@highflame/policy 2.2.34 → 2.2.35

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar

@@ -1,11 +1,15 @@
 // =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -30,36 +34,6 @@
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \"sql_injection\".")

package/_schemas/agent_ops/templates/templates.json

@@ -251,17 +251,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -610,7 +608,7 @@
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/_schemas/ai_gateway/templates/defaults/tools.cedar

@@ -8,7 +8,6 @@
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -16,11 +15,9 @@
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -88,17 +85,6 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.

package/_schemas/ai_gateway/templates/templates.json

@@ -75,13 +75,12 @@
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/_schemas/guardrails/templates/defaults/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/guardrails/templates/profiles/multi_agent/agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/guardrails/templates/templates.json

@@ -6,7 +6,7 @@
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -185,17 +185,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/_schemas/sentry/templates/templates.json

@@ -23,11 +23,6 @@
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -146,15 +141,6 @@
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",

package/dist/agent_ops-defaults.gen.js

@@ -1263,38 +1263,26 @@ when {
 const AGENT_OPS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2552,7 +2540,6 @@ const AGENT_OPS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// ==================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2648,22 +2635,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3918,11 +3892,15 @@ when {
 const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -3947,36 +3925,6 @@ const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -4690,11 +4638,11 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -4924,7 +4872,7 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -5251,17 +5199,15 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -5610,7 +5556,7 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/dist/ai_gateway-defaults.gen.js

@@ -168,7 +168,6 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -176,11 +175,9 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -248,20 +245,9 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.
 `;
 const AI_GATEWAY_AGENT_SECURITY_DEFAULTS_CEDAR = `// =============================================================================
 // Agent Security (Default)
@@ -1411,11 +1397,11 @@ export const AI_GATEWAY_TEMPLATES = [
     {
         id: 'tools.defaults',
         name: 'Tool Permissioning',
-        description: 'Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.',
+        description: 'Enforce tool risk scoring and block dangerous tools in MCP tool arguments.',
         category: 'tools',
         cedarText: AI_GATEWAY_TOOLS_DEFAULTS_CEDAR,
         severity: 'critical',
-        tags: ['category:tools', 'threat:command-injection', 'owasp:llm06', 'owasp:asi02'],
+        tags: ['category:tools', 'owasp:llm06', 'owasp:asi02'],
     },
     {
         id: 'agent-security.defaults',
@@ -1571,13 +1557,12 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/dist/guardrails-defaults.gen.js

@@ -808,38 +808,26 @@ when {
 const GUARDRAILS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2097,7 +2085,6 @@ const GUARDRAILS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// =================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2193,22 +2180,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3464,7 +3438,7 @@ when {
 // CATEGORIES
 // =============================================================================
 export const GUARDRAILS_CATEGORIES = [
-    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection.' },
+    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.' },
     { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.' },
     { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.' },
     { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.' },
@@ -3577,11 +3551,11 @@ export const GUARDRAILS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'security',
         cedarText: GUARDRAILS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -3821,7 +3795,7 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -4000,17 +3974,15 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/dist/overwatch-defaults.gen.js

@@ -239,11 +239,15 @@ when { context has secrets_detected && context.secrets_detected == true };
 const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -268,36 +272,6 @@ const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == Overwatch::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == Overwatch::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -1851,7 +1825,7 @@ when {
 export const OVERWATCH_CATEGORIES = [
     { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block credential leakage and protect sensitive file paths.' },
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across prompts, tool calls, and file operations.' },
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, hateful, sexual, criminal, or excessively profane content.' },
     { id: 'tools', name: 'Tool Permissioning', description: 'Control shell execution, file operations, MCP servers, and sensitive system paths.' },
     { id: 'agent-identity', name: 'Agent-Specific Guardrails', description: 'Per-agent security policies applied based on agent identity.' },
@@ -1908,7 +1882,7 @@ export const OVERWATCH_TEMPLATES = [
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'semantic',
         cedarText: OVERWATCH_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -2072,7 +2046,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
+      "description": "Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
     },
     {
       "id": "trust-safety",
@@ -2159,7 +2133,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",

package/dist/sentry-defaults.gen.d.ts

@@ -2,7 +2,7 @@
  * Sentry policy category identifiers.
  * Maps to UI tab names in Studio.
  */
-export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'file-safety' | 'clipboard' | 'organization';
+export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'clipboard' | 'organization';
 /**
  * Category metadata for UI display.
  */

package/dist/sentry-defaults.gen.js

@@ -1110,38 +1110,6 @@ when {
     )
 };
 `;
-const SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR = `// =============================================================================
-// File & Attachment Safety (Default)
-// =============================================================================
-// Blocks file uploads to AI chat services when document content contains
-// secrets. PII in uploads is handled by the canonical privacy.* templates
-// (defaults/pii*.cedar), which scope to upload_file.
-//
-// Context keys consumed:
-//   - secrets_detected: Bool
-//
-// Compliance:
-//   - NIST 800-53 SC-28; GDPR Art. 32
-//
-// Category:  file-safety
-// Namespace: Sentry
-// =============================================================================
-
-@id("file-safety.block-upload-secrets")
-@name("Block file uploads with secrets")
-@description("Blocks upload_file when secrets_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
-@reject_message("File upload blocked: secrets or credentials detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};
-`;
 const SENTRY_CLIPBOARD_DEFAULTS_CEDAR = `// =============================================================================
 // Clipboard Policy (Default)
 // =============================================================================
@@ -1263,7 +1231,6 @@ export const SENTRY_CATEGORIES = [
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across messages and uploads.' },
     { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block prompt injection, jailbreak attempts, and high-severity threats.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, harmful, hateful, sexual, or profane content.' },
-    { id: 'file-safety', name: 'File & Attachment Safety', description: 'Block file uploads containing secrets or PII.' },
     { id: 'clipboard', name: 'Clipboard Policy', description: 'Control paste operations into AI chat services.' },
     { id: 'organization', name: 'Organization Rules', description: 'Organization-wide baselines and session-aware threat escalation.' },
 ];
@@ -1350,15 +1317,6 @@ export const SENTRY_TEMPLATES = [
         severity: 'critical',
         tags: ['category:privacy', 'threat:pii', 'detection:pattern', 'compliance:pci-dss', 'compliance:hipaa'],
     },
-    {
-        id: 'file-safety.block-upload-secrets',
-        name: 'File & Attachment Safety',
-        description: 'Block file uploads containing secrets in document content.',
-        category: 'file-safety',
-        cedarText: SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR,
-        severity: 'critical',
-        tags: ['category:file-safety', 'threat:secrets'],
-    },
     {
         id: 'clipboard.defaults',
         name: 'Clipboard Policy',
@@ -1407,11 +1365,6 @@ export const SENTRY_TEMPLATES_JSON = `{
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -1530,15 +1483,6 @@ export const SENTRY_TEMPLATES_JSON = `{
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.34",
+  "version": "2.2.35",
   "engines": {
     "node": ">=18"
   },

package/_schemas/sentry/templates/defaults/file_safety.cedar

@@ -1,31 +0,0 @@
-// =============================================================================
-// File & Attachment Safety (Default)
-// =============================================================================
-// Blocks file uploads to AI chat services when document content contains
-// secrets. PII in uploads is handled by the canonical privacy.* templates
-// (defaults/pii*.cedar), which scope to upload_file.
-//
-// Context keys consumed:
-//   - secrets_detected: Bool
-//
-// Compliance:
-//   - NIST 800-53 SC-28; GDPR Art. 32
-//
-// Category:  file-safety
-// Namespace: Sentry
-// =============================================================================
-
-@id("file-safety.block-upload-secrets")
-@name("Block file uploads with secrets")
-@description("Blocks upload_file when secrets_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
-@reject_message("File upload blocked: secrets or credentials detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};