@highflame/policy 2.2.34 → 2.2.36

package/dist/guardrails-defaults.gen.js

@@ -808,38 +808,26 @@ when {
 const GUARDRAILS_SECURITY_PATTERNS_CEDAR = `// =============================================================================
 // Security Pattern Detection (Default)
 // =============================================================================
-// Blocks command injection, path traversal, and SQL injection using
-// regex-based pattern detection from Shield's security detectors.
+// Blocks path traversal and SQL injection using regex-based pattern detection
+// from Shield's security detectors.
+//
+// The command-injection rule was removed while that detector is disabled, so
+// this template cannot instantiate a rule that can never fire. See
+// highflame-shield#386; restore the rule when the detector is re-enabled.
 //
 // Context keys consumed:
-//   - command_injection_detected:  Bool
 //   - path_traversal_detected:     Bool
 //   - path_traversal_severity:     String
 //   - sql_injection_detected:      Bool
 //   - sql_injection_score:         Long (0-100)
 //
 // Compliance:
-//   - MITRE T1059 (Command Injection), T1005 (Data from Local System)
+//   - MITRE T1005 (Data from Local System)
 //
 // Category:  security
 // Namespace: Guardrails
 // =============================================================================
 
-@id("security.block-command-injection")
-@name("Block command injection")
-@description("Blocks process_prompt and call_tool when command_injection_detected is true.")
-@severity("critical")
-@tags("category:security,threat:command-injection,detection:pattern,mitre:t1059")
-@reject_message("Request blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
-    resource
-)
-when {
-    context has command_injection_detected && context.command_injection_detected == true
-};
-
 @id("security.block-path-traversal")
 @name("Block path traversal")
 @description("Blocks process_prompt, call_tool, read_file, and write_file when path_traversal_detected is true and severity is high or critical.")
@@ -2097,7 +2085,6 @@ const GUARDRAILS_AGENT_IDENTITY_MULTI_AGENT_SAFETY_CEDAR = `// =================
 //   - agent_trust_level, agent_type, tool_name, tool_is_sensitive
 //   - session_pii_detected, session_pii_types
 //   - session_secrets_detected, session_injection_detected
-//   - session_command_injection
 //   - session_threat_turns:            Long
 //   - session_cumulative_risk_score:   Long
 //   - suspicious_pattern:              Bool
@@ -2193,22 +2180,9 @@ when {
     context has session_injection_detected && context.session_injection_detected == true
 };
 
-@id("agent-identity.multi-agent-post-command-injection-shell")
-@name("Block shell after command injection in session")
-@description("Blocks call_tool when session_command_injection is true and tool_name is a shell tool.")
-@severity("critical")
-@tags("category:agent-identity,threat:command-injection,scope:per-agent,detection:aggregate,surface:call-tool,mitre:t1059")
-@reject_message("Tool execution blocked: command injection was detected earlier in this session — no agent may execute shell commands afterwards.")
-forbid (
-    principal is Guardrails::Agent,
-    action == Guardrails::Action::"call_tool",
-    resource
-)
-when {
-    context has session_command_injection && context.session_command_injection == true &&
-    context has tool_name &&
-    (context.tool_name == "shell" || context.tool_name == "execute_command" || context.tool_name == "bash")
-};
+// The post-command-injection shell rule was removed while that detector is
+// disabled, so this template cannot instantiate a rule that can never fire.
+// See highflame-shield#386; restore it when the detector is re-enabled.
 
 // ---------------------------------------------------------------------------
 // Section 4: Cumulative risk circuit breakers
@@ -3464,7 +3438,7 @@ when {
 // CATEGORIES
 // =============================================================================
 export const GUARDRAILS_CATEGORIES = [
-    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection.' },
+    { id: 'security', name: 'Security', description: 'Block prompt injection, jailbreak attempts, path traversal, and SQL injection.' },
     { id: 'privacy', name: 'Privacy', description: 'Block personally identifiable information (PII) in prompts and responses.' },
     { id: 'data-protection', name: 'Data Protection', description: 'Block secrets, API keys, tokens, and bulk credential exposure.' },
     { id: 'trust-safety', name: 'Trust & Safety', description: 'Block toxic, violent, hateful, sexual, or profane content; restrict regulated topics.' },
@@ -3577,11 +3551,11 @@ export const GUARDRAILS_TEMPLATES = [
     {
         id: 'security.patterns',
         name: 'Security Pattern Detection',
-        description: 'Block command injection, path traversal, and SQL injection using regex-based pattern detection.',
+        description: 'Block path traversal and SQL injection using regex-based pattern detection.',
         category: 'security',
         cedarText: GUARDRAILS_SECURITY_PATTERNS_CEDAR,
-        severity: 'critical',
-        tags: ['category:security', 'threat:command-injection', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern', 'mitre:t1059'],
+        severity: 'high',
+        tags: ['category:security', 'threat:sql-injection', 'threat:path-traversal', 'detection:pattern'],
     },
     {
         id: 'trust-safety.semantic',
@@ -3821,7 +3795,7 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security",
       "name": "Security",
-      "description": "Block prompt injection, jailbreak attempts, command injection, path traversal, and SQL injection."
+      "description": "Block prompt injection, jailbreak attempts, path traversal, and SQL injection."
     },
     {
       "id": "privacy",
@@ -4000,17 +3974,15 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
     {
       "id": "security.patterns",
       "name": "Security Pattern Detection",
-      "description": "Block command injection, path traversal, and SQL injection using regex-based pattern detection.",
+      "description": "Block path traversal and SQL injection using regex-based pattern detection.",
       "category": "security",
       "file": "defaults/security_patterns.cedar",
-      "severity": "critical",
+      "severity": "high",
       "tags": [
         "category:security",
-        "threat:command-injection",
         "threat:sql-injection",
         "threat:path-traversal",
-        "detection:pattern",
-        "mitre:t1059"
+        "detection:pattern"
       ]
     },
     {

package/dist/guardrails-detectors.gen.js

@@ -443,7 +443,7 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }],
+        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths the command touches, any capability. Every value is \\n-anchored and Cedar `like` is full-string anchored, so patterns MUST start with `*`: anchored sub-tree `*\\n/etc/*` (matches only paths under /etc, unlike the loose `*/etc/*` which also hits a project `etc/` dir at any depth); bare directory target `*\\n/etc\\n*` (e.g. `rm -rf /etc`, no trailing slash); exact file `*\\n/etc/passwd\\n*`. Purely lexical resolution (cwd-join + path.Clean; quoting/escape/wrapper/cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys (redirects, writers, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i). \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["command_injection", "unauthorized_access"],
         exampleAttacks: [{ title: "Destructive shell op", vulnerabilityId: "command_injection", snippet: "rm -rf / --no-preserve-root", expectedSignal: {} }],
@@ -479,6 +479,7 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "encoded_count": ["encoded_injection"],
     "encoded_score": ["encoded_injection"],
     "encoded_types": ["encoded_injection"],
+    "exec_target_paths": ["bash_ast_classifier"],
     "factuality_score": ["hallucination"],
     "file_extension": ["file_metadata"],
     "file_name": ["file_metadata"],
@@ -549,6 +550,8 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
     "prompt_injection_score": ["deepcontext"],
+    "read_target_paths": ["bash_ast_classifier"],
+    "resolved_target_paths": ["bash_ast_classifier"],
     "rpm_exceeded": ["budget_checker"],
     "rpm_remaining_pct": ["budget_checker"],
     "rug_pull_detected": ["rug_pull"],
@@ -590,8 +593,10 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "topic_confidence": ["topic"],
     "tpm_exceeded": ["budget_checker"],
     "tpm_remaining_pct": ["budget_checker"],
+    "unresolved_target": ["bash_ast_classifier"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["bash_ast_classifier"],
 };
 export function guardrailsDetectorById(id) {
     return GUARDRAILS_DETECTORS.find((d) => d.id === id);

package/dist/overwatch-context.gen.d.ts

@@ -10,6 +10,7 @@ export declare const OverwatchContextKey: {
     readonly Cwd: "cwd";
     readonly DetectedThreats: "detected_threats";
     readonly Event: "event";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly ExitCode: "exit_code";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
@@ -50,6 +51,8 @@ export declare const OverwatchContextKey: {
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
     readonly PromptText: "prompt_text";
+    readonly ReadTargetPaths: "read_target_paths";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly ResponseContent: "response_content";
     readonly Role: "role";
     readonly RugPullDetected: "rug_pull_detected";
@@ -84,14 +87,16 @@ export declare const OverwatchContextKey: {
     readonly ToolPoisoningDetected: "tool_poisoning_detected";
     readonly ToolPoisoningScore: "tool_poisoning_score";
     readonly ToolRiskScore: "tool_risk_score";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly UserEmail: "user_email";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
     readonly WorkspaceRoot: "workspace_root";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof OverwatchContextKey];
 /**
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];

package/dist/overwatch-context.gen.js

@@ -12,6 +12,7 @@ export const OverwatchContextKey = {
     Cwd: 'cwd',
     DetectedThreats: 'detected_threats',
     Event: 'event',
+    ExecTargetPaths: 'exec_target_paths',
     ExitCode: 'exit_code',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
@@ -52,6 +53,8 @@ export const OverwatchContextKey = {
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
     PromptText: 'prompt_text',
+    ReadTargetPaths: 'read_target_paths',
+    ResolvedTargetPaths: 'resolved_target_paths',
     ResponseContent: 'response_content',
     Role: 'role',
     RugPullDetected: 'rug_pull_detected',
@@ -86,10 +89,12 @@ export const OverwatchContextKey = {
     ToolPoisoningDetected: 'tool_poisoning_detected',
     ToolPoisoningScore: 'tool_poisoning_score',
     ToolRiskScore: 'tool_risk_score',
+    UnresolvedTarget: 'unresolved_target',
     UserEmail: 'user_email',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
     WorkspaceRoot: 'workspace_root',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for Overwatch.
@@ -101,6 +106,7 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.Cwd,
     OverwatchContextKey.DetectedThreats,
     OverwatchContextKey.Event,
+    OverwatchContextKey.ExecTargetPaths,
     OverwatchContextKey.ExitCode,
     OverwatchContextKey.HateSpeechScore,
     OverwatchContextKey.HighestSeverity,
@@ -141,6 +147,8 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.PrivilegeScope,
     OverwatchContextKey.ProfanityScore,
     OverwatchContextKey.PromptText,
+    OverwatchContextKey.ReadTargetPaths,
+    OverwatchContextKey.ResolvedTargetPaths,
     OverwatchContextKey.ResponseContent,
     OverwatchContextKey.Role,
     OverwatchContextKey.RugPullDetected,
@@ -175,8 +183,10 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.ToolPoisoningDetected,
     OverwatchContextKey.ToolPoisoningScore,
     OverwatchContextKey.ToolRiskScore,
+    OverwatchContextKey.UnresolvedTarget,
     OverwatchContextKey.UserEmail,
     OverwatchContextKey.ViolenceScore,
     OverwatchContextKey.WeaponsScore,
     OverwatchContextKey.WorkspaceRoot,
+    OverwatchContextKey.WriteTargetPaths,
 ];

package/dist/overwatch-defaults.gen.js

@@ -239,11 +239,15 @@ when { context has secrets_detected && context.secrets_detected == true };
 const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// =============================================================================
 // Semantic Threat Detection (Default)
 // =============================================================================
-// Blocks injection attacks (command, SQL, path traversal), prompt injection,
-// jailbreak attempts, and encoded payloads using two detection tiers:
+// Blocks injection attacks (SQL, path traversal), prompt injection, jailbreak
+// attempts, and encoded payloads using two detection tiers:
 //
 //   Tier 1 — Pattern-based (always available, no external dependency)
-//     command_injection, sql_injection, path_traversal, detect_encoded
+//     sql_injection, path_traversal, detect_encoded
+//
+// The command-injection rules were removed while that detector is disabled, so
+// this template cannot instantiate rules that can never fire. See
+// highflame-shield#386; restore them when the detector is re-enabled.
 //
 //   Tier 2 — ML classifiers (require Highflame API token)
 //     injection_score, jailbreak_score
@@ -268,36 +272,6 @@ const OVERWATCH_SEMANTIC_DEFAULTS_CEDAR = `// ==================================
 // Tier 1: Pattern-based injection detection
 // ---------------------------------------------------------------------------
 
-@id("semantic.block-command-injection-tool")
-@name("Block command injection in tool calls")
-@description("Blocks call_tool when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:call-tool,mitre:t1059,owasp:asi02")
-@reject_message("Tool execution blocked: command injection pattern detected — reverse shell, destructive command, or privilege escalation.")
-forbid (
-    principal,
-    action == Overwatch::Action::"call_tool",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
-@id("semantic.block-command-injection-prompt")
-@name("Block command injection in prompts")
-@description("Blocks process_prompt when detected_threats contains \\"command_injection\\".")
-@severity("critical")
-@tags("category:semantic,threat:command-injection,detection:pattern,surface:process-prompt,mitre:t1059")
-@reject_message("Prompt blocked: command injection pattern detected.")
-forbid (
-    principal,
-    action == Overwatch::Action::"process_prompt",
-    resource
-)
-when {
-    context has detected_threats && context.detected_threats.contains("command_injection")
-};
-
 @id("semantic.block-sql-injection-tool")
 @name("Block SQL injection in tool calls")
 @description("Blocks call_tool when detected_threats contains \\"sql_injection\\".")
@@ -1851,7 +1825,7 @@ when {
 export const OVERWATCH_CATEGORIES = [
     { id: 'data-protection', name: 'Secrets & Data Protection', description: 'Block credential leakage and protect sensitive file paths.' },
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across prompts, tool calls, and file operations.' },
-    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
+    { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, hateful, sexual, criminal, or excessively profane content.' },
     { id: 'tools', name: 'Tool Permissioning', description: 'Control shell execution, file operations, MCP servers, and sensitive system paths.' },
     { id: 'agent-identity', name: 'Agent-Specific Guardrails', description: 'Per-agent security policies applied based on agent identity.' },
@@ -1908,7 +1882,7 @@ export const OVERWATCH_TEMPLATES = [
     {
         id: 'semantic.defaults',
         name: 'Semantic Threat Detection',
-        description: 'Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
+        description: 'Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.',
         category: 'semantic',
         cedarText: OVERWATCH_SEMANTIC_DEFAULTS_CEDAR,
         severity: 'critical',
@@ -2072,7 +2046,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "semantic",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
+      "description": "Block injection attacks (SQL, path traversal, encoded), prompt injection, and jailbreak attempts."
     },
     {
       "id": "trust-safety",
@@ -2159,7 +2133,7 @@ export const OVERWATCH_TEMPLATES_JSON = `{
     {
       "id": "semantic.defaults",
       "name": "Semantic Threat Detection",
-      "description": "Block injection attacks (command, SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
+      "description": "Block injection attacks (SQL, path, encoded) plus ML-detected prompt injection and jailbreak attempts.",
       "category": "semantic",
       "file": "defaults/semantic.cedar",
       "severity": "critical",

package/dist/overwatch-detectors.gen.js

@@ -107,7 +107,7 @@ export const OVERWATCH_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }],
+        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths the command touches, any capability. Every value is \\n-anchored and Cedar `like` is full-string anchored, so patterns MUST start with `*`: anchored sub-tree `*\\n/etc/*` (matches only paths under /etc, unlike the loose `*/etc/*` which also hits a project `etc/` dir at any depth); bare directory target `*\\n/etc\\n*` (e.g. `rm -rf /etc`, no trailing slash); exact file `*\\n/etc/passwd\\n*`. Purely lexical resolution (cwd-join + path.Clean; quoting/escape/wrapper/cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys (redirects, writers, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i). \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["command_injection", "unauthorized_access"],
         exampleAttacks: [{ title: "Destructive shell op", vulnerabilityId: "command_injection", snippet: "rm -rf / --no-preserve-root", expectedSignal: {} }],
@@ -201,6 +201,7 @@ export const OVERWATCH_DETECTORS = [
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const OVERWATCH_FIELD_TO_DETECTORS = {
     "crime_score": ["toxicity"],
+    "exec_target_paths": ["bash_ast_classifier"],
     "hate_speech_score": ["toxicity"],
     "indirect_injection_score": ["deepcontext"],
     "injection_deep_context_score": ["deepcontext"],
@@ -235,6 +236,8 @@ export const OVERWATCH_FIELD_TO_DETECTORS = {
     "pii_score": ["pii"],
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
+    "read_target_paths": ["bash_ast_classifier"],
+    "resolved_target_paths": ["bash_ast_classifier"],
     "rug_pull_detected": ["rug_pull"],
     "rug_pull_score": ["rug_pull"],
     "secret_count": ["secrets"],
@@ -260,8 +263,10 @@ export const OVERWATCH_FIELD_TO_DETECTORS = {
     "tool_poisoning_detected": ["tool_poisoning"],
     "tool_poisoning_score": ["tool_poisoning"],
     "tool_risk_score": ["tool_risk"],
+    "unresolved_target": ["bash_ast_classifier"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["bash_ast_classifier"],
 };
 export function overwatchDetectorById(id) {
     return OVERWATCH_DETECTORS.find((d) => d.id === id);

package/dist/sentry-defaults.gen.d.ts

@@ -2,7 +2,7 @@
  * Sentry policy category identifiers.
  * Maps to UI tab names in Studio.
  */
-export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'file-safety' | 'clipboard' | 'organization';
+export type SentryCategory = 'data-protection' | 'privacy' | 'semantic' | 'trust-safety' | 'clipboard' | 'organization';
 /**
  * Category metadata for UI display.
  */

package/dist/sentry-defaults.gen.js

@@ -1110,38 +1110,6 @@ when {
     )
 };
 `;
-const SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR = `// =============================================================================
-// File & Attachment Safety (Default)
-// =============================================================================
-// Blocks file uploads to AI chat services when document content contains
-// secrets. PII in uploads is handled by the canonical privacy.* templates
-// (defaults/pii*.cedar), which scope to upload_file.
-//
-// Context keys consumed:
-//   - secrets_detected: Bool
-//
-// Compliance:
-//   - NIST 800-53 SC-28; GDPR Art. 32
-//
-// Category:  file-safety
-// Namespace: Sentry
-// =============================================================================
-
-@id("file-safety.block-upload-secrets")
-@name("Block file uploads with secrets")
-@description("Blocks upload_file when secrets_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
-@reject_message("File upload blocked: secrets or credentials detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};
-`;
 const SENTRY_CLIPBOARD_DEFAULTS_CEDAR = `// =============================================================================
 // Clipboard Policy (Default)
 // =============================================================================
@@ -1263,7 +1231,6 @@ export const SENTRY_CATEGORIES = [
     { id: 'privacy', name: 'PII Detection', description: 'Block personally identifiable information across messages and uploads.' },
     { id: 'semantic', name: 'Semantic Threat Detection', description: 'Block prompt injection, jailbreak attempts, and high-severity threats.' },
     { id: 'trust-safety', name: 'Content Safety', description: 'Block violent, harmful, hateful, sexual, or profane content.' },
-    { id: 'file-safety', name: 'File & Attachment Safety', description: 'Block file uploads containing secrets or PII.' },
     { id: 'clipboard', name: 'Clipboard Policy', description: 'Control paste operations into AI chat services.' },
     { id: 'organization', name: 'Organization Rules', description: 'Organization-wide baselines and session-aware threat escalation.' },
 ];
@@ -1350,15 +1317,6 @@ export const SENTRY_TEMPLATES = [
         severity: 'critical',
         tags: ['category:privacy', 'threat:pii', 'detection:pattern', 'compliance:pci-dss', 'compliance:hipaa'],
     },
-    {
-        id: 'file-safety.block-upload-secrets',
-        name: 'File & Attachment Safety',
-        description: 'Block file uploads containing secrets in document content.',
-        category: 'file-safety',
-        cedarText: SENTRY_FILE_SAFETY_BLOCK_UPLOAD_SECRETS_CEDAR,
-        severity: 'critical',
-        tags: ['category:file-safety', 'threat:secrets'],
-    },
     {
         id: 'clipboard.defaults',
         name: 'Clipboard Policy',
@@ -1407,11 +1365,6 @@ export const SENTRY_TEMPLATES_JSON = `{
       "name": "Content Safety",
       "description": "Block violent, harmful, hateful, sexual, or profane content."
     },
-    {
-      "id": "file-safety",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets or PII."
-    },
     {
       "id": "clipboard",
       "name": "Clipboard Policy",
@@ -1530,15 +1483,6 @@ export const SENTRY_TEMPLATES_JSON = `{
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "file-safety.block-upload-secrets",
-      "name": "File & Attachment Safety",
-      "description": "Block file uploads containing secrets in document content.",
-      "category": "file-safety",
-      "file": "defaults/file_safety.cedar",
-      "severity": "critical",
-      "tags": ["category:file-safety", "threat:secrets"]
-    },
     {
       "id": "clipboard.defaults",
       "name": "Clipboard Policy",