@highflame/policy 2.2.33 → 2.2.35

package/_schemas/sentry/templates/templates.json

@@ -23,11 +23,6 @@
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -146,15 +141,6 @@
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",

package/dist/aarm-annotation.d.ts

@@ -59,6 +59,23 @@ export interface DeferUntilContextDirective {
     /** Dotted Cedar context-attribute path (e.g. "session_max_sensitivity"). */
     field: string;
 }
+/**
+ * How a transform rule rewrites the spans its detector matched. A forbid
+ * carrying this annotation is allow-class: Shield emits decision=modify with
+ * redacted_content instead of blocking.
+ */
+export interface RedactionStrategyDirective {
+    /**
+     * One of redact | mask | anonymize | replace. Case-sensitive.
+     *
+     * An unrecognized value is rejected at parse time: Shield treats any
+     * non-empty strategy as "redact" and an unknown one falls through to the
+     * generic [REDACTED] label, so a typo would produce the wrong redaction
+     * rather than the intended masking. An EMPTY value instead reverts the rule
+     * to a hard forbid.
+     */
+    strategy: string;
+}
 /**
  * Every typed AARM directive parsed from a single policy's annotation map.
  * Each field is present iff the corresponding annotation was present and
@@ -69,6 +86,7 @@ export interface AARMDirectives {
     deferOnConflict?: DeferOnConflictDirective;
     deferBelowConfidence?: DeferBelowConfidenceDirective;
     deferUntilContext?: DeferUntilContextDirective;
+    redactionStrategy?: RedactionStrategyDirective;
 }
 /** True iff at least one AARM directive was parsed. */
 export declare function hasAnyAARMDirective(d: AARMDirectives | null | undefined): boolean;

package/dist/aarm-annotation.js

@@ -44,7 +44,8 @@ export function hasAnyAARMDirective(d) {
     return (d.stepUpRequired !== undefined ||
         d.deferOnConflict !== undefined ||
         d.deferBelowConfidence !== undefined ||
-        d.deferUntilContext !== undefined);
+        d.deferUntilContext !== undefined ||
+        d.redactionStrategy !== undefined);
 }
 /**
  * Structured error for a malformed AARM annotation. Mirrors Go's
@@ -134,6 +135,14 @@ export function parseAARMAnnotations(raw) {
                     directives.deferUntilContext = r.directive;
                 break;
             }
+            case 'redaction_strategy': {
+                const r = buildRedactionStrategy(def, params, value);
+                if (r.error)
+                    errors.push(r.error);
+                else
+                    directives.redactionStrategy = r.directive;
+                break;
+            }
             default:
                 // Registry entry exists but no typed extractor is wired here — a
                 // programming error in highflame-policy. Fail closed at runtime.
@@ -286,6 +295,32 @@ function buildDeferBelowConfidence(def, params, raw) {
         return { error: bounds };
     return { directive: { threshold: threshold.value } };
 }
+/**
+ * Mirrors the enum in schemas/annotations.json. Kept here because
+ * AARMParameterDef carries no enum field, so the generated registry cannot.
+ */
+const REDACTION_STRATEGIES = ['redact', 'mask', 'anonymize', 'replace'];
+function buildRedactionStrategy(def, params, raw) {
+    const strategy = requireStringParam(def, params, 'strategy', raw);
+    if ('error' in strategy)
+        return { error: strategy.error };
+    // Fail closed, matching this module's documented posture. Known hazard tracked
+    // separately: Shield's syncer drops the ENTIRE policy on an annotation error,
+    // so a typo removes the redaction rule from enforcement. The fix belongs on the
+    // Shield side — keep the policy, drop only the offending directive.
+    if (!REDACTION_STRATEGIES.includes(strategy.value)) {
+        return {
+            error: new AARMAnnotationError({
+                key: def.key,
+                parameter: 'strategy',
+                rawValue: raw,
+                reason: 'strategy must be one of redact, mask, anonymize, replace; ' +
+                    'values are case-sensitive',
+            }),
+        };
+    }
+    return { directive: { strategy: strategy.value } };
+}
 function buildDeferUntilContext(def, params, raw) {
     const field = requireStringParam(def, params, 'field', raw);
     if ('error' in field)

package/dist/aarm-annotations.gen.js

@@ -64,6 +64,27 @@ export const AARM_ANNOTATIONS = [
             },
         ],
     },
+    {
+        key: 'redaction_strategy',
+        description: 'Rewrite the matched content instead of blocking. A determining forbid carrying this annotation makes Shield emit decision=modify with redacted_content, replacing every detected span using the named strategy. Redaction is allow-class and applies regardless of posture — there is no shadow redaction — but most-restrictive-wins still applies, so a co-firing hard forbid in enforce posture beats it and blocks. Shield treats any non-empty strategy as a redaction and falls through to a generic replacement label for a value it does not recognize, so an out-of-enum value produces the wrong redaction rather than the author\'s intent; an empty value reverts the rule to a hard forbid. The enum is enforced by the typed extractor in the Go and TypeScript packages, which reject a policy carrying an unrecognized value.',
+        aarmRequirement: 'R3',
+        promotesCapability: 'CAP-ENF-003',
+        decisionEffect: 'modify',
+        parameters: [
+            {
+                name: 'strategy',
+                type: 'string',
+                required: true,
+                positional: true,
+                description: 'How to rewrite each detected span. redact removes it entirely; replace substitutes a single generic label; mask preserves a recognizable shape (the producing detector may supply its own mask); anonymize substitutes a realistic fake. Case-sensitive — an out-of-enum value is rejected at parse time.',
+                default: null,
+                min: null,
+                max: null,
+                pattern: '',
+                valueSource: '',
+            },
+        ],
+    },
     {
         key: 'step_up_required',
         description: 'Suspend the action pending human approval from an approver with the named role. AARM R4 STEP_UP decision: Shield issues an OpenID CIBA bc-authorize challenge and the action does not execute until an approver carrying the role resolves it (POST /oauth2/bc-authorize/{auth_req_id}/approve via AuthN), OR timeout_seconds elapses (fail-closed: timeout DENYs the action, never permits).',

package/dist/agent_ops-defaults.gen.js

@@ -1263,38 +1263,26 @@ when {
 const AGENT_OPS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2552,7 +2540,6 @@ const AGENT_OPS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// ==================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2648,22 +2635,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3918,11 +3892,15 @@ when {
 const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -3947,36 +3925,6 @@ const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -4690,11 +4638,11 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -4924,7 +4872,7 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -5251,17 +5199,15 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -5610,7 +5556,7 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/dist/ai_gateway-defaults.gen.js

@@ -168,7 +168,6 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -176,11 +175,9 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -248,20 +245,9 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.
 `;
 const AI_GATEWAY_AGENT_SECURITY_DEFAULTS_CEDAR = `// =============================================================================
 // Agent Security (Default)
@@ -1411,11 +1397,11 @@ export const AI_GATEWAY_TEMPLATES = [
     {
         id: 'tools.defaults',
         name: 'Tool Permissioning',
-        description: 'Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.',
+        description: 'Enforce tool risk scoring and block dangerous tools in MCP tool arguments.',
         category: 'tools',
         cedarText: AI_GATEWAY_TOOLS_DEFAULTS_CEDAR,
         severity: 'critical',
-        tags: ['category:tools', 'threat:command-injection', 'owasp:llm06', 'owasp:asi02'],
+        tags: ['category:tools', 'owasp:llm06', 'owasp:asi02'],
     },
     {
         id: 'agent-security.defaults',
@@ -1571,13 +1557,12 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/dist/ai_gateway-detectors.gen.js

@@ -51,8 +51,8 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count" }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set" }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count" }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [],
     },

package/dist/guardrails-defaults.gen.js

@@ -808,38 +808,26 @@ when {
 const GUARDRAILS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2097,7 +2085,6 @@ const GUARDRAILS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// =================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2193,22 +2180,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3464,7 +3438,7 @@ when {
 // CATEGORIES
 // =============================================================================
 export const GUARDRAILS_CATEGORIES = [
-    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection.' },
+    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.' },
     { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.' },
     { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.' },
     { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.' },
@@ -3577,11 +3551,11 @@ export const GUARDRAILS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'security',
         cedarText: GUARDRAILS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -3821,7 +3795,7 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -4000,17 +3974,15 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/dist/guardrails-detectors.gen.js

@@ -23,8 +23,8 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "contains_secrets", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected (e.g. aws_access_key, github_pat, stripe_key)." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "contains_secrets", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected (e.g. aws_access_key, github_pat, stripe_key)." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [{ title: "API key in content", vulnerabilityId: "credential_leakage", snippet: "Use my key sk-proj-AAbb1234567890ZZ for the API call.", expectedSignal: { "contains_secrets": true } }],
     },

package/dist/overwatch-context.gen.d.ts

@@ -10,6 +10,7 @@ export declare const OverwatchContextKey: {
     readonly Cwd: "cwd";
     readonly DetectedThreats: "detected_threats";
     readonly Event: "event";
+    readonly ExitCode: "exit_code";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
     readonly IndirectInjectionScore: "indirect_injection_score";
@@ -93,4 +94,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];

package/dist/overwatch-context.gen.js

@@ -12,6 +12,7 @@ export const OverwatchContextKey = {
     Cwd: 'cwd',
     DetectedThreats: 'detected_threats',
     Event: 'event',
+    ExitCode: 'exit_code',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
     IndirectInjectionScore: 'indirect_injection_score',
@@ -100,6 +101,7 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.Cwd,
     OverwatchContextKey.DetectedThreats,
     OverwatchContextKey.Event,
+    OverwatchContextKey.ExitCode,
     OverwatchContextKey.HateSpeechScore,
     OverwatchContextKey.HighestSeverity,
     OverwatchContextKey.IndirectInjectionScore,