@highflame/policy 2.2.34 → 2.2.36

package/_schemas/agent_ops/context.json

@@ -1229,6 +1229,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "path",
           "type": "string",

package/_schemas/agent_ops/schema.cedarschema

@@ -421,6 +421,13 @@ namespace AgentOps {
         // Tool Operation Classifier (optional)
         "tool_operation_classes"?: Set<String>,
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Boolean,

package/_schemas/agent_ops/templates/ported/agent-security/agent_identity_multi_agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/agent_ops/templates/ported/threat-detection/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/agent_ops/templates/ported/threat-detection/semantic_defaults.cedar

@@ -1,11 +1,15 @@
 // =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -30,36 +34,6 @@
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \"sql_injection\".")

package/_schemas/agent_ops/templates/templates.json

@@ -251,17 +251,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -610,7 +608,7 @@
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/_schemas/ai_gateway/context.json

@@ -187,6 +187,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\". NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim."
+        },
         {
           "key": "mcp_server_verified",
           "type": "boolean",

package/_schemas/ai_gateway/schema.cedarschema

@@ -122,6 +122,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 

package/_schemas/ai_gateway/templates/defaults/tools.cedar

@@ -8,7 +8,6 @@
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -16,11 +15,9 @@
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -88,17 +85,6 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \"command_injection\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.

package/_schemas/ai_gateway/templates/templates.json

@@ -75,13 +75,12 @@
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/_schemas/guardrails/context.json

@@ -1066,6 +1066,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "cross_origin_detected",
           "type": "boolean",

package/_schemas/guardrails/schema.cedarschema

@@ -405,6 +405,13 @@ namespace Guardrails {
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,

package/_schemas/guardrails/templates/defaults/security_patterns.cedar

@@ -1,38 +1,26 @@
 // =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")

package/_schemas/guardrails/templates/profiles/multi_agent/agent_safety.cedar

@@ -10,7 +10,6 @@
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -106,22 +105,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers

package/_schemas/guardrails/templates/templates.json

@@ -6,7 +6,7 @@
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -185,17 +185,15 @@
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/_schemas/overwatch/context.json

@@ -680,6 +680,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "package_install_detected",
           "type": "boolean",

package/_schemas/overwatch/schema.cedarschema

@@ -246,6 +246,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,

package/_schemas/sentry/templates/templates.json

@@ -23,11 +23,6 @@
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -146,15 +141,6 @@
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",