: String,
-  is_within_workspace: Bool,
-};
+/// MCP server — resource for connect_server action
+entity Server in [Project];
+
+/// File system path — resource for read_file/write_file/call_tool actions
+entity FilePath in [Project];
 
 // =============================================================================
 // ACTIONS
 // =============================================================================
 
 // User submits a prompt or receives AI response
+// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars
 action process_prompt appliesTo {
   principal: [User, Agent],
   resource: [LlmPrompt],
   context: {
-    // Event & Source
-    content: String,                // Raw content being scanned
-    source: String,                 // IDE source: "cursor", "claudecode", "github_copilot"
-    event: String,                  // Hook event name
-    user_email: String,             // User identifier
-
-    // Workspace
-    cwd?: String,                   // Current working directory
-    workspace_root?: String,        // Workspace/repository root
-
-    // Threat Detection
-    threat_count: Long,             // Total threats detected
-    highest_severity: String,       // "critical", "high", "medium", "low"
-    threat_categories: Set<String>, // Threat category names
-    yara_threats: Set<String>,      // YARA rule names
-    max_threat_severity: Long,      // Numeric severity (0-4)
-    contains_secrets: Bool,         // Whether secrets detected
-    prompt_text?: String,           // Same as content (legacy)
-    response_content?: String,      // Response content (if available)
-
-    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)
-    // Required: content safety classifiers always run for prompt processing
-    violence_score: Long,           // Violence content detection score
-    weapons_score: Long,            // Weapons content detection score
-    hate_speech_score: Long,        // Hate speech detection score
-    crime_score: Long,              // Criminal content detection score
-    sexual_score: Long,             // Sexual content detection score
-    profanity_score: Long,          // Profanity detection score
-
-    // Detector Confidence Scores (0-100, ML classifier confidence)
-    // Required: ML classifiers always run for prompt processing
-    pii_confidence: Long,           // PII detection confidence
-    injection_confidence: Long,     // Prompt injection confidence
-    jailbreak_confidence: Long,     // Jailbreak detection confidence
-
-    // Agent Security (0-100)
-    // Required: agent security scanners always run for prompt processing
-    indirect_injection_score: Long,  // Indirect prompt injection risk
+    // --- Event & Source ---
+    content: String,                  // Raw content being scanned
+    source: String,                   // IDE source: "cursor", "claudecode", "github_copilot"
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Workspace ---
+    cwd?: String,                     // Current working directory
+    workspace_root?: String,          // Workspace/repository root
+
+    // --- Threat Detection (from detection engine pipeline) ---
+    threat_count: Long,               // Total threats detected
+    highest_severity: String,         // "critical", "high", "medium", "low", "none"
+    threat_categories: Set<String>,   // Threat category names
+    detected_threats: Set<String>,    // Detection rule names that matched
+    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)
+    contains_secrets: Bool,           // Whether secrets/credentials detected
+
+    // --- Secrets (granular) ---
+    secret_types?: Set<String>,       // Types: "aws_access_key", "github_token", "ssh_private_key", etc.
+    secret_count?: Long,              // Number of distinct secrets found
+
+    // --- PII Detection ---
+    pii_detected?: Bool,              // Whether any PII patterns matched
+    pii_types?: Set<String>,          // Types: "ssn", "credit_card", "email", "phone", etc.
+    pii_count?: Long,                 // Number of PII matches
+
+    // --- Encoding & Unicode Attacks ---
+    contains_invisible_chars?: Bool,  // Zero-width chars, bidi overrides, tag chars detected
+    invisible_chars_score?: Long,     // Unicode attack severity (0-100)
+
+    // --- Content Safety Scores (0-100, from ML classifiers) ---
+    violence_score: Long,
+    weapons_score: Long,
+    hate_speech_score: Long,
+    crime_score: Long,
+    sexual_score: Long,
+    profanity_score: Long,
+
+    // --- ML Detector Confidence Scores (0-100) ---
+    pii_confidence: Long,             // PII detection classifier confidence
+    injection_confidence: Long,       // Prompt injection classifier confidence
+    jailbreak_confidence: Long,       // Jailbreak detection classifier confidence
+
+    // --- Agent Security (0-100) ---
+    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_threat_turns?: Long,
+
+    // --- Legacy ---
+    prompt_text?: String,             // Same as content (backward compatibility)
+    response_content?: String,        // Response content (if available)
   },
 };
 
 // User calls a tool (native IDE tool or MCP tool)
+// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops
 action call_tool appliesTo {
   principal: [User, Agent],
   resource: [Tool, FilePath],
   context: {
-    // Event & Source
-    content: String,                // Raw content being scanned (e.g., shell command)
-    source: String,                 // IDE source
-    event: String,                  // Hook event name
-    user_email: String,             // User identifier
+    // --- Event & Source ---
+    content: String,                  // Raw content being scanned (e.g., shell command, tool args)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
 
-    // Tool & MCP
-    tool_name?: String,             // Normalized tool name ("shell", "read_file", etc.)
-    mcp_server?: String,            // MCP server name
-    mcp_tool?: String,              // MCP tool name
+    // --- Tool & MCP ---
+    tool_name?: String,               // Normalized tool name ("shell", "read_file", etc.)
+    mcp_server?: String,              // MCP server name
+    mcp_tool?: String,                // MCP tool name
 
-    // File & Path
-    path?: String,                  // File path (if file operation)
+    // --- File & Path ---
+    path?: String,                    // File path (if file operation)
 
-    // Workspace
+    // --- Workspace ---
     cwd?: String,
     workspace_root?: String,
 
-    // Threat Detection (optional: scanning may not have run before tool call)
+    // --- Threat Detection ---
     threat_count?: Long,
     highest_severity?: String,
     threat_categories?: Set<String>,
-    yara_threats?: Set<String>,
+    detected_threats?: Set<String>,
     max_threat_severity?: Long,
     contains_secrets?: Bool,
-    response_content?: String,
 
-    // Trust/Safety Scores (0-100, from Javelin/Lakera/LlamaGuard classifiers)
-    // Optional: only present when trust/safety classifiers have run
-    violence_score?: Long,          // Violence content detection score
-    weapons_score?: Long,           // Weapons content detection score
-    hate_speech_score?: Long,       // Hate speech detection score
-    crime_score?: Long,             // Criminal content detection score
-    sexual_score?: Long,            // Sexual content detection score
-    profanity_score?: Long,         // Profanity detection score
-
-    // Detector Confidence Scores (0-100, ML classifier confidence)
-    // Optional: only present when ML classifiers have run
-    pii_confidence?: Long,          // PII detection confidence
-    injection_confidence?: Long,    // Prompt injection confidence
-    jailbreak_confidence?: Long,    // Jailbreak detection confidence
-
-    // Agent Security (0-100)
-    // Optional: only present when agent security scanners have run
-    tool_poisoning_score?: Long,    // Tool description manipulation risk
-    rug_pull_score?: Long,          // Tool behavior mismatch risk
-    indirect_injection_score?: Long, // Indirect prompt injection risk
-
-    // MCP Trust
-    // Optional: only present when MCP server verification has run
-    mcp_server_verified?: Bool,     // Whether server is from verified registry
+    // --- Secrets (granular) ---
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    contains_invisible_chars?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Content Safety Scores (0-100) ---
+    violence_score?: Long,
+    weapons_score?: Long,
+    hate_speech_score?: Long,
+    crime_score?: Long,
+    sexual_score?: Long,
+    profanity_score?: Long,
+
+    // --- ML Detector Confidence Scores (0-100) ---
+    pii_confidence?: Long,
+    injection_confidence?: Long,
+    jailbreak_confidence?: Long,
+
+    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)
+    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args
+    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning
+    rug_pull_score?: Long,            // Tool behavior drift after trust establishment
+    rug_pull_detected?: Bool,         // Boolean flag for rug pull
+    indirect_injection_score?: Long,  // Indirect injection via tool output
+
+    // --- Tool Risk Assessment ---
+    tool_risk_score?: Long,           // Computed tool risk (0-100)
+    tool_category?: String,           // "safe", "sensitive", "dangerous"
+    tool_is_sensitive?: Bool,         // Sensitivity classification
+    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool
+
+    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)
+    loop_detected?: Bool,             // Consecutive same-tool call loop
+    loop_count?: Long,                // Number of consecutive repeat calls
+    loop_tool?: String,               // Tool name in loop
+    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected
+    pattern_type?: String,            // "data_exfiltration", "secret_exfiltration", "credential_theft", "destructive_sequence"
+    sequence_risk?: Long,             // Sequence risk score (0-100)
+
+    // --- MCP Trust ---
+    mcp_server_verified?: Bool,       // Whether server is from verified registry
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_threat_turns?: Long,
+
+    // --- Legacy ---
+    response_content?: String,
   },
 };
 
 // Connect to an MCP server
+// Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {
   principal: [User, Agent],
   resource: [Server],
   context: {
-    content?: String,               // No content to scan when connecting
+    content?: String,                 // Server config content (if available)
     source: String,
     event: String,
     user_email: String,
     mcp_server?: String,
-    threat_count?: Long,            // Threat scanning may not run for connections
+
+    // --- Threat Detection ---
+    threat_count?: Long,
     highest_severity?: String,
     threat_categories?: Set<String>,
     max_threat_severity?: Long,
 
-    // Agent Security (0-100)
-    // Optional: only present when agent security scanners have run
-    tool_poisoning_score?: Long,    // Tool description manipulation risk
-    rug_pull_score?: Long,          // Tool behavior mismatch risk
-    indirect_injection_score?: Long, // Indirect prompt injection risk
-
-    // MCP Trust
-    // Optional: only present when MCP server verification has run
-    mcp_server_verified?: Bool,     // Whether server is from verified registry
+    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)
+    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server
+    tool_poisoning_detected?: Bool,
+    rug_pull_score?: Long,            // Server behavior change after approval
+    rug_pull_detected?: Bool,
+    indirect_injection_score?: Long,  // Injection payloads in server responses
+
+    // --- MCP Trust & Config Risk ---
+    mcp_server_verified?: Bool,       // Verified registry status
+    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)
+    mcp_risk_score?: Long,            // Config risk severity (0-100)
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_threat_turns?: Long,
   },
 };
 
 // Read a file from disk
+// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths
 action read_file appliesTo {
   principal: [User, Agent],
   resource: [FilePath],
@@ -462,15 +685,37 @@ action read_file appliesTo {
     path?: String,
     cwd?: String,
     workspace_root?: String,
-    threat_count?: Long,             // Threat scanning may not have run
+
+    // --- Threat Detection ---
+    threat_count?: Long,
     highest_severity?: String,
     threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
     max_threat_severity?: Long,
     contains_secrets?: Bool,
+
+    // --- Secrets (granular) ---
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_threat_turns?: Long,
   },
 };
 
 // Write a file to disk
+// Threat focus: secrets in output, PII in output, sensitive paths, malicious code
 action write_file appliesTo {
   principal: [User, Agent],
   resource: [FilePath],
@@ -482,11 +727,32 @@ action write_file appliesTo {
     path?: String,
     cwd?: String,
     workspace_root?: String,
-    threat_count?: Long,             // Threat scanning may not have run
+
+    // --- Threat Detection ---
+    threat_count?: Long,
     highest_severity?: String,
     threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
     max_threat_severity?: Long,
     contains_secrets?: Bool,
+
+    // --- Secrets (granular) ---
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_injection_detected?: Bool,
+    session_command_injection?: Bool,
+    session_threat_turns?: Long,
   },
 };
 
@@ -701,7 +967,44 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "content_topics", "type": "array", "required": false, "description": "Semantic topics detected in content (e.g., [\'controlled_substances\', \'weapons_manufacturing\']). Use .contains() to block specific topics per application" },
                 { "key": "topic_confidence", "type": "number", "required": false, "description": "Confidence score from topic classifier (0-100). Use with content_topics to tune sensitivity — higher thresholds reduce false positives" },
                 { "key": "contains_invisible_chars", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters (zero-width joiners, RTL marks, etc.) were detected in the content. Commonly used for prompt injection evasion" },
-                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts" }
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts" },
+                { "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected in the content (reverse shells, privilege escalation, destructive commands)" },
+                { "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection: \'reverse_shell\', \'privilege_escalation\', \'code_execution\', \'destructive_command\', or \'data_exfiltration\'" },
+                { "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches" },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected (e.g., ../../../etc/passwd, URL-encoded variants)" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal: \'critical\' (sensitive system files), \'high\' (deep traversal), \'medium\' (moderate traversal), \'low\', or \'none\'" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected (e.g., \'sensitive_file\', \'deep_traversal\', \'encoded_traversal\')" },
+                { "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected (tautologies, UNION-based, destructive queries)" },
+                { "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection: \'tautology\', \'union_based\', \'destructive\', \'blind\', or \'error_based\'" },
+                { "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks" },
+                { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected (tool calls or references crossing trust boundaries)" },
+                { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation: \'cross_origin_tool\', \'cross_origin_server\', or \'none\'" },
+                { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity" },
+                { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads" },
+                { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected (e.g., [\'base64\', \'hex\', \'unicode\', \'url\']). Use .contains() to check for specific encoding types" },
+                { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in the content" },
+                { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns" },
+                { "key": "detected_language", "type": "string", "required": false, "description": "ISO language code of the detected language (e.g., \'en\', \'fr\', \'zh\'). Use this for language-specific policy enforcement" },
+                { "key": "is_english", "type": "boolean", "required": false, "description": "Whether the content is in English. Useful for applying English-only policies or flagging non-English content" },
+                { "key": "language_confidence", "type": "number", "required": false, "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity" },
+                { "key": "detected_script", "type": "string", "required": false, "description": "Writing script detected in content: \'latin\', \'cyrillic\', \'arabic\', \'cjk\', \'unknown\', etc. Use to detect script-switching attacks" },
+                { "key": "is_latin_script", "type": "boolean", "required": false, "description": "Whether the content uses Latin script. Useful for detecting non-Latin script injection attempts" },
+                { "key": "script_confidence", "type": "number", "required": false, "description": "Confidence score for script detection (0-100)" },
+                { "key": "hallucination_score", "type": "number", "required": false, "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims" },
+                { "key": "factuality_score", "type": "number", "required": false, "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content" },
+                { "key": "sentiment_score", "type": "number", "required": false, "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses" },
+                { "key": "contains_code", "type": "boolean", "required": false, "description": "Whether code snippets were detected in the content" },
+                { "key": "code_languages", "type": "array", "required": false, "description": "Array of programming languages detected in code snippets (e.g., [\'python\', \'javascript\'])" },
+                { "key": "code_ratio", "type": "number", "required": false, "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content" },
+                { "key": "keyword_matched", "type": "boolean", "required": false, "description": "Whether any configured keywords or phrases were matched in the content" },
+                { "key": "keyword_categories", "type": "array", "required": false, "description": "Array of keyword categories matched (e.g., [\'competitor_names\', \'restricted_topics\']). Use .contains() for category-specific policies" },
+                { "key": "keyword_count", "type": "number", "required": false, "description": "Number of keyword matches found in the content" },
+                { "key": "contains_non_ascii", "type": "boolean", "required": false, "description": "Whether non-ASCII characters were detected. May indicate obfuscation or encoding-based evasion attempts" },
+                { "key": "phishing_detected", "type": "boolean", "required": false, "description": "Whether phishing patterns were detected in the content (suspicious URLs, impersonation, credential requests)" },
+                { "key": "content_safety_score", "type": "number", "required": false, "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator" },
+                { "key": "content_safety_blocked", "type": "boolean", "required": false, "description": "Whether content was flagged for blocking by the content safety system" },
+                { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number. Use for policies that escalate strictness over long conversations" },
+                { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected (attack spread across multiple conversation turns)" }
             ]
         },
         {
@@ -731,7 +1034,35 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets were detected in tool arguments or content" },
                 { "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in tool arguments" },
                 { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in tool arguments or content" },
-                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in tool arguments" }
+                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in tool arguments" },
+                { "key": "injection_score", "type": "number", "required": false, "description": "ML-based confidence score for prompt injection in tool arguments (0-100)" },
+                { "key": "command_injection_detected", "type": "boolean", "required": false, "description": "Whether command injection patterns were detected in tool arguments" },
+                { "key": "command_injection_type", "type": "string", "required": false, "description": "Type of command injection detected in tool arguments" },
+                { "key": "command_injection_score", "type": "number", "required": false, "description": "Confidence score for command injection in tool arguments (0-100)" },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in tool arguments" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in tool arguments" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected in tool arguments" },
+                { "key": "sql_injection_detected", "type": "boolean", "required": false, "description": "Whether SQL injection patterns were detected in tool arguments" },
+                { "key": "sql_injection_type", "type": "string", "required": false, "description": "Type of SQL injection detected in tool arguments" },
+                { "key": "sql_injection_score", "type": "number", "required": false, "description": "Confidence score for SQL injection in tool arguments (0-100)" },
+                { "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning was detected (hidden instructions in tool descriptions or arguments designed to manipulate agent behavior)" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks" },
+                { "key": "tool_poisoning_type", "type": "string", "required": false, "description": "Type of tool poisoning: \'hidden_instructions\', \'system_prompt_injection\', or \'authority_hijack\'" },
+                { "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Whether a rug pull was detected (tool behavior changed significantly after establishing trust)" },
+                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)" },
+                { "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected (inline code execution, suspicious URLs, cross-origin issues)" },
+                { "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
+                { "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks" },
+                { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
+                { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
+                { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)" },
+                { "key": "encoded_content_detected", "type": "boolean", "required": false, "description": "Whether encoded content was detected in tool arguments (base64, hex, unicode encoding hiding payloads)" },
+                { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected in tool arguments (e.g., [\'base64\', \'hex\'])" },
+                { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },
+                { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection in tool arguments (0-100)" },
+                { "key": "rug_pull_type", "type": "string", "required": false, "description": "Type of rug pull detected: \'risk_spike\' (sudden risk increase), \'pattern_change\' (behavioral shift), \'combined\', or \'none\'" },
+                { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number for the agentic session" },
+                { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected across tool calls in the session" }
             ]
         },
         {
@@ -743,7 +1074,10 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets were detected in the file content being read" },
                 { "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in file content" },
                 { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in the file content" },
-                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in file content" }
+                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in file content" },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in the file path being read" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in the file read path" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected in the file read path" }
             ]
         },
         {
@@ -755,7 +1089,10 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets were detected in the content being written. Block writes containing credentials" },
                 { "key": "secret_types", "type": "array", "required": false, "description": "Array of secret types found in write content" },
                 { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in the content being written" },
-                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in write content" }
+                { "key": "pii_types", "type": "array", "required": false, "description": "Array of PII types found in write content" },
+                { "key": "path_traversal_detected", "type": "boolean", "required": false, "description": "Whether path traversal patterns were detected in the file path being written" },
+                { "key": "path_traversal_severity", "type": "string", "required": false, "description": "Severity of path traversal in the file write path" },
+                { "key": "path_traversal_type", "type": "string", "required": false, "description": "Type of path traversal detected in the file write path" }
             ]
         },
         {
@@ -765,7 +1102,16 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
                 { "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
                 { "key": "mcp_server", "type": "string", "required": false, "description": "Name of the MCP server being connected to (e.g., \'github\', \'filesystem\', \'slack\'). Use this to allow or block specific MCP servers" },
-                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified/trusted registry. Use this to block connections to unverified servers" }
+                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified/trusted registry. Use this to block connections to unverified servers" },
+                { "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning was detected in the MCP server\'s tool descriptions (hidden instructions designed to manipulate agent behavior)" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Confidence score for tool poisoning in MCP server tools (0-100)" },
+                { "key": "tool_poisoning_type", "type": "string", "required": false, "description": "Type of tool poisoning detected in MCP server: \'hidden_instructions\', \'system_prompt_injection\', or \'authority_hijack\'" },
+                { "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected (inline code execution in server configs, suspicious URLs, cross-origin issues)" },
+                { "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP configuration risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
+                { "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100)" },
+                { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in the MCP server connection" },
+                { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in server connection" },
+                { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in server connection (0-100)" }
             ]
         }
     ]
@@ -775,8 +1121,8 @@ export const GUARDRAILS_CONTEXT = {
  */
 export const OVERWATCH_CONTEXT = {
     "service": "overwatch",
-    "version": "2.0.0",
-    "description": "Overwatch (Guardian) IDE security & policy enforcement",
+    "version": "3.0.0",
+    "description": "Overwatch IDE agent security & policy enforcement",
     "actions": [
         {
             "name": "process_prompt",
@@ -788,14 +1134,20 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier (OAuth verified or fallback)" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace/repository root path" },
-                { "key": "threat_count", "type": "number", "required": true, "description": "Total number of threats detected by YARA/Javelin" },
-                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level: critical, high, medium, low" },
-                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat category names from aggregator" },
-                { "key": "threat_types", "type": "array", "required": true, "description": "YARA threat category names" },
-                { "key": "yara_threats", "type": "array", "required": true, "description": "YARA rule names that matched" },
-                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0-4, where 4=CRITICAL)" },
+                { "key": "threat_count", "type": "number", "required": true, "description": "Total number of threats detected by the detection engine pipeline" },
+                { "key": "highest_severity", "type": "string", "required": true, "description": "Highest severity level: critical, high, medium, low, none" },
+                { "key": "threat_categories", "type": "array", "required": true, "description": "Threat category names from the detection aggregator" },
+                { "key": "detected_threats", "type": "array", "required": true, "description": "Detection rule names that matched (e.g., prompt_injection, jailbreak, credit_card, secret_exposure)" },
+                { "key": "max_threat_severity", "type": "number", "required": true, "description": "Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)" },
                 { "key": "contains_secrets", "type": "boolean", "required": true, "description": "Whether secrets or credentials were detected" },
-                { "key": "prompt_text", "type": "string", "required": false, "description": "Same as content (legacy field)" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Specific secret types found: aws_access_key, github_token, ssh_private_key, api_key, etc." },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Number of distinct secrets detected" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether any PII patterns were matched" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Specific PII types found: ssn, credit_card, email, phone, medical_record, etc." },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Number of PII pattern matches" },
+                { "key": "contains_invisible_chars", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters (zero-width, bidi overrides, tag chars) were detected" },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Invisible character attack severity score (0-100)" },
+                { "key": "prompt_text", "type": "string", "required": false, "description": "Same as content (backward compatibility)" },
                 { "key": "response_content", "type": "string", "required": false, "description": "Response content from AI (if available)" },
                 { "key": "violence_score", "type": "number", "required": true, "description": "Violence content detection score (0-100)" },
                 { "key": "weapons_score", "type": "number", "required": true, "description": "Weapons content detection score (0-100)" },
@@ -803,17 +1155,17 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "crime_score", "type": "number", "required": true, "description": "Criminal content detection score (0-100)" },
                 { "key": "sexual_score", "type": "number", "required": true, "description": "Sexual content detection score (0-100)" },
                 { "key": "profanity_score", "type": "number", "required": true, "description": "Profanity detection score (0-100)" },
-                { "key": "pii_confidence", "type": "number", "required": true, "description": "PII detection classifier confidence (0-100)" },
-                { "key": "injection_confidence", "type": "number", "required": true, "description": "Prompt injection classifier confidence (0-100)" },
-                { "key": "jailbreak_confidence", "type": "number", "required": true, "description": "Jailbreak detection classifier confidence (0-100)" },
-                { "key": "indirect_injection_score", "type": "number", "required": true, "description": "Indirect prompt injection risk score (0-100)" }
+                { "key": "pii_confidence", "type": "number", "required": true, "description": "PII detection ML classifier confidence (0-100)" },
+                { "key": "injection_confidence", "type": "number", "required": true, "description": "Prompt injection ML classifier confidence (0-100)" },
+                { "key": "jailbreak_confidence", "type": "number", "required": true, "description": "Jailbreak detection ML classifier confidence (0-100)" },
+                { "key": "indirect_injection_score", "type": "number", "required": true, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content" }
             ]
         },
         {
             "name": "call_tool",
             "description": "User calls a tool (native IDE tool or MCP tool)",
             "context_attributes": [
-                { "key": "content", "type": "string", "required": true, "description": "Raw content being scanned (e.g., shell command)" },
+                { "key": "content", "type": "string", "required": true, "description": "Raw content being scanned (e.g., shell command, tool arguments)" },
                 { "key": "source", "type": "string", "required": true, "description": "IDE source: cursor, claudecode, github_copilot" },
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name (e.g., beforeShellExecution, PreToolUse)" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
@@ -823,46 +1175,69 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "path", "type": "string", "required": false, "description": "File path (if file operation)" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace/repository root path" },
-                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
-                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity (if scanning ran)" },
-                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names (if scanning ran)" },
-                { "key": "threat_types", "type": "array", "required": false, "description": "YARA threat categories (if scanning ran)" },
-                { "key": "yara_threats", "type": "array", "required": false, "description": "YARA rule names (if scanning ran)" },
-                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
-                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" },
-                { "key": "response_content", "type": "string", "required": false, "description": "Response content (if available)" },
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected by the detection engine pipeline" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: critical, high, medium, low, none" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names from the detection aggregator" },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "Detection rule names that matched" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets or credentials were detected" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Specific secret types found" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Number of distinct secrets detected" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether any PII patterns were matched" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Specific PII types found" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Number of PII pattern matches" },
+                { "key": "contains_invisible_chars", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected" },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "Invisible character attack severity score (0-100)" },
+                { "key": "response_content", "type": "string", "required": false, "description": "Response content from AI (if available)" },
                 { "key": "violence_score", "type": "number", "required": false, "description": "Violence content detection score (0-100)" },
                 { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content detection score (0-100)" },
                 { "key": "hate_speech_score", "type": "number", "required": false, "description": "Hate speech detection score (0-100)" },
                 { "key": "crime_score", "type": "number", "required": false, "description": "Criminal content detection score (0-100)" },
                 { "key": "sexual_score", "type": "number", "required": false, "description": "Sexual content detection score (0-100)" },
                 { "key": "profanity_score", "type": "number", "required": false, "description": "Profanity detection score (0-100)" },
-                { "key": "pii_confidence", "type": "number", "required": false, "description": "PII detection classifier confidence (0-100)" },
-                { "key": "injection_confidence", "type": "number", "required": false, "description": "Prompt injection classifier confidence (0-100)" },
-                { "key": "jailbreak_confidence", "type": "number", "required": false, "description": "Jailbreak detection classifier confidence (0-100)" },
-                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100)" },
-                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavior mismatch risk score (0-100)" },
-                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100)" },
-                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether MCP server is from a verified registry" }
+                { "key": "pii_confidence", "type": "number", "required": false, "description": "PII detection ML classifier confidence (0-100)" },
+                { "key": "injection_confidence", "type": "number", "required": false, "description": "Prompt injection ML classifier confidence (0-100)" },
+                { "key": "jailbreak_confidence", "type": "number", "required": false, "description": "Jailbreak detection ML classifier confidence (0-100)" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100) — hidden instructions in tool descriptions or arguments" },
+                { "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning patterns were explicitly detected" },
+                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavioral drift score (0-100) — deviation from established tool behavior patterns" },
+                { "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Whether a rug pull attack was explicitly detected" },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs" },
+                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed tool risk score (0-100) combining tool type, arguments, and context" },
+                { "key": "tool_category", "type": "string", "required": false, "description": "Tool risk classification: safe, sensitive, dangerous" },
+                { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Whether the tool is classified as sensitive (shell, file write, network)" },
+                { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Whether the tool is a built-in IDE tool (true) or MCP tool (false)" },
+                { "key": "loop_detected", "type": "boolean", "required": false, "description": "Whether a consecutive same-tool call loop was detected" },
+                { "key": "loop_count", "type": "number", "required": false, "description": "Number of consecutive calls to the same tool" },
+                { "key": "loop_tool", "type": "string", "required": false, "description": "The tool name involved in the detected loop" },
+                { "key": "suspicious_pattern", "type": "boolean", "required": false, "description": "Whether a suspicious action sequence was detected (exfiltration, theft, destructive)" },
+                { "key": "pattern_type", "type": "string", "required": false, "description": "Type of suspicious pattern: data_exfiltration, secret_exfiltration, credential_theft, destructive_sequence" },
+                { "key": "sequence_risk", "type": "number", "required": false, "description": "Behavioral sequence risk score (0-100)" },
+                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified registry" }
             ]
         },
         {
             "name": "connect_server",
             "description": "Connect to an MCP server",
             "context_attributes": [
-                { "key": "content", "type": "string", "required": false, "description": "Raw content being scanned (if available)" },
-                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "content", "type": "string", "required": false, "description": "Server configuration content (if available)" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source: cursor, claudecode, github_copilot" },
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "mcp_server", "type": "string", "required": false, "description": "MCP server name" },
-                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
-                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
-                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names (if scanning ran)" },
-                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
-                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100)" },
-                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavior mismatch risk score (0-100)" },
-                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100)" },
-                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether MCP server is from a verified registry" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected by the detection engine pipeline" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: critical, high, medium, low, none" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names from the detection aggregator" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)" },
+                { "key": "contains_invisible_chars", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in server data" },
+                { "key": "tool_poisoning_score", "type": "number", "required": false, "description": "Tool description manipulation risk score (0-100) — poisoned tool descriptions in server" },
+                { "key": "tool_poisoning_detected", "type": "boolean", "required": false, "description": "Whether tool poisoning patterns were explicitly detected" },
+                { "key": "rug_pull_score", "type": "number", "required": false, "description": "Server behavioral drift score (0-100) — behavior change after approval" },
+                { "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Whether a rug pull attack was explicitly detected" },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect injection risk score (0-100) — injection payloads in server responses" },
+                { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified registry" },
+                { "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether risky server configuration was detected (inline code exec, mixed transports)" },
+                { "key": "mcp_risk_score", "type": "number", "required": false, "description": "MCP configuration risk severity score (0-100)" }
             ]
         },
         {
@@ -870,17 +1245,23 @@ export const OVERWATCH_CONTEXT = {
             "description": "Read a file from disk",
             "context_attributes": [
                 { "key": "content", "type": "string", "required": true, "description": "File content or operation details" },
-                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source: cursor, claudecode, github_copilot" },
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name (e.g., beforeReadFile)" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "path", "type": "string", "required": false, "description": "File path being read" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace root path" },
-                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
-                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
-                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat categories (if scanning ran)" },
-                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
-                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected by the detection engine pipeline" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: critical, high, medium, low, none" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names from the detection aggregator" },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "Detection rule names that matched" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets or credentials were detected in file content" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Specific secret types found in file" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Number of distinct secrets detected in file" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether any PII patterns were matched in file content" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Specific PII types found in file" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Number of PII pattern matches in file" }
             ]
         },
         {
@@ -888,17 +1269,24 @@ export const OVERWATCH_CONTEXT = {
             "description": "Write a file to disk",
             "context_attributes": [
                 { "key": "content", "type": "string", "required": true, "description": "File content being written" },
-                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source: cursor, claudecode, github_copilot" },
                 { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
                 { "key": "path", "type": "string", "required": false, "description": "File path being written" },
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "Workspace root path" },
-                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected (if scanning ran)" },
-                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level (if scanning ran)" },
-                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat categories (if scanning ran)" },
-                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity 0-4 (if scanning ran)" },
-                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets detected (if scanning ran)" }
+                { "key": "threat_count", "type": "number", "required": false, "description": "Total threats detected by the detection engine pipeline" },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "Highest severity level: critical, high, medium, low, none" },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "Threat category names from the detection aggregator" },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "Detection rule names that matched" },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)" },
+                { "key": "contains_secrets", "type": "boolean", "required": false, "description": "Whether secrets or credentials were detected in content being written" },
+                { "key": "secret_types", "type": "array", "required": false, "description": "Specific secret types found" },
+                { "key": "secret_count", "type": "number", "required": false, "description": "Number of distinct secrets detected" },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "Whether any PII patterns were matched in content being written" },
+                { "key": "pii_types", "type": "array", "required": false, "description": "Specific PII types found" },
+                { "key": "pii_count", "type": "number", "required": false, "description": "Number of PII pattern matches" },
+                { "key": "contains_invisible_chars", "type": "boolean", "required": false, "description": "Whether invisible Unicode characters were detected in content being written" }
             ]
         }
     ]