@highflame/policy 2.1.37 → 2.1.38

package/dist/overwatch-defaults.gen.js

@@ -171,17 +171,21 @@ when {
 
 @id("data-protection.block-env-file-paths")
 @name("Block dotenv file access")
-@description("Blocks read_file and write_file when path matches *.env*.")
+@description("Blocks read_file and write_file when path matches a .env file or .env.<suffix> variant.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:pattern,compliance:nist-si-3")
-@reject_message("File access blocked: .env file targeted — these files typically contain secrets and database credentials.")
+@reject_message("File access blocked: .env file targeted, these files typically contain secrets and database credentials.")
 forbid (
     principal,
     action in [Overwatch::Action::"read_file", Overwatch::Action::"write_file"],
     resource
 )
 when {
-    context has path && context.path like "*.env*"
+    context has path &&
+    (
+        context.path like "*.env" ||
+        context.path like "*.env.*"
+    )
 };
 `;
 const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
@@ -455,58 +459,60 @@ when {
 const OVERWATCH_TOOLS_DEFAULTS_CEDAR = `// =============================================================================
 // Tool Permissioning (Default)
 // =============================================================================
-// Controls IDE tool execution, shell access, sensitive file system paths, and
-// threat-severity-based blocking. Sections 1–2 are opt-in (inactive unless
-// explicitly enabled); sections 3–4 are active baseline.
+// Sensitive system-path file access and destructive MCP file-operation
+// blocking. Shell-execution blocking lives in tools_shell_block.cedar as a
+// separate opt-in template and is not bundled with this default.
 //
 // Context keys consumed:
-//   - tool_name:           String
-//   - path:                String
-//   - max_threat_severity: Long (0-4)
+//   - path:      String
+//   - tool_name: String
 //
 // Compliance:
 //   - NIST 800-53 AC-3, AC-6, CM-7
-//   - OWASP LLM06, OWASP ASI02
-//   - MITRE ATT&CK T1059, T1005
+//   - OWASP ASI02; MITRE ATT&CK T1005
 //
 // Category:  tools
 // Namespace: Overwatch
 // =============================================================================
 
 // ---------------------------------------------------------------------------
-// Section 1: Shell execution (opt-in)
+// Section 1: Sensitive system paths
 // ---------------------------------------------------------------------------
 
-@id("tools.block-shell")
-@name("Block shell and command execution")
-@description("Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,owasp:llm06,mitre:t1059")
-@reject_message("Tool execution blocked: shell/command execution is restricted in this environment.")
+@id("tools.block-system-paths")
+@name("Block system directory access")
+@description("Blocks read_file and write_file when path matches a sensitive Linux or macOS system directory.")
+@severity("high")
+@tags("category:tools,threat:path-traversal,detection:pattern,mitre:t1005")
+@reject_message("File access blocked: sensitive system directory targeted (/etc, /proc, /sys, /root, /var, /System, /Library, /private).")
 forbid (
     principal,
-    action == Overwatch::Action::"call_tool",
+    action in [Overwatch::Action::"read_file", Overwatch::Action::"write_file"],
     resource
 )
 when {
-    context has tool_name &&
+    context has path &&
     (
-        context.tool_name == "shell" ||
-        context.tool_name == "bash" ||
-        context.tool_name == "sh" ||
-        context.tool_name == "terminal" ||
-        context.tool_name == "cmd" ||
-        context.tool_name == "powershell"
+        context.path like "/etc/*" ||
+        context.path like "/proc/*" ||
+        context.path like "/sys/*" ||
+        context.path like "/root/*" ||
+        context.path like "/var/log/*" ||
+        context.path like "/var/run/*" ||
+        context.path like "/private/etc/*" ||
+        context.path like "/private/var/*" ||
+        context.path like "/Library/*" ||
+        context.path like "/System/*"
     )
 };
 
 // ---------------------------------------------------------------------------
-// Section 2: Destructive file operations (opt-in)
+// Section 2: Destructive MCP file operations
 // ---------------------------------------------------------------------------
 
 @id("tools.block-destructive-ops")
 @name("Block destructive file operations")
-@description("Blocks call_tool when tool_name is a destructive file operation.")
+@description("Blocks call_tool when tool_name is a destructive MCP file operation.")
 @severity("high")
 @tags("category:tools,detection:rule,surface:call-tool,owasp:asi02")
 @reject_message("Tool execution blocked: destructive file operations (delete, rmdir, unlink) require explicit human approval.")
@@ -526,56 +532,47 @@ when {
         context.tool_name == "remove_directory"
     )
 };
+`;
+const OVERWATCH_TOOLS_BLOCK_SHELL_CEDAR = `// =============================================================================
+// Tool Permissioning — Shell execution block (Opt-in)
+// =============================================================================
+// Blocks shell and command execution tools. Inactive unless explicitly enabled
+// because it blocks ALL shell access (including safe commands like git and
+// echo). Intended for high-security environments where shell access is
+// prohibited.
+//
+// Context keys consumed:
+//   - tool_name: String
+//
+// Compliance:
+//   - NIST 800-53 CM-7; OWASP LLM06; MITRE ATT&CK T1059
+//
+// Category:  tools
+// Namespace: Overwatch
+// =============================================================================
 
-// ---------------------------------------------------------------------------
-// Section 3: Sensitive system paths (active)
-// ---------------------------------------------------------------------------
-
-@id("tools.block-system-paths")
-@name("Block system directory access")
-@description("Blocks read_file and write_file when path matches a sensitive Linux or macOS system directory.")
-@severity("high")
-@tags("category:tools,threat:path-traversal,detection:pattern,mitre:t1005")
-@reject_message("File access blocked: sensitive system directory targeted (/etc, /proc, /sys, /root, /var, /System, /Library, /private).")
+@id("tools.block-shell")
+@name("Block shell and command execution")
+@description("Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.")
+@severity("critical")
+@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,owasp:llm06,mitre:t1059")
+@reject_message("Tool execution blocked: shell/command execution is restricted in this environment.")
 forbid (
     principal,
-    action in [Overwatch::Action::"read_file", Overwatch::Action::"write_file"],
+    action == Overwatch::Action::"call_tool",
     resource
 )
 when {
-    context has path &&
+    context has tool_name &&
     (
-        context.path like "/etc/*" ||
-        context.path like "/proc/*" ||
-        context.path like "/sys/*" ||
-        context.path like "/root/*" ||
-        context.path like "/var/log/*" ||
-        context.path like "/var/run/*" ||
-        context.path like "/private/etc/*" ||
-        context.path like "/private/var/*" ||
-        context.path like "/Library/*" ||
-        context.path like "/System/*"
+        context.tool_name == "shell" ||
+        context.tool_name == "bash" ||
+        context.tool_name == "sh" ||
+        context.tool_name == "terminal" ||
+        context.tool_name == "cmd" ||
+        context.tool_name == "powershell"
     )
 };
-
-// ---------------------------------------------------------------------------
-// Section 4: Threat-severity catch-all
-// ---------------------------------------------------------------------------
-
-@id("tools.block-high-severity")
-@name("Block high-severity tool calls")
-@description("Blocks call_tool when max_threat_severity >= 3.")
-@severity("high")
-@tags("category:tools,detection:aggregate,surface:call-tool,posture:catch-all")
-@reject_message("Tool execution blocked: high or critical severity threats detected in content.")
-forbid (
-    principal,
-    action == Overwatch::Action::"call_tool",
-    resource
-)
-when {
-    context has max_threat_severity && context.max_threat_severity >= 3
-};
 `;
 const OVERWATCH_PRIVACY_DEFAULTS_CEDAR = `// =============================================================================
 // PII Detection (Default)
@@ -1036,11 +1033,20 @@ export const OVERWATCH_TEMPLATES = [
     {
         id: 'tools.defaults',
         name: 'Tool Permissioning',
-        description: 'Block sensitive system paths and tool calls with high-severity threats; opt-in shell and destructive-op blocking.',
+        description: 'Block sensitive system-path file access and destructive MCP file-operation tools.',
         category: 'tools',
         cedarText: OVERWATCH_TOOLS_DEFAULTS_CEDAR,
+        severity: 'high',
+        tags: ['category:tools', 'threat:path-traversal', 'detection:pattern', 'mitre:t1005', 'owasp:asi02'],
+    },
+    {
+        id: 'tools.block-shell',
+        name: 'Block shell and command execution',
+        description: 'Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.',
+        category: 'tools',
+        cedarText: OVERWATCH_TOOLS_BLOCK_SHELL_CEDAR,
         severity: 'critical',
-        tags: ['category:tools', 'threat:command-injection', 'owasp:llm06'],
+        tags: ['category:tools', 'threat:command-injection', 'detection:rule', 'surface:call-tool', 'owasp:llm06', 'mitre:t1059'],
     },
     {
         id: 'privacy.defaults',
@@ -1190,7 +1196,13 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",
-      "tags": ["category:semantic", "threat:injection", "threat:jailbreak", "owasp:llm01", "owasp:llm02"]
+      "tags": [
+        "category:semantic",
+        "threat:injection",
+        "threat:jailbreak",
+        "owasp:llm01",
+        "owasp:llm02"
+      ]
     },
     {
       "id": "trust-safety.defaults",
@@ -1199,16 +1211,43 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "trust-safety",
       "file": "defaults/content_safety.cedar",
       "severity": "critical",
-      "tags": ["category:trust-safety", "threat:harmful", "compliance:eu-ai-act", "compliance:iso-42001"]
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "compliance:eu-ai-act",
+        "compliance:iso-42001"
+      ]
     },
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Block sensitive system paths and tool calls with high-severity threats; opt-in shell and destructive-op blocking.",
+      "description": "Block sensitive system-path file access and destructive MCP file-operation tools.",
       "category": "tools",
       "file": "defaults/tools.cedar",
+      "severity": "high",
+      "tags": [
+        "category:tools",
+        "threat:path-traversal",
+        "detection:pattern",
+        "mitre:t1005",
+        "owasp:asi02"
+      ]
+    },
+    {
+      "id": "tools.block-shell",
+      "name": "Block shell and command execution",
+      "description": "Blocks call_tool when tool_name is shell, bash, sh, terminal, cmd, or powershell.",
+      "category": "tools",
+      "file": "tools_shell_block.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:command-injection", "owasp:llm06"]
+      "tags": [
+        "category:tools",
+        "threat:command-injection",
+        "detection:rule",
+        "surface:call-tool",
+        "owasp:llm06",
+        "mitre:t1059"
+      ]
     },
     {
       "id": "privacy.defaults",
@@ -1217,7 +1256,13 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "privacy",
       "file": "defaults/pii.cedar",
       "severity": "critical",
-      "tags": ["category:privacy", "threat:pii", "compliance:pci-dss", "compliance:gdpr", "compliance:hipaa"]
+      "tags": [
+        "category:privacy",
+        "threat:pii",
+        "compliance:pci-dss",
+        "compliance:gdpr",
+        "compliance:hipaa"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -1235,7 +1280,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:permit-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:permit-default"
+      ]
     },
     {
       "id": "organization.deny-baseline",
@@ -1244,7 +1293,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "default_deny_all.cedar",
       "severity": "high",
-      "tags": ["category:organization", "posture:deny-default", "scope:org-wide"]
+      "tags": [
+        "category:organization",
+        "posture:deny-default",
+        "scope:org-wide"
+      ]
     },
     {
       "id": "organization.audit-all",
@@ -1253,7 +1306,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "audit_all_actions.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default", "compliance:soc2"]
+      "tags": [
+        "category:organization",
+        "posture:permit-default",
+        "compliance:soc2"
+      ]
     },
     {
       "id": "organization.team-permissions",
@@ -1262,7 +1319,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "team_permissions.cedar",
       "severity": "medium",
-      "tags": ["category:organization", "scope:per-tool", "posture:deny-default"]
+      "tags": [
+        "category:organization",
+        "scope:per-tool",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "agent-identity.agent-guardrails",
@@ -1271,7 +1332,12 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "agent_guardrails.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "threat:injection", "threat:pii"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:injection",
+        "threat:pii"
+      ]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.1.37",
+  "version": "2.1.38",
   "engines": {
     "node": ">=18"
   },