@highflame/policy 2.2.32 → 2.2.34

package/dist/service-schemas.gen.js

@@ -1805,6 +1805,19 @@ namespace Guardrails {
         "mcp_risk_type"?: String,                // "inline_execution" | "suspicious_url" | "cross_origin"
         "mcp_risk_score"?: Long,                 // 0-100
 
+        // Agentic - MCP Input Requests (optional) — an MCP server asking the CLIENT to act
+        // on its behalf: elicitation/create (prompt a human), sampling/createMessage (drive
+        // the client's model), roots/list (enumerate its filesystem). Carried in-band as
+        // InputRequiredResult.inputRequests under the MRTR pattern (MCP 2026-07-28), and
+        // out-of-band by the gateway relay for earlier peers. INV-DET-002.
+        "mcp_input_request_detected"?: Bool,
+        "mcp_input_request_score"?: Long,        // 0-100
+        "mcp_input_request_types"?: Set<String>, // subset of {"credential_elicitation", "sampling_injection", "root_probe"}
+        // The requested methods, independent of content. Lets a policy refuse a capability
+        // outright ("never permit sampling/createMessage from an unverified server") rather
+        // than only reacting to a payload we managed to classify.
+        "mcp_input_request_methods"?: Set<String>, // subset of {"elicitation/create", "sampling/createMessage", "roots/list"}
+
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
@@ -2339,6 +2352,78 @@ action call_tool appliesTo {
   },
 };
 
+// Inspect the OUTPUT of a tool that has already run.
+// Threat focus: a credential or PII printed by a tool entering the agent's
+// context. The tool has run, so a permission verdict is meaningless here — the
+// only enforcement available is rewriting or withholding what the model sees,
+// which is why transform rules (@redaction_strategy) are the point of this
+// action. Context is deliberately narrower than call_tool: pre-execution
+// signals (tool risk, loop, sequence) belong to the call, not its result.
+action post_tool_call appliesTo {
+  principal: [User, Agent],
+  resource: [Tool, FilePath, LlmPrompt],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+    // --- Event & Source ---
+    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Tool & MCP ---
+    tool_name?: String,
+    mcp_server?: String,
+    mcp_tool?: String,
+
+    // --- Result ---
+    exit_code?: Long,                 // Absent when the IDE does not propagate it
+
+    // --- File & Path ---
+    path?: String,
+
+    // --- Workspace ---
+    cwd?: String,
+    workspace_root?: String,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Secrets --- the primary signal for this surface
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- Indirect injection via tool output --- (OWASP ASI01)
+    indirect_injection_score?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    invisible_chars_detected?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_threat_turns?: Long,
+    session_max_secret_score?: Long,
+    session_max_pii_score?: Long,
+    session_cumulative_risk_score?: Long,
+  },
+};
+
 // Connect to an MCP server
 // Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {
@@ -4023,6 +4108,10 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "mcp_config_risk", "type": "boolean", "required": false, "description": "Whether MCP configuration risk was detected (inline code execution, suspicious URLs, cross-origin issues)" },
                 { "key": "mcp_risk_type", "type": "string", "required": false, "description": "Type of MCP risk: \'inline_execution\', \'suspicious_url\', or \'cross_origin\'" },
                 { "key": "mcp_risk_score", "type": "number", "required": false, "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks" },
+                { "key": "mcp_input_request_detected", "type": "boolean", "required": false, "description": "Whether an MCP server-to-client input request was flagged. These ask the CLIENT to act on the server\'s behalf — elicitation/create prompts a human, sampling/createMessage drives the client\'s own model, roots/list enumerates its filesystem" },
+                { "key": "mcp_input_request_score", "type": "number", "required": false, "description": "Risk score for the MCP input request (0-100). Credential-soliciting elicitation and injection aimed at the client\'s model score highest" },
+                { "key": "mcp_input_request_types", "type": "array", "required": false, "description": "Threat shapes found in the input request (e.g. [\'credential_elicitation\', \'sampling_injection\', \'root_probe\']). Use .contains() to block a specific shape" },
+                { "key": "mcp_input_request_methods", "type": "array", "required": false, "description": "MCP methods the server asked the client to perform (e.g. [\'elicitation/create\', \'sampling/createMessage\', \'roots/list\']). Independent of content, so a policy can refuse a capability outright — e.g. mcp_input_request_methods.contains(\"sampling/createMessage\") on an unverified server — rather than only reacting to a payload that was successfully classified" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
@@ -4368,6 +4457,48 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" }
             ]
         },
+        {
+            "name": "post_tool_call",
+            "description": "Inspect the output of a tool that has already run. The tool has run, so enforcement is limited to rewriting or withholding what the model sees.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "role projected for the post_tool_call surface." },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "privilege_scope projected for the post_tool_call surface." },
+                { "key": "content", "type": "string", "required": true, "description": "The tool\'s OUTPUT (stdout+stderr, or serialized response)" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
+                { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
+                { "key": "tool_name", "type": "string", "required": false, "description": "tool_name projected for the post_tool_call surface." },
+                { "key": "mcp_server", "type": "string", "required": false, "description": "mcp_server projected for the post_tool_call surface." },
+                { "key": "mcp_tool", "type": "string", "required": false, "description": "mcp_tool projected for the post_tool_call surface." },
+                { "key": "exit_code", "type": "number", "required": false, "description": "Absent when the IDE does not propagate it" },
+                { "key": "path", "type": "string", "required": false, "description": "path projected for the post_tool_call surface." },
+                { "key": "cwd", "type": "string", "required": false, "description": "cwd projected for the post_tool_call surface." },
+                { "key": "workspace_root", "type": "string", "required": false, "description": "workspace_root projected for the post_tool_call surface." },
+                { "key": "threat_count", "type": "number", "required": false, "description": "threat_count projected for the post_tool_call surface." },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "highest_severity projected for the post_tool_call surface." },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "threat_categories projected for the post_tool_call surface." },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "detected_threats projected for the post_tool_call surface." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "max_threat_severity projected for the post_tool_call surface." },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "secrets_detected projected for the post_tool_call surface." },
+                { "key": "secret_types", "type": "array", "required": false, "description": "secret_types projected for the post_tool_call surface." },
+                { "key": "secret_count", "type": "number", "required": false, "description": "secret_count projected for the post_tool_call surface." },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "pii_detected projected for the post_tool_call surface." },
+                { "key": "pii_types", "type": "array", "required": false, "description": "pii_types projected for the post_tool_call surface." },
+                { "key": "pii_count", "type": "number", "required": false, "description": "pii_count projected for the post_tool_call surface." },
+                { "key": "pii_score", "type": "number", "required": false, "description": "pii_score projected for the post_tool_call surface." },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "indirect_injection_score projected for the post_tool_call surface." },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "invisible_chars_detected projected for the post_tool_call surface." },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "invisible_chars_score projected for the post_tool_call surface." },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "session_pii_detected projected for the post_tool_call surface." },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "session_pii_types projected for the post_tool_call surface." },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "session_secrets_detected projected for the post_tool_call surface." },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "session_secret_types projected for the post_tool_call surface." },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "session_threat_turns projected for the post_tool_call surface." },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "session_max_secret_score projected for the post_tool_call surface." },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "session_max_pii_score projected for the post_tool_call surface." },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "session_cumulative_risk_score projected for the post_tool_call surface." }
+            ]
+        },
         {
             "name": "connect_server",
             "description": "Connect to an MCP server",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.32",
+  "version": "2.2.34",
   "engines": {
     "node": ">=18"
   },