@highflame/policy 2.2.31 → 2.2.32

package/_schemas/ai_gateway/context.json

@@ -161,7 +161,7 @@
           "key": "tool_risk_score",
           "type": "number",
           "required": false,
-          "description": "Computed tool risk (0-100)"
+          "description": "Computed tool risk (0-100). Typical condition: tool_risk_score >= 86 (>= 71 for sensitive tools)"
         },
         {
           "key": "tool_category",
@@ -185,7 +185,7 @@
           "key": "tool_operation_classes",
           "type": "array",
           "required": false,
-          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+          "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
         {
           "key": "mcp_server_verified",

package/_schemas/guardrails/context.json

@@ -724,7 +724,7 @@
           "key": "tool_risk_score",
           "type": "number",
           "required": false,
-          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools",
+          "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical condition: tool_risk_score >= 86 (used by the Tool Risk template; >= 71 for sensitive tools).",
           "range": "0-100"
         },
         {
@@ -1039,7 +1039,7 @@
           "key": "tool_operation_classes",
           "type": "array",
           "required": false,
-          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+          "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
         {
           "key": "cross_origin_detected",

package/_schemas/guardrails/templates/templates.json

@@ -238,7 +238,12 @@
       "category": "tools",
       "file": "mcp_server_allowlist.cedar",
       "severity": "medium",
-      "tags": ["category:tools", "surface:connect-server", "scope:org-wide", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "surface:connect-server",
+        "scope:org-wide",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "security.chat-assistant",

package/_schemas/overwatch/context.json

@@ -612,7 +612,7 @@
           "key": "tool_risk_score",
           "type": "number",
           "required": false,
-          "description": "Computed tool risk score (0-100) combining tool type, arguments, and context"
+          "description": "Computed tool risk score (0-100) combining tool type, arguments, and context. Typical condition: tool_risk_score >= 86 (>= 71 for sensitive tools)"
         },
         {
           "key": "tool_category",
@@ -660,7 +660,7 @@
           "key": "pattern_type",
           "type": "string",
           "required": false,
-          "description": "Type of suspicious pattern: data_exfiltration, secret_exfiltration, credential_theft, destructive_sequence"
+          "description": "Type of suspicious pattern: data_exfiltration, secret_exfiltration, db_exfiltration, credential_theft, destructive_sequence"
         },
         {
           "key": "sequence_risk",
@@ -678,7 +678,7 @@
           "key": "tool_operation_classes",
           "type": "array",
           "required": false,
-          "description": "All operation classes observed in the tool call. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. 'unknown' appears when any unrecognized or variable-expanded command was seen."
+          "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
         {
           "key": "package_install_detected",

package/dist/aarm-annotations.gen.js

@@ -76,7 +76,7 @@ export const AARM_ANNOTATIONS = [
                 type: 'string',
                 required: true,
                 positional: true,
-                description: 'AuthN role string the approver must carry (e.g. "finance_lead", "security_oncall"). Validated against authn.roles at deploy time; unknown roles reject the policy.',
+                description: 'AuthN role string the approver must carry (e.g. \"finance_lead\", \"security_oncall\"). Validated against authn.roles at deploy time; unknown roles reject the policy.',
                 default: null,
                 min: null,
                 max: null,

package/dist/agent_ops-context.gen.d.ts

@@ -76,6 +76,8 @@ export declare const AgentOpsContextKey: {
     readonly LoopCount: "loop_count";
     readonly LoopDetected: "loop_detected";
     readonly LoopTool: "loop_tool";
+    readonly MaliciousPackageDetected: "malicious_package_detected";
+    readonly MaxThreatSeverity: "max_threat_severity";
     readonly McpConfigRisk: "mcp_config_risk";
     readonly McpRiskScore: "mcp_risk_score";
     readonly McpRiskType: "mcp_risk_type";
@@ -87,6 +89,8 @@ export declare const AgentOpsContextKey: {
     readonly ModelProvider: "model_provider";
     readonly MultiTurnDetection: "multi_turn_detection";
     readonly NetworkEgress: "network_egress";
+    readonly PackageCheckStatus: "package_check_status";
+    readonly PackageInstallDetected: "package_install_detected";
     readonly ParamTypeViolation: "param_type_violation";
     readonly ParamTypeViolations: "param_type_violations";
     readonly Path: "path";
@@ -165,4 +169,4 @@ export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentO
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];

package/dist/agent_ops-context.gen.js

@@ -78,6 +78,8 @@ export const AgentOpsContextKey = {
     LoopCount: 'loop_count',
     LoopDetected: 'loop_detected',
     LoopTool: 'loop_tool',
+    MaliciousPackageDetected: 'malicious_package_detected',
+    MaxThreatSeverity: 'max_threat_severity',
     McpConfigRisk: 'mcp_config_risk',
     McpRiskScore: 'mcp_risk_score',
     McpRiskType: 'mcp_risk_type',
@@ -89,6 +91,8 @@ export const AgentOpsContextKey = {
     ModelProvider: 'model_provider',
     MultiTurnDetection: 'multi_turn_detection',
     NetworkEgress: 'network_egress',
+    PackageCheckStatus: 'package_check_status',
+    PackageInstallDetected: 'package_install_detected',
     ParamTypeViolation: 'param_type_violation',
     ParamTypeViolations: 'param_type_violations',
     Path: 'path',
@@ -238,6 +242,8 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.LoopCount,
     AgentOpsContextKey.LoopDetected,
     AgentOpsContextKey.LoopTool,
+    AgentOpsContextKey.MaliciousPackageDetected,
+    AgentOpsContextKey.MaxThreatSeverity,
     AgentOpsContextKey.McpConfigRisk,
     AgentOpsContextKey.McpRiskScore,
     AgentOpsContextKey.McpRiskType,
@@ -249,6 +255,8 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.ModelProvider,
     AgentOpsContextKey.MultiTurnDetection,
     AgentOpsContextKey.NetworkEgress,
+    AgentOpsContextKey.PackageCheckStatus,
+    AgentOpsContextKey.PackageInstallDetected,
     AgentOpsContextKey.ParamTypeViolation,
     AgentOpsContextKey.ParamTypeViolations,
     AgentOpsContextKey.Path,