@highflame/policy 2.2.33 → 2.2.35

package/dist/overwatch-defaults.gen.js

@@ -188,14 +188,66 @@ when {
     )
 };
 `;
+const OVERWATCH_DATA_PROTECTION_REDACT_SECRETS_IN_TOOL_OUTPUT_CEDAR = `// =============================================================================
+// Mask Secrets In Tool Output (Default, inactive)
+// =============================================================================
+// Masks secrets in tool output instead of withholding it.
+//
+// Context keys consumed:
+//   - secrets_detected: Bool
+//
+// Compliance:
+//   - NIST 800-53 SC-28, IA-5
+//   - OWASP LLM06
+//
+// Category:  data-protection
+// Namespace: Overwatch
+// =============================================================================
+//
+// The companion to data-protection.block-secrets-*, for the one surface where
+// blocking is not available: post_tool_call fires after the tool has already
+// run, so a permission verdict is meaningless and the only enforcement left is
+// changing what the model sees.
+//
+// @redaction_strategy makes Shield emit decision=modify with redacted_content,
+// which the agent client substitutes for the real output. Clients differ in how
+// far they can honour that — Claude Code and Cursor (MCP tools only) replace the
+// output in place, while Codex and Gemini CLI can only withhold it wholesale.
+//
+// Not active by default: it changes the outcome for tool output from "nothing"
+// to "masked", and on withhold-only clients from "nothing" to "output
+// suppressed". Turn it on deliberately.
+//
+// Ordering note: Shield resolves most-restrictive-first (block > redact >
+// observe). A hard secrets forbid in enforce posture that also matches this
+// action will beat this rule and block. Scope hard forbids off post_tool_call
+// if you want masking rather than suppression.
+
+@id("data-protection.redact-secrets-in-tool-output")
+@name("Mask secrets in tool output")
+@description("Masks detected credentials in tool output instead of letting them enter the agent context.")
+@severity("high")
+@tags("category:data-protection,threat:secrets,detection:rule,surface:post-tool-call,owasp:llm06")
+@redaction_strategy("mask")
+forbid (
+    principal,
+    action == Overwatch::Action::"post_tool_call",
+    resource
+)
+when { context has secrets_detected && context.secrets_detected == true };
+`;
 const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -220,36 +272,6 @@ const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == Overwatch::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == Overwatch::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -1803,7 +1825,7 @@ when {
 export const OVERWATCH_CATEGORIES = [
     { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block credential leakage and protect sensitive file paths.' },
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across prompts, tool calls, and file operations.' },
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, hateful, sexual, criminal, or excessively profane content.' },
     { id: 'tools', name: 'Tool Permissioning', description: 'Control shell execution, file operations, MCP servers, and sensitive system paths.' },
     { id: 'agent-identity', name: 'Agent-Specific Guardrails', description: 'Per-agent security policies applied based on agent identity.' },
@@ -1848,10 +1870,19 @@ export const OVERWATCH_TEMPLATES = [
         severity: 'critical',
         tags: ['category:data-protection', 'threat:secrets', 'owasp:llm06'],
     },
+    {
+        id: 'data-protection.redact-secrets-in-tool-output',
+        name: 'Mask Secrets In Tool Output',
+        description: 'Masks detected credentials in tool output instead of letting them enter the agent context. Off by default; masking-capable clients replace the output, withhold-only clients suppress it.',
+        category: 'data-protection',
+        cedarText: OVERWATCH_DATA_PROTECTION_REDACT_SECRETS_IN_TOOL_OUTPUT_CEDAR,
+        severity: 'high',
+        tags: ['category:data-protection', 'threat:secrets', 'detection:rule', 'owasp:llm06'],
+    },
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'semantic',
         cedarText: OVERWATCH_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -2015,7 +2046,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
+      "description": "Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
     },
     {
       "id": "trust-safety",
@@ -2051,7 +2082,10 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -2063,7 +2097,10 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -2073,12 +2110,30 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
+    },
+    {
+      "id": "data-protection.redact-secrets-in-tool-output",
+      "name": "Mask Secrets In Tool Output",
+      "description": "Masks detected credentials in tool output instead of letting them enter the agent context. Off by default; masking-capable clients replace the output, withhold-only clients suppress it.",
+      "category": "data-protection",
+      "file": "defaults/secrets_redaction.cedar",
+      "severity": "high",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "detection:rule",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",
@@ -2223,7 +2278,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_server_allowlist.cedar",
       "severity": "medium",
-      "tags": ["category:tools", "scope:org-wide", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "scope:org-wide",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -2284,7 +2343,11 @@ export const OVERWATCH_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "agent_guardrails.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "threat:injection"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "threat:injection"
+      ]
     },
     {
       "id": "agent-security.malicious-package",

package/dist/overwatch-detectors.gen.js

@@ -51,8 +51,8 @@ export const OVERWATCH_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff at least one secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [{ title: "Key surfaced from a file read", vulnerabilityId: "credential_leakage", snippet: "(tool read .env) OPENAI_API_KEY=sk-proj-AAbb1234567890ZZ", expectedSignal: { "secrets_detected": true } }],
     },

package/dist/overwatch-entities.gen.js

@@ -7,7 +7,7 @@
 export const OVERWATCH_ENTITIES = {
     principals: ['Agent', 'User'],
     resources: ['FilePath', 'LlmPrompt', 'Server', 'Tool'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'post_tool_call', 'process_prompt', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for Overwatch.
@@ -22,6 +22,10 @@ export const OVERWATCH_ACTION_ENTITIES = {
         principals: ['Agent', 'User'],
         resources: ['Server'],
     },
+    'post_tool_call': {
+        principals: ['Agent', 'User'],
+        resources: ['FilePath', 'LlmPrompt', 'Tool'],
+    },
     'process_prompt': {
         principals: ['Agent', 'User'],
         resources: ['LlmPrompt'],

package/dist/sentry-defaults.gen.d.ts

@@ -2,7 +2,7 @@
  * Sentry policy category identifiers.
  * Maps to UI tab names in Studio.
  */
-export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'file-safety' | 'clipboard' | 'organization';
+export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'clipboard' | 'organization';
 /**
  * Category metadata for UI display.
  */

package/dist/sentry-defaults.gen.js

@@ -1110,38 +1110,6 @@ when {
     )
 };
 `;
-const SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR = `// =============================================================================
-// File & Attachment Safety (Default)
-// =============================================================================
-// Blocks file uploads to AI chat services when document content contains
-// secrets. PII in uploads is handled by the canonical privacy.* templates
-// (defaults/pii*.cedar), which scope to upload_file.
-//
-// Context keys consumed:
-//   - secrets_detected: Bool
-//
-// Compliance:
-//   - NIST 800-53 SC-28; GDPR Art. 32
-//
-// Category:  file-safety
-// Namespace: Sentry
-// =============================================================================
-
-@id("file-safety.block-upload-secrets")
-@name("Block file uploads with secrets")
-@description("Blocks upload_file when secrets_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
-@reject_message("File upload blocked: secrets or credentials detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};
-`;
 const SENTRY_CLIPBOARD_DEFAULTS_CEDAR = `// =============================================================================
 // Clipboard Policy (Default)
 // =============================================================================
@@ -1263,7 +1231,6 @@ export const SENTRY_CATEGORIES = [
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across messages and uploads.' },
     { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block prompt injection, jailbreak attempts, and high-severity threats.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, harmful, hateful, sexual, or profane content.' },
-    { id: 'file-safety', name: 'File & Attachment Safety', description: 'Block file uploads containing secrets or PII.' },
     { id: 'clipboard', name: 'Clipboard Policy', description: 'Control paste operations into AI chat services.' },
     { id: 'organization', name: 'Organization Rules', description: 'Organization-wide baselines and session-aware threat escalation.' },
 ];
@@ -1350,15 +1317,6 @@ export const SENTRY_TEMPLATES = [
         severity: 'critical',
         tags: ['category:privacy', 'threat:pii', 'detection:pattern', 'compliance:pci-dss', 'compliance:hipaa'],
     },
-    {
-        id: 'file-safety.block-upload-secrets',
-        name: 'File & Attachment Safety',
-        description: 'Block file uploads containing secrets in document content.',
-        category: 'file-safety',
-        cedarText: SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR,
-        severity: 'critical',
-        tags: ['category:file-safety', 'threat:secrets'],
-    },
     {
         id: 'clipboard.defaults',
         name: 'Clipboard Policy',
@@ -1407,11 +1365,6 @@ export const SENTRY_TEMPLATES_JSON = `{
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -1530,15 +1483,6 @@ export const SENTRY_TEMPLATES_JSON = `{
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",

package/dist/sentry-detectors.gen.js

@@ -37,8 +37,8 @@ export const SENTRY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
-        supportedModes: ["enforce", "monitor", "alert"],
+        emits: [{ name: "secrets_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a secret pattern matched." }, { name: "secret_types", type: "Set<String>", modifiable: true, semantic: "category_set", description: "Distinct secret types detected." }, { name: "secret_count", type: "Long", modifiable: false, semantic: "count", description: "Total secret matches detected." }],
+        supportedModes: ["enforce", "monitor", "alert", "modify"],
         defendsAgainst: ["credential_leakage", "prompt_leakage"],
         exampleAttacks: [],
     },

package/dist/service-schemas.gen.d.ts

@@ -21,7 +21,7 @@ export declare const GUARDRAILS_SCHEMA = "// ===================================
  *
  * Full Cedar schema for overwatch, embedded at codegen time.
  */
-export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
+export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Inspect the OUTPUT of a tool that has already run.\n// Threat focus: a credential or PII printed by a tool entering the agent's\n// context. The tool has run, so a permission verdict is meaningless here \u2014 the\n// only enforcement available is rewriting or withholding what the model sees,\n// which is why transform rules (@redaction_strategy) are the point of this\n// action. Context is deliberately narrower than call_tool: pre-execution\n// signals (tool risk, loop, sequence) belong to the call, not its result.\naction post_tool_call appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath, LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,\n    mcp_server?: String,\n    mcp_tool?: String,\n\n    // --- Result ---\n    exit_code?: Long,                 // Absent when the IDE does not propagate it\n\n    // --- File & Path ---\n    path?: String,\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Secrets --- the primary signal for this surface\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Indirect injection via tool output --- (OWASP ASI01)\n    indirect_injection_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_threat_turns?: Long,\n    session_max_secret_score?: Long,\n    session_max_pii_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
 /**
  * Palisade Cedar schema
  *

package/dist/service-schemas.gen.js

@@ -2352,6 +2352,78 @@ action call_tool appliesTo {
   },
 };
 
+// Inspect the OUTPUT of a tool that has already run.
+// Threat focus: a credential or PII printed by a tool entering the agent's
+// context. The tool has run, so a permission verdict is meaningless here — the
+// only enforcement available is rewriting or withholding what the model sees,
+// which is why transform rules (@redaction_strategy) are the point of this
+// action. Context is deliberately narrower than call_tool: pre-execution
+// signals (tool risk, loop, sequence) belong to the call, not its result.
+action post_tool_call appliesTo {
+  principal: [User, Agent],
+  resource: [Tool, FilePath, LlmPrompt],
+  context: {
+    // Identity (AARM R6 / CAP-IDN-011) — projected from the principal's token; optional.
+    role?: String,
+    privilege_scope?: Set<String>,
+    // --- Event & Source ---
+    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)
+    source: String,                   // IDE source
+    event: String,                    // Hook event name
+    user_email: String,               // User identifier
+
+    // --- Tool & MCP ---
+    tool_name?: String,
+    mcp_server?: String,
+    mcp_tool?: String,
+
+    // --- Result ---
+    exit_code?: Long,                 // Absent when the IDE does not propagate it
+
+    // --- File & Path ---
+    path?: String,
+
+    // --- Workspace ---
+    cwd?: String,
+    workspace_root?: String,
+
+    // --- Threat Detection ---
+    threat_count?: Long,
+    highest_severity?: String,
+    threat_categories?: Set<String>,
+    detected_threats?: Set<String>,
+    max_threat_severity?: Long,
+
+    // --- Secrets --- the primary signal for this surface
+    secrets_detected?: Bool,
+    secret_types?: Set<String>,
+    secret_count?: Long,
+
+    // --- PII Detection ---
+    pii_detected?: Bool,
+    pii_types?: Set<String>,
+    pii_count?: Long,
+    pii_score?: Long,
+
+    // --- Indirect injection via tool output --- (OWASP ASI01)
+    indirect_injection_score?: Long,
+
+    // --- Encoding & Unicode Attacks ---
+    invisible_chars_detected?: Bool,
+    invisible_chars_score?: Long,
+
+    // --- Session Detection History (cross-turn sticky flags) ---
+    session_pii_detected?: Bool,
+    session_pii_types?: Set<String>,
+    session_secrets_detected?: Bool,
+    session_secret_types?: Set<String>,
+    session_threat_turns?: Long,
+    session_max_secret_score?: Long,
+    session_max_pii_score?: Long,
+    session_cumulative_risk_score?: Long,
+  },
+};
+
 // Connect to an MCP server
 // Threat focus: supply chain, tool poisoning, rug pull, config risk
 action connect_server appliesTo {
@@ -4385,6 +4457,48 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "Sum of per-turn risk scores across the session. Catches death-by-a-thousand-cuts where no single turn is high but cumulative risk is significant" }
             ]
         },
+        {
+            "name": "post_tool_call",
+            "description": "Inspect the output of a tool that has already run. The tool has run, so enforcement is limited to rewriting or withholding what the model sees.",
+            "context_attributes": [
+                { "key": "role", "type": "string", "required": false, "description": "role projected for the post_tool_call surface." },
+                { "key": "privilege_scope", "type": "array", "required": false, "description": "privilege_scope projected for the post_tool_call surface." },
+                { "key": "content", "type": "string", "required": true, "description": "The tool\'s OUTPUT (stdout+stderr, or serialized response)" },
+                { "key": "source", "type": "string", "required": true, "description": "IDE source" },
+                { "key": "event", "type": "string", "required": true, "description": "Hook event name" },
+                { "key": "user_email", "type": "string", "required": true, "description": "User identifier" },
+                { "key": "tool_name", "type": "string", "required": false, "description": "tool_name projected for the post_tool_call surface." },
+                { "key": "mcp_server", "type": "string", "required": false, "description": "mcp_server projected for the post_tool_call surface." },
+                { "key": "mcp_tool", "type": "string", "required": false, "description": "mcp_tool projected for the post_tool_call surface." },
+                { "key": "exit_code", "type": "number", "required": false, "description": "Absent when the IDE does not propagate it" },
+                { "key": "path", "type": "string", "required": false, "description": "path projected for the post_tool_call surface." },
+                { "key": "cwd", "type": "string", "required": false, "description": "cwd projected for the post_tool_call surface." },
+                { "key": "workspace_root", "type": "string", "required": false, "description": "workspace_root projected for the post_tool_call surface." },
+                { "key": "threat_count", "type": "number", "required": false, "description": "threat_count projected for the post_tool_call surface." },
+                { "key": "highest_severity", "type": "string", "required": false, "description": "highest_severity projected for the post_tool_call surface." },
+                { "key": "threat_categories", "type": "array", "required": false, "description": "threat_categories projected for the post_tool_call surface." },
+                { "key": "detected_threats", "type": "array", "required": false, "description": "detected_threats projected for the post_tool_call surface." },
+                { "key": "max_threat_severity", "type": "number", "required": false, "description": "max_threat_severity projected for the post_tool_call surface." },
+                { "key": "secrets_detected", "type": "boolean", "required": false, "description": "secrets_detected projected for the post_tool_call surface." },
+                { "key": "secret_types", "type": "array", "required": false, "description": "secret_types projected for the post_tool_call surface." },
+                { "key": "secret_count", "type": "number", "required": false, "description": "secret_count projected for the post_tool_call surface." },
+                { "key": "pii_detected", "type": "boolean", "required": false, "description": "pii_detected projected for the post_tool_call surface." },
+                { "key": "pii_types", "type": "array", "required": false, "description": "pii_types projected for the post_tool_call surface." },
+                { "key": "pii_count", "type": "number", "required": false, "description": "pii_count projected for the post_tool_call surface." },
+                { "key": "pii_score", "type": "number", "required": false, "description": "pii_score projected for the post_tool_call surface." },
+                { "key": "indirect_injection_score", "type": "number", "required": false, "description": "indirect_injection_score projected for the post_tool_call surface." },
+                { "key": "invisible_chars_detected", "type": "boolean", "required": false, "description": "invisible_chars_detected projected for the post_tool_call surface." },
+                { "key": "invisible_chars_score", "type": "number", "required": false, "description": "invisible_chars_score projected for the post_tool_call surface." },
+                { "key": "session_pii_detected", "type": "boolean", "required": false, "description": "session_pii_detected projected for the post_tool_call surface." },
+                { "key": "session_pii_types", "type": "array", "required": false, "description": "session_pii_types projected for the post_tool_call surface." },
+                { "key": "session_secrets_detected", "type": "boolean", "required": false, "description": "session_secrets_detected projected for the post_tool_call surface." },
+                { "key": "session_secret_types", "type": "array", "required": false, "description": "session_secret_types projected for the post_tool_call surface." },
+                { "key": "session_threat_turns", "type": "number", "required": false, "description": "session_threat_turns projected for the post_tool_call surface." },
+                { "key": "session_max_secret_score", "type": "number", "required": false, "description": "session_max_secret_score projected for the post_tool_call surface." },
+                { "key": "session_max_pii_score", "type": "number", "required": false, "description": "session_max_pii_score projected for the post_tool_call surface." },
+                { "key": "session_cumulative_risk_score", "type": "number", "required": false, "description": "session_cumulative_risk_score projected for the post_tool_call surface." }
+            ]
+        },
         {
             "name": "connect_server",
             "description": "Connect to an MCP server",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.33",
+  "version": "2.2.35",
   "engines": {
     "node": ">=18"
   },