@highflame/policy 2.1.31 → 2.1.33

package/dist/sentry-entities.gen.js

@@ -7,7 +7,7 @@
 export const SENTRY_ENTITIES = {
     principals: ['User'],
     resources: ['ChatSession', 'Document'],
-    actions: ['paste_content', 'receive_response', 'send_message', 'upload_file'],
+    actions: ['paste_content', 'process_prompt', 'receive_response', 'upload_file'],
 };
 /**
  * Per-action entity mapping for Sentry.
@@ -18,11 +18,11 @@ export const SENTRY_ACTION_ENTITIES = {
         principals: ['User'],
         resources: ['ChatSession', 'Document'],
     },
-    'receive_response': {
+    'process_prompt': {
         principals: ['User'],
         resources: ['ChatSession'],
     },
-    'send_message': {
+    'receive_response': {
         principals: ['User'],
         resources: ['ChatSession'],
     },

package/dist/service-schemas.gen.d.ts

@@ -27,7 +27,7 @@ export declare const PALISADE_SCHEMA = "// Palisade Cedar Schema\n// ===========
  *
  * Full Cedar schema for sentry, embedded at codegen time.
  */
-export declare const SENTRY_SCHEMA = "// =============================================================================\n// Sentry Cedar Schema\n// =============================================================================\n// Browser Security \u2014 monitors AI chat interactions in the browser and enforces\n// data-protection, content-safety, and compliance policies at point of use.\n//\n// Sentry is a lightweight browser extension (JSA) that intercepts:\n//   - Messages sent to AI chat services (ChatGPT, Gemini, Claude, Copilot, etc.)\n//   - AI responses returned to the user\n//   - Cut/paste operations transferring content into AI chats\n//   - File/document uploads into AI chat services\n//\n// Architecture:\n//   User \u2192 Browser Extension \u2192 Shield Detection Engine \u2192 Cedar Policy \u2192 Allow/Block\n//\n// Threat Coverage:\n//   - Data Leakage: PII, PHI, credentials, source code, confidential documents\n//   - Content Safety: Violence, hate speech, sexual content, restricted topics\n//   - Prompt Injection: Direct and indirect injection via pasted/uploaded content\n//   - Document Sensitivity: MIP label enforcement, classification-aware blocking\n//   - Compliance: GDPR, HIPAA, PCI DSS, CCPA, EU AI Act\n//\n// Supported AI Services:\n//   - ChatGPT (chat.openai.com)\n//   - Google Gemini (gemini.google.com)\n//   - Claude (claude.ai)\n//   - GitHub Copilot Chat\n//   - Microsoft Copilot\n//   - Custom/enterprise AI chat endpoints\n\nnamespace Sentry {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails/Overwatch entity hierarchy (Account -> Project).\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 ChatSession in [Project]\n//\n// Policy scoping examples:\n//   resource in Sentry::Account::\"<uuid>\"    \u2192 org-wide\n//   resource in Sentry::Project::\"<uuid>\"    \u2192 project-wide\n//   resource == Sentry::ChatSession::\"<id>\"  \u2192 specific session\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user interacting with AI chat in the browser\nentity User;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// AI chat session \u2014 resource for send_message and receive_response actions\nentity ChatSession in [Project];\n\n/// Document or file being uploaded \u2014 resource for upload_file action\nentity Document in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User sends a message (prompt) to an AI chat service\n// Threat focus: data leakage (PII, secrets, confidential data), injection, content safety\naction send_message appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Raw message content being sent\n    source: String,                   // Browser extension identifier: \"sentry\"\n    event: String,                    // Event type: \"send_message\"\n    user_email: String,               // User identifier (SSO/OAuth verified)\n    target_app: String,               // AI service: \"chatgpt\", \"gemini\", \"claude\", \"copilot\", \"custom\"\n    target_url?: String,              // Full URL of the AI chat service\n\n    // --- Aggregated Threat Summary (from Shield NormalizeAggregation) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n\n    // --- Secrets Detection (from SecretsDetector) ---\n    contains_secrets: Bool,           // Whether secrets/credentials detected\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection (from PIIRegexDetector, normalized) ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n    pii_confidence?: Long,            // PII detection confidence (0-100)\n\n    // --- Content Safety Scores (from ToxicityDetector, 0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score: Long,            // Prompt injection score (max of InjectionDetector + DeepContextDetector)\n    jailbreak_score: Long,            // Jailbreak detection score (max of JailbreakDetector + DeepContextDetector)\n\n    // --- Topic Classification (from TopicDetector) ---\n    content_topics?: Set<String>,     // Detected topics: \"controlled_substances\", \"weapons_manufacturing\", etc.\n    topic_confidence?: Long,          // Topic classifier confidence (0-100)\n\n    // --- Encoding & Unicode Attacks (from SecurityFiltersDetector, EncodedInjectionDetector) ---\n    contains_invisible_chars?: Bool,  // Zero-width chars, bidi overrides, tag chars\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n    encoded_content_detected?: Bool,  // Base64, hex, unicode, URL encoded content\n    encoded_types?: Set<String>,      // Encoding types detected\n    encoded_count?: Long,             // Number of encoded segments\n    encoded_score?: Long,             // Encoded injection severity (0-100)\n\n    // --- Code Detection (from CodeDetector) ---\n    contains_code?: Bool,             // Whether content contains source code\n    code_languages?: Set<String>,     // Detected languages: \"python\", \"javascript\", etc.\n    code_ratio?: Long,                // Percentage of content that is code (0-100)\n\n    // --- Language Detection (from LanguageDetector, ScriptDetector) ---\n    detected_language?: String,       // ISO language code\n    is_english?: Bool,\n    language_confidence?: Long,       // 0-100\n    detected_script?: String,         // \"latin\", \"cyrillic\", \"arabic\", \"unknown\"\n    is_latin_script?: Bool,\n    script_confidence?: Long,         // 0-100\n\n    // --- Keyword Detection (from KeywordDetector) ---\n    keyword_matched?: Bool,           // Whether any keywords matched\n    keyword_categories?: Set<String>, // Matched keyword categories\n    keyword_count?: Long,             // Number of keyword matches\n\n    // --- Phishing Detection (from CheckPhishDetector) ---\n    phishing_detected?: Bool,         // Whether phishing URLs detected in content\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// AI service responds to the user\n// Threat focus: harmful content in responses, hallucination, data leakage in output\naction receive_response appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // AI response content\n    source: String,\n    event: String,                    // \"receive_response\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Indirect injection in response content\n    jailbreak_score: Long,\n\n    // --- Hallucination Detection (from HallucinationDetector) ---\n    hallucination_score?: Long,       // Hallucination confidence (0-100)\n    factuality_score?: Long,          // Factuality score (0-100)\n\n    // --- Code in Response ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User pastes content into an AI chat (clipboard, cross-tab, cross-app)\n// Threat focus: data leakage via cut/paste, injection payloads in pasted content\naction paste_content appliesTo {\n  principal: [User],\n  resource: [ChatSession, Document],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Pasted content\n    source: String,\n    event: String,                    // \"paste_content\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Paste Context ---\n    paste_source_app?: String,        // Source application (e.g., \"outlook\", \"excel\", \"vscode\", \"terminal\")\n    paste_source_url?: String,        // Source URL if from another browser tab\n    paste_length?: Long,              // Character length of pasted content\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Keyword Detection ---\n    keyword_matched?: Bool,\n    keyword_categories?: Set<String>,\n    keyword_count?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User uploads a file or document into an AI chat\n// Threat focus: document sensitivity (MIP labels), PII/secrets in files, malware\naction upload_file appliesTo {\n  principal: [User],\n  resource: [Document, ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Extracted file text content (for scanning)\n    source: String,\n    event: String,                    // \"upload_file\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- File Metadata ---\n    file_name?: String,               // Original file name\n    file_type?: String,               // MIME type: \"application/pdf\", \"text/csv\", etc.\n    file_size_bytes?: Long,           // File size in bytes\n    file_extension?: String,          // Extension: \"pdf\", \"docx\", \"xlsx\", \"csv\", \"txt\"\n\n    // --- Document Sensitivity (MIP Labels) ---\n    mip_label_id?: String,            // Microsoft Information Protection label ID\n    mip_label_name?: String,          // Label display name: \"Public\", \"Internal\", \"Confidential\", \"Highly Confidential\"\n    sensitivity_level?: String,       // Normalized: \"public\", \"internal\", \"confidential\", \"restricted\"\n    is_encrypted?: Bool,              // Whether file is encrypted (MIP protection)\n    is_rights_managed?: Bool,         // Whether file has rights management restrictions\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Prompt injection payloads hidden in documents\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n}\n";
+export declare const SENTRY_SCHEMA = "// =============================================================================\n// Sentry Cedar Schema\n// =============================================================================\n// Browser Security \u2014 monitors AI chat interactions in the browser and enforces\n// data-protection, content-safety, and compliance policies at point of use.\n//\n// Sentry is a lightweight browser extension (JSA) that intercepts:\n//   - Messages sent to AI chat services (ChatGPT, Gemini, Claude, Copilot, etc.)\n//   - AI responses returned to the user\n//   - Cut/paste operations transferring content into AI chats\n//   - File/document uploads into AI chat services\n//\n// Architecture:\n//   User \u2192 Browser Extension \u2192 Shield Detection Engine \u2192 Cedar Policy \u2192 Allow/Block\n//\n// Threat Coverage:\n//   - Data Leakage: PII, PHI, credentials, source code, confidential documents\n//   - Content Safety: Violence, hate speech, sexual content, restricted topics\n//   - Prompt Injection: Direct and indirect injection via pasted/uploaded content\n//   - Document Sensitivity: MIP label enforcement, classification-aware blocking\n//   - Compliance: GDPR, HIPAA, PCI DSS, CCPA, EU AI Act\n//\n// Supported AI Services:\n//   - ChatGPT (chat.openai.com)\n//   - Google Gemini (gemini.google.com)\n//   - Claude (claude.ai)\n//   - GitHub Copilot Chat\n//   - Microsoft Copilot\n//   - Custom/enterprise AI chat endpoints\n\nnamespace Sentry {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails/Overwatch entity hierarchy (Account -> Project).\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 ChatSession in [Project]\n//\n// Policy scoping examples:\n//   resource in Sentry::Account::\"<uuid>\"    \u2192 org-wide\n//   resource in Sentry::Project::\"<uuid>\"    \u2192 project-wide\n//   resource == Sentry::ChatSession::\"<id>\"  \u2192 specific session\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user interacting with AI chat in the browser\nentity User;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// AI chat session \u2014 resource for process_prompt and receive_response actions\nentity ChatSession in [Project];\n\n/// Document or file being uploaded \u2014 resource for upload_file action\nentity Document in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User sends a message (prompt) to an AI chat service\n// Threat focus: data leakage (PII, secrets, confidential data), injection, content safety\naction process_prompt appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Raw message content being sent\n    source: String,                   // Browser extension identifier: \"sentry\"\n    event: String,                    // Event type: \"process_prompt\"\n    user_email: String,               // User identifier (SSO/OAuth verified)\n    target_app: String,               // AI service: \"chatgpt\", \"gemini\", \"claude\", \"copilot\", \"custom\"\n    target_url?: String,              // Full URL of the AI chat service\n\n    // --- Aggregated Threat Summary (from Shield NormalizeAggregation) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n\n    // --- Secrets Detection (from SecretsDetector) ---\n    contains_secrets: Bool,           // Whether secrets/credentials detected\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection (from PIIRegexDetector, normalized) ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n    pii_confidence?: Long,            // PII detection confidence (0-100)\n\n    // --- Content Safety Scores (from ToxicityDetector, 0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score: Long,            // Prompt injection score (max of InjectionDetector + DeepContextDetector)\n    jailbreak_score: Long,            // Jailbreak detection score (max of JailbreakDetector + DeepContextDetector)\n\n    // --- Topic Classification (from TopicDetector) ---\n    content_topics?: Set<String>,     // Detected topics: \"controlled_substances\", \"weapons_manufacturing\", etc.\n    topic_confidence?: Long,          // Topic classifier confidence (0-100)\n\n    // --- Encoding & Unicode Attacks (from SecurityFiltersDetector, EncodedInjectionDetector) ---\n    contains_invisible_chars?: Bool,  // Zero-width chars, bidi overrides, tag chars\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n    encoded_content_detected?: Bool,  // Base64, hex, unicode, URL encoded content\n    encoded_types?: Set<String>,      // Encoding types detected\n    encoded_count?: Long,             // Number of encoded segments\n    encoded_score?: Long,             // Encoded injection severity (0-100)\n\n    // --- Code Detection (from CodeDetector) ---\n    contains_code?: Bool,             // Whether content contains source code\n    code_languages?: Set<String>,     // Detected languages: \"python\", \"javascript\", etc.\n    code_ratio?: Long,                // Percentage of content that is code (0-100)\n\n    // --- Language Detection (from LanguageDetector, ScriptDetector) ---\n    detected_language?: String,       // ISO language code\n    is_english?: Bool,\n    language_confidence?: Long,       // 0-100\n    detected_script?: String,         // \"latin\", \"cyrillic\", \"arabic\", \"unknown\"\n    is_latin_script?: Bool,\n    script_confidence?: Long,         // 0-100\n\n    // --- Keyword Detection (from KeywordDetector) ---\n    keyword_matched?: Bool,           // Whether any keywords matched\n    keyword_categories?: Set<String>, // Matched keyword categories\n    keyword_count?: Long,             // Number of keyword matches\n\n    // --- Phishing Detection (from CheckPhishDetector) ---\n    phishing_detected?: Bool,         // Whether phishing URLs detected in content\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// AI service responds to the user\n// Threat focus: harmful content in responses, hallucination, data leakage in output\naction receive_response appliesTo {\n  principal: [User],\n  resource: [ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // AI response content\n    source: String,\n    event: String,                    // \"receive_response\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Indirect injection in response content\n    jailbreak_score: Long,\n\n    // --- Hallucination Detection (from HallucinationDetector) ---\n    hallucination_score?: Long,       // Hallucination confidence (0-100)\n    factuality_score?: Long,          // Factuality score (0-100)\n\n    // --- Code in Response ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User pastes content into an AI chat (clipboard, cross-tab, cross-app)\n// Threat focus: data leakage via cut/paste, injection payloads in pasted content\naction paste_content appliesTo {\n  principal: [User],\n  resource: [ChatSession, Document],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Pasted content\n    source: String,\n    event: String,                    // \"paste_content\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- Paste Context ---\n    paste_source_app?: String,        // Source application (e.g., \"outlook\", \"excel\", \"vscode\", \"terminal\")\n    paste_source_url?: String,        // Source URL if from another browser tab\n    paste_length?: Long,              // Character length of pasted content\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Keyword Detection ---\n    keyword_matched?: Bool,\n    keyword_categories?: Set<String>,\n    keyword_count?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n// User uploads a file or document into an AI chat\n// Threat focus: document sensitivity (MIP labels), PII/secrets in files, malware\naction upload_file appliesTo {\n  principal: [User],\n  resource: [Document, ChatSession],\n  context: {\n    // --- Core Metadata ---\n    content: String,                  // Extracted file text content (for scanning)\n    source: String,\n    event: String,                    // \"upload_file\"\n    user_email: String,\n    target_app: String,\n    target_url?: String,\n\n    // --- File Metadata ---\n    file_name?: String,               // Original file name\n    file_type?: String,               // MIME type: \"application/pdf\", \"text/csv\", etc.\n    file_size_bytes?: Long,           // File size in bytes\n    file_extension?: String,          // Extension: \"pdf\", \"docx\", \"xlsx\", \"csv\", \"txt\"\n\n    // --- Document Sensitivity (MIP Labels) ---\n    mip_label_id?: String,            // Microsoft Information Protection label ID\n    mip_label_name?: String,          // Label display name: \"Public\", \"Internal\", \"Confidential\", \"Highly Confidential\"\n    sensitivity_level?: String,       // Normalized: \"public\", \"internal\", \"confidential\", \"restricted\"\n    is_encrypted?: Bool,              // Whether file is encrypted (MIP protection)\n    is_rights_managed?: Bool,         // Whether file has rights management restrictions\n\n    // --- Aggregated Threat Summary ---\n    threat_count: Long,\n    highest_severity: String,\n    threat_categories: Set<String>,\n    detected_threats: Set<String>,\n    max_threat_severity: Long,\n\n    // --- Secrets Detection ---\n    contains_secrets: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_confidence?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Scores (0-100) ---\n    injection_score: Long,            // Prompt injection payloads hidden in documents\n    jailbreak_score: Long,\n\n    // --- Code Detection ---\n    contains_code?: Bool,\n    code_languages?: Set<String>,\n    code_ratio?: Long,\n\n    // --- Phishing ---\n    phishing_detected?: Bool,\n\n    // --- Encoding Attacks ---\n    contains_invisible_chars?: Bool,\n    invisible_chars_score?: Long,\n    encoded_content_detected?: Bool,\n    encoded_types?: Set<String>,\n    encoded_count?: Long,\n    encoded_score?: Long,\n\n    // --- Session History ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_threat_turns?: Long,\n  },\n};\n\n}\n";
 /**
  * Context attribute metadata for service actions.
  * Used by PolicyBuilder UI to generate form fields.

package/dist/service-schemas.gen.js

@@ -1592,7 +1592,7 @@ entity User;
 // ENTITIES - Resources (scoped under Project)
 // =============================================================================
 
-/// AI chat session — resource for send_message and receive_response actions
+/// AI chat session — resource for process_prompt and receive_response actions
 entity ChatSession in [Project];
 
 /// Document or file being uploaded — resource for upload_file action
@@ -1604,14 +1604,14 @@ entity Document in [Project];
 
 // User sends a message (prompt) to an AI chat service
 // Threat focus: data leakage (PII, secrets, confidential data), injection, content safety
-action send_message appliesTo {
+action process_prompt appliesTo {
   principal: [User],
   resource: [ChatSession],
   context: {
     // --- Core Metadata ---
     content: String,                  // Raw message content being sent
     source: String,                   // Browser extension identifier: "sentry"
-    event: String,                    // Event type: "send_message"
+    event: String,                    // Event type: "process_prompt"
     user_email: String,               // User identifier (SSO/OAuth verified)
     target_app: String,               // AI service: "chatgpt", "gemini", "claude", "copilot", "custom"
     target_url?: String,              // Full URL of the AI chat service
@@ -2719,12 +2719,12 @@ export const SENTRY_CONTEXT = {
     "description": "Sentry browser security — monitors AI chat interactions and enforces data-protection, content-safety, and compliance policies",
     "actions": [
         {
-            "name": "send_message",
+            "name": "process_prompt",
             "description": "User sends a message (prompt) to an AI chat service via the browser",
             "context_attributes": [
                 { "key": "content", "type": "string", "required": true, "description": "Raw message content being sent to the AI service" },
                 { "key": "source", "type": "string", "required": true, "description": "Browser extension identifier (always \'sentry\')" },
-                { "key": "event", "type": "string", "required": true, "description": "Event type (always \'send_message\')" },
+                { "key": "event", "type": "string", "required": true, "description": "Event type (always \'process_prompt\')" },
                 { "key": "user_email", "type": "string", "required": true, "description": "User identifier (SSO/OAuth verified)" },
                 { "key": "target_app", "type": "string", "required": true, "description": "AI service being used: chatgpt, gemini, claude, copilot, custom" },
                 { "key": "target_url", "type": "string", "required": false, "description": "Full URL of the AI chat service" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.1.31",
+  "version": "2.1.33",
   "engines": {
     "node": ">=18"
   },