@highflame/policy 2.2.25 → 2.2.26

package/_schemas/overwatch/context.json

@@ -233,6 +233,24 @@
           "required": true,
           "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content"
         },
+        {
+          "key": "package_install_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff a package install/download command was recognized in the request content."
+        },
+        {
+          "key": "malicious_package_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory."
+        },
+        {
+          "key": "package_check_status",
+          "type": "string",
+          "required": false,
+          "description": "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise."
+        },
         {
           "key": "session_pii_detected",
           "type": "boolean",

package/dist/overwatch-defaults.gen.js

@@ -1654,8 +1654,8 @@ when {
 const OVERWATCH_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// =============================================================================
 // Malicious Package (Default)
 // =============================================================================
-// Blocks tool calls that install or download packages flagged as malicious
-// by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
+// Blocks prompts and tool calls that install or download packages flagged as
+// malicious by the osv.dev database (OpenSSF MAL- advisories). The malicious_package
 // detector (Shield, Tier Slow) parses package-manager invocations (pip, npm,
 // yarn, pnpm, bun, uv, gem, cargo, go, composer) out of tool-call arguments
 // and checks each referenced package against the OSV batch API.
@@ -1678,13 +1678,13 @@ const OVERWATCH_AGENT_SECURITY_MALICIOUS_PACKAGE_CEDAR = `// ===================
 
 @id("agent-security.block-malicious-package")
 @name("Block malicious package installs")
-@description("Blocks call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
+@description("Blocks process_prompt and call_tool when a referenced package carries a known-malicious osv.dev (MAL-) advisory.")
 @severity("critical")
-@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03,owasp:asi02")
+@tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:process-prompt,surface:call-tool,owasp:llm03,owasp:asi02")
 @reject_message("Package install blocked: the requested package is flagged as malicious in the osv.dev database.")
 forbid (
     principal,
-    action == Overwatch::Action::"call_tool",
+    action in [Overwatch::Action::"process_prompt", Overwatch::Action::"call_tool"],
     resource
 )
 when {
@@ -1699,13 +1699,13 @@ when {
 //
 // @id("agent-security.block-unverified-package")
 // @name("Block unverified package installs")
-// @description("Blocks call_tool package installs when the malicious-package lookup is degraded.")
+// @description("Blocks process_prompt and call_tool package installs when the malicious-package lookup is degraded.")
 // @severity("medium")
-// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:call-tool,owasp:llm03")
+// @tags("category:agent-security,threat:supply-chain,detection:aggregate,surface:process-prompt,surface:call-tool,owasp:llm03")
 // @reject_message("Package install blocked: the package could not be verified against the malicious-package database.")
 // forbid (
 //     principal,
-//     action == Overwatch::Action::"call_tool",
+//     action in [Overwatch::Action::"process_prompt", Overwatch::Action::"call_tool"],
 //     resource
 // )
 // when {

package/dist/service-schemas.gen.js

@@ -3968,6 +3968,9 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "jailbreak_pulse_score", "type": "number", "required": false, "description": "Highflame single-turn classifier score for jailbreak attempts (0-100). Raw score from Pulse detector before combination with deep-context" },
                 { "key": "jailbreak_deep_context_score", "type": "number", "required": false, "description": "DeepContext multi-turn analyzer score for jailbreak attempts (0-100). Detects jailbreak escalation patterns across conversation turns" },
                 { "key": "indirect_injection_score", "type": "number", "required": true, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs or retrieved content" },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "True iff a package install/download command was recognized in the request content." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Set to \'degraded\' when the osv.dev lookup failed (fail-open); empty otherwise." },
                 { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "Whether PII was detected in any previous turn of the session" },
                 { "key": "session_pii_types", "type": "array", "required": false, "description": "PII types detected across the session (accumulated)" },
                 { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "Whether secrets were detected in any previous turn of the session" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.25",
+  "version": "2.2.26",
   "engines": {
     "node": ">=18"
   },