@highflame/policy 2.2.33 → 2.2.35

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar

@@ -1,11 +1,15 @@
 // =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -30,36 +34,6 @@
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \"sql_injection\".")

package/_schemas/agent_ops/templates/templates.json

@@ -251,17 +251,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -610,7 +608,7 @@
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/_schemas/ai_gateway/templates/defaults/tools.cedar

@@ -8,7 +8,6 @@
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -16,11 +15,9 @@
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -88,17 +85,6 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.

package/_schemas/ai_gateway/templates/templates.json

@@ -75,13 +75,12 @@
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/_schemas/guardrails/templates/defaults/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/guardrails/templates/profiles/multi_agent/agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/guardrails/templates/templates.json

@@ -6,7 +6,7 @@
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -185,17 +185,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/_schemas/overwatch/context.json

@@ -827,6 +827,228 @@
         }
       ]
     },
+    {
+      "name": "post_tool_call",
+      "description": "Inspect the output of a tool that has already run. The tool has run, so enforcement is limited to rewriting or withholding what the model sees.",
+      "context_attributes": [
+        {
+          "key": "role",
+          "type": "string",
+          "required": false,
+          "description": "role projected for the post_tool_call surface."
+        },
+        {
+          "key": "privilege_scope",
+          "type": "array",
+          "required": false,
+          "description": "privilege_scope projected for the post_tool_call surface."
+        },
+        {
+          "key": "content",
+          "type": "string",
+          "required": true,
+          "description": "The tool's OUTPUT (stdout+stderr, or serialized response)"
+        },
+        {
+          "key": "source",
+          "type": "string",
+          "required": true,
+          "description": "IDE source"
+        },
+        {
+          "key": "event",
+          "type": "string",
+          "required": true,
+          "description": "Hook event name"
+        },
+        {
+          "key": "user_email",
+          "type": "string",
+          "required": true,
+          "description": "User identifier"
+        },
+        {
+          "key": "tool_name",
+          "type": "string",
+          "required": false,
+          "description": "tool_name projected for the post_tool_call surface."
+        },
+        {
+          "key": "mcp_server",
+          "type": "string",
+          "required": false,
+          "description": "mcp_server projected for the post_tool_call surface."
+        },
+        {
+          "key": "mcp_tool",
+          "type": "string",
+          "required": false,
+          "description": "mcp_tool projected for the post_tool_call surface."
+        },
+        {
+          "key": "exit_code",
+          "type": "number",
+          "required": false,
+          "description": "Absent when the IDE does not propagate it"
+        },
+        {
+          "key": "path",
+          "type": "string",
+          "required": false,
+          "description": "path projected for the post_tool_call surface."
+        },
+        {
+          "key": "cwd",
+          "type": "string",
+          "required": false,
+          "description": "cwd projected for the post_tool_call surface."
+        },
+        {
+          "key": "workspace_root",
+          "type": "string",
+          "required": false,
+          "description": "workspace_root projected for the post_tool_call surface."
+        },
+        {
+          "key": "threat_count",
+          "type": "number",
+          "required": false,
+          "description": "threat_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "highest_severity",
+          "type": "string",
+          "required": false,
+          "description": "highest_severity projected for the post_tool_call surface."
+        },
+        {
+          "key": "threat_categories",
+          "type": "array",
+          "required": false,
+          "description": "threat_categories projected for the post_tool_call surface."
+        },
+        {
+          "key": "detected_threats",
+          "type": "array",
+          "required": false,
+          "description": "detected_threats projected for the post_tool_call surface."
+        },
+        {
+          "key": "max_threat_severity",
+          "type": "number",
+          "required": false,
+          "description": "max_threat_severity projected for the post_tool_call surface."
+        },
+        {
+          "key": "secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "secrets_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "secret_types",
+          "type": "array",
+          "required": false,
+          "description": "secret_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "secret_count",
+          "type": "number",
+          "required": false,
+          "description": "secret_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "pii_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_types",
+          "type": "array",
+          "required": false,
+          "description": "pii_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_count",
+          "type": "number",
+          "required": false,
+          "description": "pii_count projected for the post_tool_call surface."
+        },
+        {
+          "key": "pii_score",
+          "type": "number",
+          "required": false,
+          "description": "pii_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "indirect_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "indirect_injection_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "invisible_chars_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "invisible_chars_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "invisible_chars_score",
+          "type": "number",
+          "required": false,
+          "description": "invisible_chars_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_pii_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "session_pii_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_pii_types",
+          "type": "array",
+          "required": false,
+          "description": "session_pii_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_secrets_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "session_secrets_detected projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_secret_types",
+          "type": "array",
+          "required": false,
+          "description": "session_secret_types projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_threat_turns",
+          "type": "number",
+          "required": false,
+          "description": "session_threat_turns projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_max_secret_score",
+          "type": "number",
+          "required": false,
+          "description": "session_max_secret_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_max_pii_score",
+          "type": "number",
+          "required": false,
+          "description": "session_max_pii_score projected for the post_tool_call surface."
+        },
+        {
+          "key": "session_cumulative_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "session_cumulative_risk_score projected for the post_tool_call surface."
+        }
+      ]
+    },
     {
       "name": "connect_server",
       "description": "Connect to an MCP server",

package/_schemas/overwatch/schema.cedarschema

@@ -266,6 +266,78 @@ action call_tool appliesTo {
   },
 };
 
+// Inspect the OUTPUT of a tool that has already run.
+// Threat focus: a credential or PII printed by a tool entering the agent's
+// context. The tool has run, so a permission verdict is meaningless here — the
+// only enforcement available is rewriting or withholding what the model sees,
+// which is why transform rules (@redaction_strategy) are the point of this
+// action. Context is deliberately narrower than call_tool: pre-execution
+// signals (tool risk, loop, sequence) belong to the call, not its result.
+action post_tool_call appliesTo {
+  principal: [User, Agent],
+  resource: [Tool, FilePath, LlmPrompt],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+    // --- Event & Source ---
+    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Tool & MCP ---
+    tool_name?: String,
+    mcp_server?: String,
+    mcp_tool?: String,
+
+    // --- Result ---
+    exit_code?: Long,                 // Absent when the IDE does not propagate it
+
+    // --- File & Path ---
+    path?: String,
+
+    // --- Workspace ---
+    cwd?: String,
+    workspace_root?: String,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Secrets --- the primary signal for this surface
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- Indirect injection via tool output --- (OWASP ASI01)
+    indirect_injection_score?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    invisible_chars_detected?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_threat_turns?: Long,
+    session_max_secret_score?: Long,
+    session_max_pii_score?: Long,
+    session_cumulative_risk_score?: Long,
+  },
+};
+
 // Connect to an MCP server
 // Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {