@highflame/policy 2.2.33 → 2.2.34

package/_schemas/overwatch/context.json

@@ -827,6 +827,228 @@
         }
       ]
     },
+    {
+      "name": "post_tool_call",
+      "description": "Inspect the output of a tool that has already run. The tool has run, so enforcement is limited to rewriting or withholding what the model sees.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "role projected for the post_tool_call surface."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "privilege_scope projected for the post_tool_call surface."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": true,
+          "description": "The tool's OUTPUT (stdout+stderr, or serialized response)"
+        },
+        {
+          "key": "source",
+          "type": "string",
+          "required": true,
+          "description": "IDE source"
+        },
+        {
+          "key": "event",
+          "type": "string",
+          "required": true,
+          "description": "Hook event name"
+        },
+        {
+          "key": "user_email",
+          "type": "string",
+          "required": true,
+          "description": "User identifier"
+        },
+        {
+          "key": "tool_name",
+          "type": "string",
+          "required": false,
+          "description": "tool_name projected for the post_tool_call surface."
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "mcp_server projected for the post_tool_call surface."
+        },
+        {
+          "key": "mcp_tool",
+          "type": "string",
+          "required": false,
+          "description": "mcp_tool projected for the post_tool_call surface."
+        },
+        {
+          "key": "exit_code",
+          "type": "number",
+          "required": false,
+          "description": "Absent when the IDE does not propagate it"
+        },
+        {
+          "key": "path",
+          "type": "string",
+          "required": false,
+          "description": "path projected for the post_tool_call surface."
+        },
+        {
+          "key": "cwd",
+          "type": "string",
+          "required": false,
+          "description": "cwd projected for the post_tool_call surface."
+        },
+        {
+          "key": "workspace_root",
+          "type": "string",
+          "required": false,
+          "description": "workspace_root projected for the post_tool_call surface."
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "threat_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "highest_severity projected for the post_tool_call surface."
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "threat_categories projected for the post_tool_call surface."
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "detected_threats projected for the post_tool_call surface."
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "max_threat_severity projected for the post_tool_call surface."
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "secrets_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "secret_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "secret_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "pii_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "pii_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "pii_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "pii_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "indirect_injection_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "invisible_chars_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "invisible_chars_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "session_pii_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "session_pii_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "session_secrets_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "session_secret_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "session_threat_turns projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "session_max_secret_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "session_max_pii_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "session_cumulative_risk_score projected for the post_tool_call surface."
+        }
+      ]
+    },
     {
       "name": "connect_server",
       "description": "Connect to an MCP server",

package/_schemas/overwatch/schema.cedarschema

@@ -266,6 +266,78 @@ action call_tool appliesTo {
   },
 };
 
+// Inspect the OUTPUT of a tool that has already run.
+// Threat focus: a credential or PII printed by a tool entering the agent's
+// context. The tool has run, so a permission verdict is meaningless here — the
+// only enforcement available is rewriting or withholding what the model sees,
+// which is why transform rules (@redaction_strategy) are the point of this
+// action. Context is deliberately narrower than call_tool: pre-execution
+// signals (tool risk, loop, sequence) belong to the call, not its result.
+action post_tool_call appliesTo {
+  principal: [User, Agent],
+  resource: [Tool, FilePath, LlmPrompt],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+    // --- Event & Source ---
+    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Tool & MCP ---
+    tool_name?: String,
+    mcp_server?: String,
+    mcp_tool?: String,
+
+    // --- Result ---
+    exit_code?: Long,                 // Absent when the IDE does not propagate it
+
+    // --- File & Path ---
+    path?: String,
+
+    // --- Workspace ---
+    cwd?: String,
+    workspace_root?: String,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Secrets --- the primary signal for this surface
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- Indirect injection via tool output --- (OWASP ASI01)
+    indirect_injection_score?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    invisible_chars_detected?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_threat_turns?: Long,
+    session_max_secret_score?: Long,
+    session_max_pii_score?: Long,
+    session_cumulative_risk_score?: Long,
+  },
+};
+
 // Connect to an MCP server
 // Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {

package/dist/aarm-annotation.d.ts

@@ -59,6 +59,23 @@ export interface DeferUntilContextDirective {
     /** Dotted Cedar context-attribute path (e.g. "session_max_sensitivity"). */
     field: string;
 }
+/**
+ * How a transform rule rewrites the spans its detector matched. A forbid
+ * carrying this annotation is allow-class: Shield emits decision=modify with
+ * redacted_content instead of blocking.
+ */
+export interface RedactionStrategyDirective {
+    /**
+     * One of redact | mask | anonymize | replace. Case-sensitive.
+     *
+     * An unrecognized value is rejected at parse time: Shield treats any
+     * non-empty strategy as "redact" and an unknown one falls through to the
+     * generic [REDACTED] label, so a typo would produce the wrong redaction
+     * rather than the intended masking. An EMPTY value instead reverts the rule
+     * to a hard forbid.
+     */
+    strategy: string;
+}
 /**
  * Every typed AARM directive parsed from a single policy's annotation map.
  * Each field is present iff the corresponding annotation was present and
@@ -69,6 +86,7 @@ export interface AARMDirectives {
     deferOnConflict?: DeferOnConflictDirective;
     deferBelowConfidence?: DeferBelowConfidenceDirective;
     deferUntilContext?: DeferUntilContextDirective;
+    redactionStrategy?: RedactionStrategyDirective;
 }
 /** True iff at least one AARM directive was parsed. */
 export declare function hasAnyAARMDirective(d: AARMDirectives | null | undefined): boolean;

package/dist/aarm-annotation.js

@@ -44,7 +44,8 @@ export function hasAnyAARMDirective(d) {
     return (d.stepUpRequired !== undefined ||
         d.deferOnConflict !== undefined ||
         d.deferBelowConfidence !== undefined ||
-        d.deferUntilContext !== undefined);
+        d.deferUntilContext !== undefined ||
+        d.redactionStrategy !== undefined);
 }
 /**
  * Structured error for a malformed AARM annotation. Mirrors Go's
@@ -134,6 +135,14 @@ export function parseAARMAnnotations(raw) {
                     directives.deferUntilContext = r.directive;
                 break;
             }
+            case 'redaction_strategy': {
+                const r = buildRedactionStrategy(def, params, value);
+                if (r.error)
+                    errors.push(r.error);
+                else
+                    directives.redactionStrategy = r.directive;
+                break;
+            }
             default:
                 // Registry entry exists but no typed extractor is wired here — a
                 // programming error in highflame-policy. Fail closed at runtime.
@@ -286,6 +295,32 @@ function buildDeferBelowConfidence(def, params, raw) {
         return { error: bounds };
     return { directive: { threshold: threshold.value } };
 }
+/**
+ * Mirrors the enum in schemas/annotations.json. Kept here because
+ * AARMParameterDef carries no enum field, so the generated registry cannot.
+ */
+const REDACTION_STRATEGIES = ['redact', 'mask', 'anonymize', 'replace'];
+function buildRedactionStrategy(def, params, raw) {
+    const strategy = requireStringParam(def, params, 'strategy', raw);
+    if ('error' in strategy)
+        return { error: strategy.error };
+    // Fail closed, matching this module's documented posture. Known hazard tracked
+    // separately: Shield's syncer drops the ENTIRE policy on an annotation error,
+    // so a typo removes the redaction rule from enforcement. The fix belongs on the
+    // Shield side — keep the policy, drop only the offending directive.
+    if (!REDACTION_STRATEGIES.includes(strategy.value)) {
+        return {
+            error: new AARMAnnotationError({
+                key: def.key,
+                parameter: 'strategy',
+                rawValue: raw,
+                reason: 'strategy must be one of redact, mask, anonymize, replace; ' +
+                    'values are case-sensitive',
+            }),
+        };
+    }
+    return { directive: { strategy: strategy.value } };
+}
 function buildDeferUntilContext(def, params, raw) {
     const field = requireStringParam(def, params, 'field', raw);
     if ('error' in field)

package/dist/aarm-annotations.gen.js

@@ -64,6 +64,27 @@ export const AARM_ANNOTATIONS = [
             },
         ],
     },
+    {
+        key: 'redaction_strategy',
+        description: 'Rewrite the matched content instead of blocking. A determining forbid carrying this annotation makes Shield emit decision=modify with redacted_content, replacing every detected span using the named strategy. Redaction is allow-class and applies regardless of posture — there is no shadow redaction — but most-restrictive-wins still applies, so a co-firing hard forbid in enforce posture beats it and blocks. Shield treats any non-empty strategy as a redaction and falls through to a generic replacement label for a value it does not recognize, so an out-of-enum value produces the wrong redaction rather than the author\'s intent; an empty value reverts the rule to a hard forbid. The enum is enforced by the typed extractor in the Go and TypeScript packages, which reject a policy carrying an unrecognized value.',
+        aarmRequirement: 'R3',
+        promotesCapability: 'CAP-ENF-003',
+        decisionEffect: 'modify',
+        parameters: [
+            {
+                name: 'strategy',
+                type: 'string',
+                required: true,
+                positional: true,
+                description: 'How to rewrite each detected span. redact removes it entirely; replace substitutes a single generic label; mask preserves a recognizable shape (the producing detector may supply its own mask); anonymize substitutes a realistic fake. Case-sensitive — an out-of-enum value is rejected at parse time.',
+                default: null,
+                min: null,
+                max: null,
+                pattern: '',
+                valueSource: '',
+            },
+        ],
+    },
     {
         key: 'step_up_required',
         description: 'Suspend the action pending human approval from an approver with the named role. AARM R4 STEP_UP decision: Shield issues an OpenID CIBA bc-authorize challenge and the action does not execute until an approver carrying the role resolves it (POST /oauth2/bc-authorize/{auth_req_id}/approve via AuthN), OR timeout_seconds elapses (fail-closed: timeout DENYs the action, never permits).',

package/dist/ai_gateway-detectors.gen.js

@@ -51,8 +51,8 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count" }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set" }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count" }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [],
     },

package/dist/guardrails-detectors.gen.js

@@ -23,8 +23,8 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "contains_secrets", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected (e.g. aws_access_key, github_pat, stripe_key)." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "contains_secrets", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected (e.g. aws_access_key, github_pat, stripe_key)." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [{ title: "API key in content", vulnerabilityId: "credential_leakage", snippet: "Use my key sk-proj-AAbb1234567890ZZ for the API call.", expectedSignal: { "contains_secrets": true } }],
     },

package/dist/overwatch-context.gen.d.ts

@@ -10,6 +10,7 @@ export declare const OverwatchContextKey: {
     readonly Cwd: "cwd";
     readonly DetectedThreats: "detected_threats";
     readonly Event: "event";
+    readonly ExitCode: "exit_code";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
     readonly IndirectInjectionScore: "indirect_injection_score";
@@ -93,4 +94,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];

package/dist/overwatch-context.gen.js

@@ -12,6 +12,7 @@ export const OverwatchContextKey = {
     Cwd: 'cwd',
     DetectedThreats: 'detected_threats',
     Event: 'event',
+    ExitCode: 'exit_code',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
     IndirectInjectionScore: 'indirect_injection_score',
@@ -100,6 +101,7 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.Cwd,
     OverwatchContextKey.DetectedThreats,
     OverwatchContextKey.Event,
+    OverwatchContextKey.ExitCode,
     OverwatchContextKey.HateSpeechScore,
     OverwatchContextKey.HighestSeverity,
     OverwatchContextKey.IndirectInjectionScore,

package/dist/overwatch-defaults.gen.js

@@ -188,6 +188,54 @@ when {
     )
 };
 `;
+const OVERWATCH_DATA_PROTECTION_REDACT_SECRETS_IN_TOOL_OUTPUT_CEDAR = `// =============================================================================
+// Mask Secrets In Tool Output (Default, inactive)
+// =============================================================================
+// Masks secrets in tool output instead of withholding it.
+//
+// Context keys consumed:
+//   - secrets_detected: Bool
+//
+// Compliance:
+//   - NIST 800-53 SC-28, IA-5
+//   - OWASP LLM06
+//
+// Category:  data-protection
+// Namespace: Overwatch
+// =============================================================================
+//
+// The companion to data-protection.block-secrets-*, for the one surface where
+// blocking is not available: post_tool_call fires after the tool has already
+// run, so a permission verdict is meaningless and the only enforcement left is
+// changing what the model sees.
+//
+// @redaction_strategy makes Shield emit decision=modify with redacted_content,
+// which the agent client substitutes for the real output. Clients differ in how
+// far they can honour that — Claude Code and Cursor (MCP tools only) replace the
+// output in place, while Codex and Gemini CLI can only withhold it wholesale.
+//
+// Not active by default: it changes the outcome for tool output from "nothing"
+// to "masked", and on withhold-only clients from "nothing" to "output
+// suppressed". Turn it on deliberately.
+//
+// Ordering note: Shield resolves most-restrictive-first (block > redact >
+// observe). A hard secrets forbid in enforce posture that also matches this
+// action will beat this rule and block. Scope hard forbids off post_tool_call
+// if you want masking rather than suppression.
+
+@id("data-protection.redact-secrets-in-tool-output")
+@name("Mask secrets in tool output")
+@description("Masks detected credentials in tool output instead of letting them enter the agent context.")
+@severity("high")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:post-tool-call,owasp:llm06")
+@redaction_strategy("mask")
+forbid (
+    principal,
+    action == Overwatch::Action::"post_tool_call",
+    resource
+)
+when { context has secrets_detected && context.secrets_detected == true };
+`;
 const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
@@ -1848,6 +1896,15 @@ export const OVERWATCH_TEMPLATES = [
         severity: 'critical',
         tags: ['category:data-protection', 'threat:secrets', 'owasp:llm06'],
     },
+    {
+        id: 'data-protection.redact-secrets-in-tool-output',
+        name: 'Mask Secrets In Tool Output',
+        description: 'Masks detected credentials in tool output instead of letting them enter the agent context. Off by default; masking-capable clients replace the output, withhold-only clients suppress it.',
+        category: 'data-protection',
+        cedarText: OVERWATCH_DATA_PROTECTION_REDACT_SECRETS_IN_TOOL_OUTPUT_CEDAR,
+        severity: 'high',
+        tags: ['category:data-protection', 'threat:secrets', 'detection:rule', 'owasp:llm06'],
+    },
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
@@ -2051,7 +2108,10 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -2063,7 +2123,10 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -2073,7 +2136,25 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "data-protection.redact-secrets-in-tool-output",
+      "name": "Mask Secrets In Tool Output",
+      "description": "Masks detected credentials in tool output instead of letting them enter the agent context. Off by default; masking-capable clients replace the output, withhold-only clients suppress it.",
+      "category": "data-protection",
+      "file": "defaults/secrets_redaction.cedar",
+      "severity": "high",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "detection:rule",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "semantic.defaults",
@@ -2223,7 +2304,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_server_allowlist.cedar",
       "severity": "medium",
-      "tags": ["category:tools", "scope:org-wide", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "scope:org-wide",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -2284,7 +2369,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "agent_guardrails.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "threat:injection"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:injection"
+      ]
     },
     {
       "id": "agent-security.malicious-package",

package/dist/overwatch-detectors.gen.js

@@ -51,8 +51,8 @@ export const OVERWATCH_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [{ title: "Key surfaced from a file read", vulnerabilityId: "credential_leakage", snippet: "(tool read .env) OPENAI_API_KEY=sk-proj-AAbb1234567890ZZ", expectedSignal: { "secrets_detected": true } }],
     },

package/dist/overwatch-entities.gen.js

@@ -7,7 +7,7 @@
 export const OVERWATCH_ENTITIES = {
     principals: ['Agent', 'User'],
     resources: ['FilePath', 'LlmPrompt', 'Server', 'Tool'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'post_tool_call', 'process_prompt', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for Overwatch.
@@ -22,6 +22,10 @@ export const OVERWATCH_ACTION_ENTITIES = {
         principals: ['Agent', 'User'],
         resources: ['Server'],
     },
+    'post_tool_call': {
+        principals: ['Agent', 'User'],
+        resources: ['FilePath', 'LlmPrompt', 'Tool'],
+    },
     'process_prompt': {
         principals: ['Agent', 'User'],
         resources: ['LlmPrompt'],

package/dist/sentry-detectors.gen.js

@@ -37,8 +37,8 @@ export const SENTRY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [],
     },

package/dist/service-schemas.gen.d.ts

@@ -21,7 +21,7 @@ export declare const GUARDRAILS_SCHEMA = "// ===================================
  *
  * Full Cedar schema for overwatch, embedded at codegen time.
  */
-export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
+export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Inspect the OUTPUT of a tool that has already run.\n// Threat focus: a credential or PII printed by a tool entering the agent's\n// context. The tool has run, so a permission verdict is meaningless here \u2014 the\n// only enforcement available is rewriting or withholding what the model sees,\n// which is why transform rules (@redaction_strategy) are the point of this\n// action. Context is deliberately narrower than call_tool: pre-execution\n// signals (tool risk, loop, sequence) belong to the call, not its result.\naction post_tool_call appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath, LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,\n    mcp_server?: String,\n    mcp_tool?: String,\n\n    // --- Result ---\n    exit_code?: Long,                 // Absent when the IDE does not propagate it\n\n    // --- File & Path ---\n    path?: String,\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Secrets --- the primary signal for this surface\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Indirect injection via tool output --- (OWASP ASI01)\n    indirect_injection_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_threat_turns?: Long,\n    session_max_secret_score?: Long,\n    session_max_pii_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
 /**
  * Palisade Cedar schema
  *

package/dist/service-schemas.gen.js

@@ -2352,6 +2352,78 @@ action call_tool appliesTo {
   },
 };
 
+// Inspect the OUTPUT of a tool that has already run.
+// Threat focus: a credential or PII printed by a tool entering the agent's
+// context. The tool has run, so a permission verdict is meaningless here — the
+// only enforcement available is rewriting or withholding what the model sees,
+// which is why transform rules (@redaction_strategy) are the point of this
+// action. Context is deliberately narrower than call_tool: pre-execution
+// signals (tool risk, loop, sequence) belong to the call, not its result.
+action post_tool_call appliesTo {
+  principal: [User, Agent],
+  resource: [Tool, FilePath, LlmPrompt],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+    // --- Event & Source ---
+    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Tool & MCP ---
+    tool_name?: String,
+    mcp_server?: String,
+    mcp_tool?: String,
+
+    // --- Result ---
+    exit_code?: Long,                 // Absent when the IDE does not propagate it
+
+    // --- File & Path ---
+    path?: String,
+
+    // --- Workspace ---
+    cwd?: String,
+    workspace_root?: String,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Secrets --- the primary signal for this surface
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- Indirect injection via tool output --- (OWASP ASI01)
+    indirect_injection_score?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    invisible_chars_detected?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_threat_turns?: Long,
+    session_max_secret_score?: Long,
+    session_max_pii_score?: Long,
+    session_cumulative_risk_score?: Long,
+  },
+};
+
 // Connect to an MCP server
 // Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {
@@ -4385,6 +4457,48 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" }
             ]
         },
+        {
+            "name": "post_tool_call",
+            "description": "Inspect the output of a tool that has already run. The tool has run, so enforcement is limited to rewriting or withholding what the model sees.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "role projected for the post_tool_call surface." },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "privilege_scope projected for the post_tool_call surface." },
+                { "key": "content", "type": "string", "required": true, "description": "The tool\'s OUTPUT (stdout+stderr, or serialized response)" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
+                { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
+                { "key": "tool_name", "type": "string", "required": false, "description": "tool_name projected for the post_tool_call surface." },
+                { "key": "mcp_server", "type": "string", "required": false, "description": "mcp_server projected for the post_tool_call surface." },
+                { "key": "mcp_tool", "type": "string", "required": false, "description": "mcp_tool projected for the post_tool_call surface." },
+                { "key": "exit_code", "type": "number", "required": false, "description": "Absent when the IDE does not propagate it" },
+                { "key": "path", "type": "string", "required": false, "description": "path projected for the post_tool_call surface." },
+                { "key": "cwd", "type": "string", "required": false, "description": "cwd projected for the post_tool_call surface." },
+                { "key": "workspace_root", "type": "string", "required": false, "description": "workspace_root projected for the post_tool_call surface." },
+                { "key": "threat_count", "type": "number", "required": false, "description": "threat_count projected for the post_tool_call surface." },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "highest_severity projected for the post_tool_call surface." },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "threat_categories projected for the post_tool_call surface." },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "detected_threats projected for the post_tool_call surface." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "max_threat_severity projected for the post_tool_call surface." },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "secrets_detected projected for the post_tool_call surface." },
+                { "key": "secret_types", "type": "array", "required": false, "description": "secret_types projected for the post_tool_call surface." },
+                { "key": "secret_count", "type": "number", "required": false, "description": "secret_count projected for the post_tool_call surface." },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "pii_detected projected for the post_tool_call surface." },
+                { "key": "pii_types", "type": "array", "required": false, "description": "pii_types projected for the post_tool_call surface." },
+                { "key": "pii_count", "type": "number", "required": false, "description": "pii_count projected for the post_tool_call surface." },
+                { "key": "pii_score", "type": "number", "required": false, "description": "pii_score projected for the post_tool_call surface." },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "indirect_injection_score projected for the post_tool_call surface." },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "invisible_chars_detected projected for the post_tool_call surface." },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "invisible_chars_score projected for the post_tool_call surface." },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "session_pii_detected projected for the post_tool_call surface." },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "session_pii_types projected for the post_tool_call surface." },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "session_secrets_detected projected for the post_tool_call surface." },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "session_secret_types projected for the post_tool_call surface." },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "session_threat_turns projected for the post_tool_call surface." },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "session_max_secret_score projected for the post_tool_call surface." },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "session_max_pii_score projected for the post_tool_call surface." },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "session_cumulative_risk_score projected for the post_tool_call surface." }
+            ]
+        },
         {
             "name": "connect_server",
             "description": "Connect to an MCP server",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.33",
+  "version": "2.2.34",
   "engines": {
     "node": ">=18"
   },