@highflame/policy 2.2.24 → 2.2.26

package/_schemas/overwatch/context.json

@@ -203,25 +203,29 @@
           "key": "injection_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control"
+          "description": "Highflame single-turn classifier score for prompt injection (0-100). Raw score from Pulse detector before combination with deep-context. Use for per-detector policy control",
+          "range": "0-100"
         },
         {
           "key": "injection_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn"
+          "description": "DeepContext multi-turn analyzer score for prompt injection (0-100). Tracks injection patterns across conversation history. Generally higher confidence than single-turn",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context"
+          "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns"
+          "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns",
+          "range": "0-100"
         },
         {
           "key": "indirect_injection_score",
@@ -229,6 +233,24 @@
           "required": true,
           "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content"
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff a package install/download command was recognized in the request content."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise."
+        },
         {
           "key": "session_pii_detected",
           "type": "boolean",
@@ -275,31 +297,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -527,25 +554,29 @@
           "key": "injection_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context"
+          "description": "Highflame single-turn classifier score for prompt injection in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
         },
         {
           "key": "injection_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100). Tracks injection patterns across tool call history"
+          "description": "DeepContext multi-turn analyzer score for prompt injection in tool arguments (0-100). Tracks injection patterns across tool call history",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_pulse_score",
           "type": "number",
           "required": false,
-          "description": "Highflame single-turn classifier score for jailbreak in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context"
+          "description": "Highflame single-turn classifier score for jailbreak in tool arguments (0-100). Raw score from Pulse detector before combination with deep-context",
+          "range": "0-100"
         },
         {
           "key": "jailbreak_deep_context_score",
           "type": "number",
           "required": false,
-          "description": "DeepContext multi-turn analyzer score for jailbreak in tool arguments (0-100). Detects jailbreak escalation patterns across tool call turns"
+          "description": "DeepContext multi-turn analyzer score for jailbreak in tool arguments (0-100). Detects jailbreak escalation patterns across tool call turns",
+          "range": "0-100"
         },
         {
           "key": "tool_poisoning_score",
@@ -649,6 +680,68 @@
           "required": false,
           "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff a package install/download command was recognized in the tool call arguments."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory."
+        },
+        {
+          "key": "malicious_package_score",
+          "type": "number",
+          "required": false,
+          "description": "100 when a malicious package was detected, 0 otherwise.",
+          "range": "0-100"
+        },
+        {
+          "key": "malicious_packages",
+          "type": "array",
+          "required": false,
+          "description": "Malicious packages as ecosystem/name[@version] strings."
+        },
+        {
+          "key": "packages_checked",
+          "type": "number",
+          "required": false,
+          "description": "Number of unique packages checked against osv.dev."
+        },
+        {
+          "key": "package_names",
+          "type": "array",
+          "required": false,
+          "description": "Names of all packages parsed from install commands (without ecosystem prefix)."
+        },
+        {
+          "key": "package_ecosystems",
+          "type": "array",
+          "required": false,
+          "description": "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'."
+        },
+        {
+          "key": "package_advisory_count",
+          "type": "number",
+          "required": false,
+          "description": "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages."
+        },
+        {
+          "key": "package_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Graduated supply-chain risk score (0-100). 100 when any malicious package is found.",
+          "range": "0-100"
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise."
+        },
         {
           "key": "session_pii_detected",
           "type": "boolean",
@@ -695,31 +788,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -899,31 +997,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -1103,31 +1206,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",
@@ -1313,31 +1421,36 @@
           "key": "session_max_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions"
+          "description": "Highest prompt injection score seen in any turn of the session (0-100). Use for tiered responses: >75 hard block, >50 restrict permissions",
+          "range": "0-100"
         },
         {
           "key": "session_max_jailbreak_score",
           "type": "number",
           "required": false,
-          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)"
+          "description": "Highest jailbreak detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_command_injection_score",
           "type": "number",
           "required": false,
-          "description": "Highest command injection score seen in any turn of the session (0-100)"
+          "description": "Highest command injection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_pii_score",
           "type": "number",
           "required": false,
-          "description": "Highest PII risk score seen in any turn of the session (0-100)"
+          "description": "Highest PII risk score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_max_secret_score",
           "type": "number",
           "required": false,
-          "description": "Highest secret detection score seen in any turn of the session (0-100)"
+          "description": "Highest secret detection score seen in any turn of the session (0-100)",
+          "range": "0-100"
         },
         {
           "key": "session_cumulative_risk_score",

package/dist/ai_gateway-defaults.gen.js

@@ -427,6 +427,66 @@ when {
     context has mcp_server_verified && context.mcp_server_verified == false
 };
 `;
+const AI_GATEWAY_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// =============================================================================
+// Malicious Package (Default)
+// =============================================================================
+// Blocks tool calls that install or download packages flagged as malicious
+// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
+// yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
+// and checks each referenced package against the OSV batch API.
+//
+// Context keys consumed:
+//   - malicious_package_detected: Bool
+//   - package_install_detected:   Bool
+//   - package_check_status:       String ("" | "degraded")
+//
+// Compliance:
+//   - OWASP LLM03 (Supply Chain), OWASP ASI02
+//
+// Category:  agent-security
+// Namespace: AIGateway
+// =============================================================================
+
+@id("agent-security.block-malicious-package")
+@name("Block malicious package installs")
+@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@severity("critical")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
+forbid (
+    principal,
+    action == AIGateway::Action::"call_tool",
+    resource
+)
+when {
+    context has malicious_package_detected &&
+    context.malicious_package_detected == true
+};
+
+// Alternative (fail-closed): the detector fails OPEN by design — when the
+// OSV lookup is unavailable, installs proceed with package_check_status set
+// to "degraded". Uncomment to block package installs whenever they cannot be
+// verified, trading install availability for supply-chain certainty.
+//
+// @id("agent-security.block-unverified-package")
+// @name("Block unverified package installs")
+// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @severity("medium")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
+// forbid (
+//     principal,
+//     action == AIGateway::Action::"call_tool",
+//     resource
+// )
+// when {
+//     context has package_install_detected &&
+//     context.package_install_detected == true &&
+//     context has package_check_status &&
+//     context.package_check_status == "degraded"
+// };
+`;
 const AI_GATEWAY_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// =============================================================================
 // MCP Server Allowlist
 // =============================================================================
@@ -1366,6 +1426,15 @@ export const AI_GATEWAY_TEMPLATES = [
         severity: 'critical',
         tags: ['category:agent-security', 'threat:tool-poisoning', 'threat:rug-pull', 'threat:indirect-injection', 'threat:supply-chain', 'owasp:asi01', 'owasp:asi04'],
     },
+    {
+        id: 'agent-security.malicious-package',
+        name: 'Malicious Package',
+        description: 'Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.',
+        category: 'agent-security',
+        cedarText: AI_GATEWAY_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR,
+        severity: 'critical',
+        tags: ['category:agent-security', 'threat:supply-chain', 'owasp:llm03', 'owasp:asi02'],
+    },
     {
         id: 'tools.mcp-server-allowlist',
         name: 'MCP Server Allowlist',
@@ -1530,6 +1599,20 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
         "owasp:asi04"
       ]
     },
+    {
+      "id": "agent-security.malicious-package",
+      "name": "Malicious Package",
+      "description": "Block package installs (pip, npm, yarn, pnpm, bun, uv, gem, cargo, go, composer) flagged as malicious.",
+      "category": "agent-security",
+      "file": "defaults/malicious_package.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:agent-security",
+        "threat:supply-chain",
+        "owasp:llm03",
+        "owasp:asi02"
+      ]
+    },
     {
       "id": "tools.mcp-server-allowlist",
       "name": "MCP Server Allowlist",

package/dist/overwatch-context.gen.d.ts

@@ -24,12 +24,22 @@ export declare const OverwatchContextKey: {
     readonly LoopCount: "loop_count";
     readonly LoopDetected: "loop_detected";
     readonly LoopTool: "loop_tool";
+    readonly MaliciousPackageDetected: "malicious_package_detected";
+    readonly MaliciousPackageScore: "malicious_package_score";
+    readonly MaliciousPackages: "malicious_packages";
     readonly MaxThreatSeverity: "max_threat_severity";
     readonly McpConfigRisk: "mcp_config_risk";
     readonly McpRiskScore: "mcp_risk_score";
     readonly McpServer: "mcp_server";
     readonly McpServerVerified: "mcp_server_verified";
     readonly McpTool: "mcp_tool";
+    readonly PackageAdvisoryCount: "package_advisory_count";
+    readonly PackageCheckStatus: "package_check_status";
+    readonly PackageEcosystems: "package_ecosystems";
+    readonly PackageInstallDetected: "package_install_detected";
+    readonly PackageNames: "package_names";
+    readonly PackageRiskScore: "package_risk_score";
+    readonly PackagesChecked: "packages_checked";
     readonly Path: "path";
     readonly PatternType: "pattern_type";
     readonly PiiCount: "pii_count";
@@ -83,4 +93,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];

package/dist/overwatch-context.gen.js

@@ -26,12 +26,22 @@ export const OverwatchContextKey = {
     LoopCount: 'loop_count',
     LoopDetected: 'loop_detected',
     LoopTool: 'loop_tool',
+    MaliciousPackageDetected: 'malicious_package_detected',
+    MaliciousPackageScore: 'malicious_package_score',
+    MaliciousPackages: 'malicious_packages',
     MaxThreatSeverity: 'max_threat_severity',
     McpConfigRisk: 'mcp_config_risk',
     McpRiskScore: 'mcp_risk_score',
     McpServer: 'mcp_server',
     McpServerVerified: 'mcp_server_verified',
     McpTool: 'mcp_tool',
+    PackageAdvisoryCount: 'package_advisory_count',
+    PackageCheckStatus: 'package_check_status',
+    PackageEcosystems: 'package_ecosystems',
+    PackageInstallDetected: 'package_install_detected',
+    PackageNames: 'package_names',
+    PackageRiskScore: 'package_risk_score',
+    PackagesChecked: 'packages_checked',
     Path: 'path',
     PatternType: 'pattern_type',
     PiiCount: 'pii_count',
@@ -104,12 +114,22 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.LoopCount,
     OverwatchContextKey.LoopDetected,
     OverwatchContextKey.LoopTool,
+    OverwatchContextKey.MaliciousPackageDetected,
+    OverwatchContextKey.MaliciousPackageScore,
+    OverwatchContextKey.MaliciousPackages,
     OverwatchContextKey.MaxThreatSeverity,
     OverwatchContextKey.McpConfigRisk,
     OverwatchContextKey.McpRiskScore,
     OverwatchContextKey.McpServer,
     OverwatchContextKey.McpServerVerified,
     OverwatchContextKey.McpTool,
+    OverwatchContextKey.PackageAdvisoryCount,
+    OverwatchContextKey.PackageCheckStatus,
+    OverwatchContextKey.PackageEcosystems,
+    OverwatchContextKey.PackageInstallDetected,
+    OverwatchContextKey.PackageNames,
+    OverwatchContextKey.PackageRiskScore,
+    OverwatchContextKey.PackagesChecked,
     OverwatchContextKey.Path,
     OverwatchContextKey.PatternType,
     OverwatchContextKey.PiiCount,

package/dist/overwatch-defaults.gen.d.ts

@@ -2,7 +2,7 @@
  * Overwatch policy category identifiers.
  * Maps to UI tab names in Studio.
  */
-export type OverwatchCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'tools' | 'agent-identity' | 'organization';
+export type OverwatchCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'tools' | 'agent-identity' | 'agent-security' | 'organization';
 /**
  * Category metadata for UI display.
  */