@highflame/policy 2.2.34 → 2.2.36

package/dist/agent_ops-context.gen.d.ts

@@ -41,6 +41,7 @@ export declare const AgentOpsContextKey: {
     readonly EncodedTypes: "encoded_types";
     readonly Event: "event";
     readonly ExecAllowlist: "exec_allowlist";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly FactualityScore: "factuality_score";
     readonly FlowCompartments: "flow_compartments";
     readonly FlowConfidentiality: "flow_confidentiality";
@@ -108,7 +109,9 @@ export declare const AgentOpsContextKey: {
     readonly PrincipalCompartments: "principal_compartments";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
     readonly RequestId: "request_id";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -158,15 +161,17 @@ export declare const AgentOpsContextKey: {
     readonly TopicConfidence: "topic_confidence";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly UserEmail: "user_email";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
     readonly WorkspaceRoot: "workspace_root";
     readonly WritablePaths: "writable_paths";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentOpsContextKey];
 /**
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "exec_target_paths", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths", "write_target_paths"];

package/dist/agent_ops-context.gen.js

@@ -43,6 +43,7 @@ export const AgentOpsContextKey = {
     EncodedTypes: 'encoded_types',
     Event: 'event',
     ExecAllowlist: 'exec_allowlist',
+    ExecTargetPaths: 'exec_target_paths',
     FactualityScore: 'factuality_score',
     FlowCompartments: 'flow_compartments',
     FlowConfidentiality: 'flow_confidentiality',
@@ -110,7 +111,9 @@ export const AgentOpsContextKey = {
     PrincipalCompartments: 'principal_compartments',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
     RequestId: 'request_id',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -160,11 +163,13 @@ export const AgentOpsContextKey = {
     TopicConfidence: 'topic_confidence',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     UserEmail: 'user_email',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
     WorkspaceRoot: 'workspace_root',
     WritablePaths: 'writable_paths',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for AgentOps.
@@ -207,6 +212,7 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.EncodedTypes,
     AgentOpsContextKey.Event,
     AgentOpsContextKey.ExecAllowlist,
+    AgentOpsContextKey.ExecTargetPaths,
     AgentOpsContextKey.FactualityScore,
     AgentOpsContextKey.FlowCompartments,
     AgentOpsContextKey.FlowConfidentiality,
@@ -274,7 +280,9 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.PrincipalCompartments,
     AgentOpsContextKey.PrivilegeScope,
     AgentOpsContextKey.ProfanityScore,
+    AgentOpsContextKey.ReadTargetPaths,
     AgentOpsContextKey.RequestId,
+    AgentOpsContextKey.ResolvedTargetPaths,
     AgentOpsContextKey.Role,
     AgentOpsContextKey.RpmExceeded,
     AgentOpsContextKey.RpmRemainingPct,
@@ -324,9 +332,11 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.TopicConfidence,
     AgentOpsContextKey.TpmExceeded,
     AgentOpsContextKey.TpmRemainingPct,
+    AgentOpsContextKey.UnresolvedTarget,
     AgentOpsContextKey.UserEmail,
     AgentOpsContextKey.ViolenceScore,
     AgentOpsContextKey.WeaponsScore,
     AgentOpsContextKey.WorkspaceRoot,
     AgentOpsContextKey.WritablePaths,
+    AgentOpsContextKey.WriteTargetPaths,
 ];

package/dist/agent_ops-defaults.gen.js

@@ -1263,38 +1263,26 @@ when {
 const AGENT_OPS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: AgentOps
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [AgentOps::Action::"process_prompt", AgentOps::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2552,7 +2540,6 @@ const AGENT_OPS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// ==================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2648,22 +2635,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is AgentOps::Agent,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3918,11 +3892,15 @@ when {
 const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -3947,36 +3925,6 @@ const AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == AgentOps::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == AgentOps::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -4690,11 +4638,11 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -4924,7 +4872,7 @@ export const AGENT_OPS_TEMPLATES = [
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'threat-detection',
         cedarText: AGENT_OPS_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -5251,17 +5199,15 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "threat-detection",
       "file": "ported/threat-detection/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {
@@ -5610,7 +5556,7 @@ export const AGENT_OPS_TEMPLATES_JSON = `{
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "threat-detection",
       "file": "ported/threat-detection/semantic_defaults.cedar",
       "severity": "critical",

package/dist/ai_gateway-context.gen.d.ts

@@ -8,6 +8,7 @@ export declare const AiGatewayContextKey: {
     readonly Content: "content";
     readonly CrimeScore: "crime_score";
     readonly DetectedThreats: "detected_threats";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
     readonly IndirectInjectionScore: "indirect_injection_score";
@@ -42,6 +43,8 @@ export declare const AiGatewayContextKey: {
     readonly PiiTypes: "pii_types";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -78,12 +81,14 @@ export declare const AiGatewayContextKey: {
     readonly ToolRiskScore: "tool_risk_score";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type AiGatewayContextKey = (typeof AiGatewayContextKey)[keyof typeof AiGatewayContextKey];
 /**
  * The full set of authorable context attribute keys for AiGateway.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const AiGatewayContextKeys: readonly ["content", "crime_score", "detected_threats", "exec_target_paths", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_score", "loop_count", "loop_detected", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "model_name", "model_provider", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "read_target_paths", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];

package/dist/ai_gateway-context.gen.js

@@ -10,6 +10,7 @@ export const AiGatewayContextKey = {
     Content: 'content',
     CrimeScore: 'crime_score',
     DetectedThreats: 'detected_threats',
+    ExecTargetPaths: 'exec_target_paths',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
     IndirectInjectionScore: 'indirect_injection_score',
@@ -44,6 +45,8 @@ export const AiGatewayContextKey = {
     PiiTypes: 'pii_types',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -80,8 +83,10 @@ export const AiGatewayContextKey = {
     ToolRiskScore: 'tool_risk_score',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for AiGateway.
@@ -91,6 +96,7 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.Content,
     AiGatewayContextKey.CrimeScore,
     AiGatewayContextKey.DetectedThreats,
+    AiGatewayContextKey.ExecTargetPaths,
     AiGatewayContextKey.HateSpeechScore,
     AiGatewayContextKey.HighestSeverity,
     AiGatewayContextKey.IndirectInjectionScore,
@@ -125,6 +131,8 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.PiiTypes,
     AiGatewayContextKey.PrivilegeScope,
     AiGatewayContextKey.ProfanityScore,
+    AiGatewayContextKey.ReadTargetPaths,
+    AiGatewayContextKey.ResolvedTargetPaths,
     AiGatewayContextKey.Role,
     AiGatewayContextKey.RpmExceeded,
     AiGatewayContextKey.RpmRemainingPct,
@@ -161,6 +169,8 @@ export const AiGatewayContextKeys = [
     AiGatewayContextKey.ToolRiskScore,
     AiGatewayContextKey.TpmExceeded,
     AiGatewayContextKey.TpmRemainingPct,
+    AiGatewayContextKey.UnresolvedTarget,
     AiGatewayContextKey.ViolenceScore,
     AiGatewayContextKey.WeaponsScore,
+    AiGatewayContextKey.WriteTargetPaths,
 ];

package/dist/ai_gateway-defaults.gen.js

@@ -168,7 +168,6 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - Computed risk score (tool_risk_score)
 //   - Detector category labels (tool_category, tool_is_sensitive)
 //   - Threat aggregation (threat_count, max_threat_severity)
-//   - Detection rule triggers (detected_threats)
 //
 // Context keys consumed:
 //   - tool_risk_score:      Long (0-100)
@@ -176,11 +175,9 @@ const AI_GATEWAY_TOOLS_DEFAULTS_CEDAR = `// ====================================
 //   - tool_is_sensitive:    Bool
 //   - threat_count:         Long
 //   - max_threat_severity:  Long (0-4)
-//   - detected_threats:     Set<String>
 //
 // Compliance:
 //   - OWASP LLM06, OWASP ASI02
-//   - MITRE T1059
 //
 // Category:  tools
 // Namespace: AIGateway
@@ -248,20 +245,9 @@ when {
     context.threat_count >= 1 && context.max_threat_severity >= 3
 };
 
-@id("tools.block-command-injection")
-@name("Block command injection")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:tools,threat:command-injection,detection:rule,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected in tool arguments.")
-forbid (
-    principal,
-    action == AIGateway::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore it when the detector is re-enabled.
 `;
 const AI_GATEWAY_AGENT_SECURITY_DEFAULTS_CEDAR = `// =============================================================================
 // Agent Security (Default)
@@ -1411,11 +1397,11 @@ export const AI_GATEWAY_TEMPLATES = [
     {
         id: 'tools.defaults',
         name: 'Tool Permissioning',
-        description: 'Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.',
+        description: 'Enforce tool risk scoring and block dangerous tools in MCP tool arguments.',
         category: 'tools',
         cedarText: AI_GATEWAY_TOOLS_DEFAULTS_CEDAR,
         severity: 'critical',
-        tags: ['category:tools', 'threat:command-injection', 'owasp:llm06', 'owasp:asi02'],
+        tags: ['category:tools', 'owasp:llm06', 'owasp:asi02'],
     },
     {
         id: 'agent-security.defaults',
@@ -1571,13 +1557,12 @@ export const AI_GATEWAY_TEMPLATES_JSON = `{
     {
       "id": "tools.defaults",
       "name": "Tool Permissioning",
-      "description": "Enforce tool risk scoring, block dangerous tools, and detect command injection in MCP tool arguments.",
+      "description": "Enforce tool risk scoring and block dangerous tools in MCP tool arguments.",
       "category": "tools",
       "file": "defaults/tools.cedar",
       "severity": "critical",
       "tags": [
         "category:tools",
-        "threat:command-injection",
         "owasp:llm06",
         "owasp:asi02"
       ]

package/dist/ai_gateway-detectors.gen.js

@@ -107,7 +107,7 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 1,
-        emits: [{ name: "tool_name", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_category", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_is_builtin", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_is_sensitive", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "tool_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Tool-call risk score (0-100)." }],
+        emits: [{ name: "tool_name", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_category", type: "String", modifiable: false, semantic: "category_label" }, { name: "tool_is_builtin", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_is_sensitive", type: "Bool", modifiable: false, semantic: "boolean_flag" }, { name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set" }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths, any capability. Cedar `like` is anchored so patterns start with `*`: sub-tree `*\\n/etc/*`, bare dir `*\\n/etc\\n*`, exact `*\\n/etc/passwd\\n*`." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*`." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }, { name: "tool_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Tool-call risk score (0-100)." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["excessive_agency", "unauthorized_access", "tool_hijacking"],
         exampleAttacks: [],
@@ -187,6 +187,7 @@ export const AI_GATEWAY_DETECTORS = [
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "crime_score": ["toxicity"],
+    "exec_target_paths": ["tool_risk"],
     "hate_speech_score": ["toxicity"],
     "indirect_injection_score": ["deepcontext"],
     "injection_score": ["injection"],
@@ -216,6 +217,8 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "pii_score": ["pii"],
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
+    "read_target_paths": ["tool_risk"],
+    "resolved_target_paths": ["tool_risk"],
     "rug_pull_detected": ["rug_pull"],
     "rug_pull_score": ["rug_pull"],
     "secret_count": ["secrets"],
@@ -241,8 +244,10 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "tool_poisoning_detected": ["tool_poisoning"],
     "tool_poisoning_score": ["tool_poisoning"],
     "tool_risk_score": ["tool_risk"],
+    "unresolved_target": ["tool_risk"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["tool_risk"],
 };
 export function aiGatewayDetectorById(id) {
     return AI_GATEWAY_DETECTORS.find((d) => d.id === id);

package/dist/guardrails-context.gen.d.ts

@@ -36,6 +36,7 @@ export declare const GuardrailsContextKey: {
     readonly EncodedCount: "encoded_count";
     readonly EncodedScore: "encoded_score";
     readonly EncodedTypes: "encoded_types";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly FactualityScore: "factuality_score";
     readonly HallucinationScore: "hallucination_score";
     readonly HateSpeechScore: "hate_speech_score";
@@ -97,7 +98,9 @@ export declare const GuardrailsContextKey: {
     readonly Principal: "principal";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
     readonly RequestId: "request_id";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -143,12 +146,14 @@ export declare const GuardrailsContextKey: {
     readonly TopicConfidence: "topic_confidence";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type GuardrailsContextKey = (typeof GuardrailsContextKey)[keyof typeof GuardrailsContextKey];
 /**
  * The full set of authorable context attribute keys for Guardrails.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "violence_score", "weapons_score"];
+export declare const GuardrailsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "detected_language", "detected_script", "detector_count", "direction", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "exec_target_paths", "factuality_score", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "mcp_config_risk", "mcp_input_request_detected", "mcp_input_request_methods", "mcp_input_request_score", "mcp_input_request_types", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "multi_turn_detection", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "suspicious_pattern", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "violence_score", "weapons_score", "write_target_paths"];

package/dist/guardrails-context.gen.js

@@ -38,6 +38,7 @@ export const GuardrailsContextKey = {
     EncodedCount: 'encoded_count',
     EncodedScore: 'encoded_score',
     EncodedTypes: 'encoded_types',
+    ExecTargetPaths: 'exec_target_paths',
     FactualityScore: 'factuality_score',
     HallucinationScore: 'hallucination_score',
     HateSpeechScore: 'hate_speech_score',
@@ -99,7 +100,9 @@ export const GuardrailsContextKey = {
     Principal: 'principal',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
     RequestId: 'request_id',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -145,8 +148,10 @@ export const GuardrailsContextKey = {
     TopicConfidence: 'topic_confidence',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for Guardrails.
@@ -184,6 +189,7 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.EncodedCount,
     GuardrailsContextKey.EncodedScore,
     GuardrailsContextKey.EncodedTypes,
+    GuardrailsContextKey.ExecTargetPaths,
     GuardrailsContextKey.FactualityScore,
     GuardrailsContextKey.HallucinationScore,
     GuardrailsContextKey.HateSpeechScore,
@@ -245,7 +251,9 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.Principal,
     GuardrailsContextKey.PrivilegeScope,
     GuardrailsContextKey.ProfanityScore,
+    GuardrailsContextKey.ReadTargetPaths,
     GuardrailsContextKey.RequestId,
+    GuardrailsContextKey.ResolvedTargetPaths,
     GuardrailsContextKey.Role,
     GuardrailsContextKey.RpmExceeded,
     GuardrailsContextKey.RpmRemainingPct,
@@ -291,6 +299,8 @@ export const GuardrailsContextKeys = [
     GuardrailsContextKey.TopicConfidence,
     GuardrailsContextKey.TpmExceeded,
     GuardrailsContextKey.TpmRemainingPct,
+    GuardrailsContextKey.UnresolvedTarget,
     GuardrailsContextKey.ViolenceScore,
     GuardrailsContextKey.WeaponsScore,
+    GuardrailsContextKey.WriteTargetPaths,
 ];