@highflame/policy 2.2.31 → 2.2.33

package/dist/service-schemas.gen.js

@@ -315,6 +315,14 @@ namespace AgentOps {
         "agent_framework"?: String,
         "agent_publisher"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is \`has\`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for call_tool action (agentic tool execution)
@@ -511,6 +519,14 @@ namespace AgentOps {
         // File & Path (optional)
         "path"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is \`has\`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for read_file action
@@ -843,6 +859,14 @@ namespace AgentOps {
         "agent_framework"?: String,
         "agent_publisher"?: String,
 
+        // Supply-chain / package safety + aggregate threat severity (optional —
+        // ADR 0012 unified port). Projected by Shield's malicious-package and
+        // threat-severity detectors; every read is \`has\`-guarded in policy.
+        "malicious_package_detected"?: Boolean,
+        "package_install_detected"?: Boolean,
+        "package_check_status"?: String,
+        "max_threat_severity"?: Long,
+
     };
 
     /// Context for provision_sandbox action (Forge sandbox-create envelope).
@@ -1781,6 +1805,19 @@ namespace Guardrails {
         "mcp_risk_type"?: String,                // "inline_execution" | "suspicious_url" | "cross_origin"
         "mcp_risk_score"?: Long,                 // 0-100
 
+        // Agentic - MCP Input Requests (optional) — an MCP server asking the CLIENT to act
+        // on its behalf: elicitation/create (prompt a human), sampling/createMessage (drive
+        // the client's model), roots/list (enumerate its filesystem). Carried in-band as
+        // InputRequiredResult.inputRequests under the MRTR pattern (MCP 2026-07-28), and
+        // out-of-band by the gateway relay for earlier peers. INV-DET-002.
+        "mcp_input_request_detected"?: Bool,
+        "mcp_input_request_score"?: Long,        // 0-100
+        "mcp_input_request_types"?: Set<String>, // subset of {"credential_elicitation", "sampling_injection", "root_probe"}
+        // The requested methods, independent of content. Lets a policy refuse a capability
+        // outright ("never permit sampling/createMessage from an unverified server") rather
+        // than only reacting to a payload we managed to classify.
+        "mcp_input_request_methods"?: Set<String>, // subset of {"elicitation/create", "sampling/createMessage", "roots/list"}
+
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
@@ -3187,7 +3224,11 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
                 { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
-                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory." },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical)." }
             ]
         },
         {
@@ -3206,7 +3247,7 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "cwd", "type": "string", "required": false, "description": "Current working directory" },
                 { "key": "workspace_root", "type": "string", "required": false, "description": "IDE workspace root path" },
                 { "key": "tool_name", "type": "string", "required": false, "description": "Name of the tool being called (e.g., \'shell\', \'write_file\', \'http_post\')" },
-                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed risk score for this tool call (0-100)." },
+                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed risk score for this tool call (0-100). Typical condition: tool_risk_score >= 86 (>= 71 for sensitive tools)." },
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Whether the tool is classified as sensitive" },
                 { "key": "tool_category", "type": "string", "required": false, "description": "Tool classification: \'safe\', \'sensitive\', or \'dangerous\'" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Whether the tool is a built-in tool (vs MCP external tool)" },
@@ -3262,7 +3303,7 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "encoded_types", "type": "array", "required": false, "description": "Array of encoding types detected in tool arguments" },
                 { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },
                 { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection in tool arguments (0-100)." },
-                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'" },
+                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
                 { "key": "path", "type": "string", "required": false, "description": "File path targeted by the tool call" },
                 { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
                 { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected across tool calls" },
@@ -3306,7 +3347,11 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
                 { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
-                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory." },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical)." }
             ]
         },
         {
@@ -3511,7 +3556,11 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "flow_sink_effects", "type": "array", "required": false, "description": "Side effects the destination can exercise (ADR 0020), e.g. \'network.send\', \'financial.transfer\', \'filesystem.write\'. Enables \'untrusted content MUST NOT reach a financial.transfer sink\'. Set<String>." },
                 { "key": "principal_clearances", "type": "array", "required": false, "description": "Clearances AuthN/ZeroID mints for the principal (ADR 0020 D8), e.g. \'restricted\', \'pii\'. Coarse scopes gate the capability; clearances gate which protected data that capability may touch. Set<String>." },
                 { "key": "principal_compartments", "type": "array", "required": false, "description": "Compartments the principal is admitted to (ADR 0020 D8), e.g. \'tenant:acme\', \'customer:123\'. A flow into a compartment the principal lacks is deniable independent of confidentiality tier. Set<String>." },
-                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." }
+                { "key": "surface", "type": "string", "required": true, "description": "Origin surface of the request (ADR 0012 D14.2) — REQUIRED; projected by Shield from the ingress product, never user-supplied. Values are the product identifiers: \'guardrails\', \'overwatch\', \'ai_gateway\' (\'sentry\' joins at D17 phase 2). The \'Applies to\' narrowing target: test with an ordinary condition (context.surface == \'ai_gateway\'); no \'has\' guard needed because it is required. A policy with no surface condition applies to every surface, including ones added later." },
+                { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "Whether a referenced package carries a known-malicious osv.dev (MAL-) advisory." },
+                { "key": "package_install_detected", "type": "boolean", "required": false, "description": "Whether the request installs or downloads a package (pip/npm/cargo/etc.)." },
+                { "key": "package_check_status", "type": "string", "required": false, "description": "Malicious-package lookup status: empty (ok) or degraded (OSV unavailable, fail-open)." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "Aggregate max threat severity across detectors (0=none,1=low,2=medium,3=high,4=critical)." }
             ]
         },
         {
@@ -3572,11 +3621,11 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "rug_pull_score", "type": "number", "required": false, "description": "Rug pull risk score (0-100)" },
                 { "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Rug pull detected flag" },
                 { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect injection score (0-100)" },
-                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed tool risk (0-100)" },
+                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed tool risk (0-100). Typical condition: tool_risk_score >= 86 (>= 71 for sensitive tools)" },
                 { "key": "tool_category", "type": "string", "required": false, "description": "Tool category: safe/sensitive/dangerous" },
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Tool sensitivity flag" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Built-in tool flag" },
-                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. \'unknown\' appears when any unrecognized or variable-expanded command was seen." },
+                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether server is from verified registry" },
                 { "key": "violence_score", "type": "number", "required": false, "description": "Violence content score (0-100)" },
                 { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content score (0-100)" },
@@ -3937,7 +3986,7 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "request_id", "type": "string", "required": true, "description": "Unique identifier for this request" },
                 { "key": "timestamp", "type": "number", "required": true, "description": "Unix timestamp in milliseconds" },
                 { "key": "tool_name", "type": "string", "required": false, "description": "Name of the tool being called (e.g., \'shell\', \'write_file\', \'http_post\'). Use this to block specific dangerous tools" },
-                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical threshold: >85 for dangerous tools" },
+                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed risk score for this tool call (0-100). Considers tool sensitivity, argument patterns, and MCP verification status. Typical condition: tool_risk_score >= 86 (used by the Tool Risk template; >= 71 for sensitive tools)." },
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Whether the tool is classified as sensitive (shell, file operations, network access, etc.)" },
                 { "key": "tool_category", "type": "string", "required": false, "description": "Tool classification: \'safe\', \'sensitive\', or \'dangerous\'. Based on tool type and argument patterns" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Whether the tool is a built-in tool (vs MCP external tool). Built-in tools are generally more trusted" },
@@ -3987,7 +4036,11 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected (inline code execution, suspicious URLs, cross-origin issues)" },
                 { "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
                 { "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks" },
-                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. \'unknown\' appears when any unrecognized or variable-expanded command was seen." },
+                { "key": "mcp_input_request_detected", "type": "boolean", "required": false, "description": "Whether an MCP server-to-client input request was flagged. These ask the CLIENT to act on the server\'s behalf — elicitation/create prompts a human, sampling/createMessage drives the client\'s own model, roots/list enumerates its filesystem" },
+                { "key": "mcp_input_request_score", "type": "number", "required": false, "description": "Risk score for the MCP input request (0-100). Credential-soliciting elicitation and injection aimed at the client\'s model score highest" },
+                { "key": "mcp_input_request_types", "type": "array", "required": false, "description": "Threat shapes found in the input request (e.g. [\'credential_elicitation\', \'sampling_injection\', \'root_probe\']). Use .contains() to block a specific shape" },
+                { "key": "mcp_input_request_methods", "type": "array", "required": false, "description": "MCP methods the server asked the client to perform (e.g. [\'elicitation/create\', \'sampling/createMessage\', \'roots/list\']). Independent of content, so a policy can refuse a capability outright — e.g. mcp_input_request_methods.contains(\"sampling/createMessage\") on an unverified server — rather than only reacting to a payload that was successfully classified" },
+                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
                 { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)" },
@@ -4295,7 +4348,7 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "rug_pull_score", "type": "number", "required": false, "description": "Tool behavioral drift score (0-100) — deviation from established tool behavior patterns" },
                 { "key": "rug_pull_detected", "type": "boolean", "required": false, "description": "Whether a rug pull attack was explicitly detected" },
                 { "key": "indirect_injection_score", "type": "number", "required": false, "description": "Indirect prompt injection risk score (0-100) — injection via tool outputs" },
-                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed tool risk score (0-100) combining tool type, arguments, and context" },
+                { "key": "tool_risk_score", "type": "number", "required": false, "description": "Computed tool risk score (0-100) combining tool type, arguments, and context. Typical condition: tool_risk_score >= 86 (>= 71 for sensitive tools)" },
                 { "key": "tool_category", "type": "string", "required": false, "description": "Tool risk classification: safe, sensitive, dangerous" },
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Whether the tool is classified as sensitive (shell, file write, network)" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Whether the tool is a built-in IDE tool (true) or MCP tool (false)" },
@@ -4303,10 +4356,10 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "loop_count", "type": "number", "required": false, "description": "Number of consecutive calls to the same tool" },
                 { "key": "loop_tool", "type": "string", "required": false, "description": "The tool name involved in the detected loop" },
                 { "key": "suspicious_pattern", "type": "boolean", "required": false, "description": "Whether a suspicious action sequence was detected (exfiltration, theft, destructive)" },
-                { "key": "pattern_type", "type": "string", "required": false, "description": "Type of suspicious pattern: data_exfiltration, secret_exfiltration, credential_theft, destructive_sequence" },
+                { "key": "pattern_type", "type": "string", "required": false, "description": "Type of suspicious pattern: data_exfiltration, secret_exfiltration, db_exfiltration, credential_theft, destructive_sequence" },
                 { "key": "sequence_risk", "type": "number", "required": false, "description": "Behavioral sequence risk score (0-100)" },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified registry" },
-                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. \'unknown\' appears when any unrecognized or variable-expanded command was seen." },
+                { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
                 { "key": "package_install_detected", "type": "boolean", "required": false, "description": "True iff a package install/download command was recognized in the tool call arguments." },
                 { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory." },
                 { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.31",
+  "version": "2.2.33",
   "engines": {
     "node": ">=18"
   },