@highflame/policy 2.2.34 → 2.2.36

package/dist/service-schemas.gen.js

@@ -439,6 +439,13 @@ namespace AgentOps {
         // Tool Operation Classifier (optional)
         "tool_operation_classes"?: Set<String>,
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Boolean,
@@ -1048,6 +1055,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
     // --- MCP Trust ---
     mcp_server_verified?: Bool,       // Whether server is from verified registry
 
@@ -1821,6 +1835,13 @@ namespace Guardrails {
         // Tool Operation Classifier (optional) — populated by AST-based classifiers (bash, python, etc.)
         "tool_operation_classes"?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+        // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+        "resolved_target_paths"?: String,  // union of resolved absolute target paths, any capability
+        "read_target_paths"?: String,      // paths the command reads or enumerates
+        "write_target_paths"?: String,     // paths the command writes, creates, or destroys
+        "exec_target_paths"?: String,      // paths executed as a script
+        "unresolved_target"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated
+
         // Agentic - Multi-Turn Context (optional)
         "conversation_turn"?: Long,
         "multi_turn_detection"?: Bool,
@@ -2332,6 +2353,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \\n); Cedar \`like\` is anchored so patterns start with "*": sub-tree "*\\n/etc/*", bare dir "*\\n/etc\\n*", exact "*\\n/etc/passwd\\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,
@@ -3376,6 +3404,11 @@ export const AGENT_OPS_CONTEXT = {
                 { "key": "encoded_count", "type": "number", "required": false, "description": "Number of encoded segments found in tool arguments" },
                 { "key": "encoded_score", "type": "number", "required": false, "description": "Risk score for encoded injection in tool arguments (0-100)." },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "path", "type": "string", "required": false, "description": "File path targeted by the tool call" },
                 { "key": "conversation_turn", "type": "number", "required": false, "description": "Current conversation turn number" },
                 { "key": "multi_turn_detection", "type": "boolean", "required": false, "description": "Whether multi-turn injection patterns were detected across tool calls" },
@@ -3698,6 +3731,11 @@ export const AI_GATEWAY_CONTEXT = {
                 { "key": "tool_is_sensitive", "type": "boolean", "required": false, "description": "Tool sensitivity flag" },
                 { "key": "tool_is_builtin", "type": "boolean", "required": false, "description": "Built-in tool flag" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\". NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths). NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments. NOTE (AI Gateway): declared ahead of runtime emission — the gateway does not populate this until the bash classifier is wired (#173); policies validate now but will not match in the interim." },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether server is from verified registry" },
                 { "key": "violence_score", "type": "number", "required": false, "description": "Violence content score (0-100)" },
                 { "key": "weapons_score", "type": "number", "required": false, "description": "Weapons content score (0-100)" },
@@ -4113,6 +4151,11 @@ export const GUARDRAILS_CONTEXT = {
                 { "key": "mcp_input_request_types", "type": "array", "required": false, "description": "Threat shapes found in the input request (e.g. [\'credential_elicitation\', \'sampling_injection\', \'root_probe\']). Use .contains() to block a specific shape" },
                 { "key": "mcp_input_request_methods", "type": "array", "required": false, "description": "MCP methods the server asked the client to perform (e.g. [\'elicitation/create\', \'sampling/createMessage\', \'roots/list\']). Independent of content, so a policy can refuse a capability outright — e.g. mcp_input_request_methods.contains(\"sampling/createMessage\") on an unverified server — rather than only reacting to a payload that was successfully classified" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "cross_origin_detected", "type": "boolean", "required": false, "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries" },
                 { "key": "cross_origin_type", "type": "string", "required": false, "description": "Type of cross-origin escalation detected in tool call" },
                 { "key": "cross_origin_score", "type": "number", "required": false, "description": "Risk score for cross-origin escalation in tool calls (0-100)" },
@@ -4432,6 +4475,11 @@ export const OVERWATCH_CONTEXT = {
                 { "key": "sequence_risk", "type": "number", "required": false, "description": "Behavioral sequence risk score (0-100)" },
                 { "key": "mcp_server_verified", "type": "boolean", "required": false, "description": "Whether the MCP server is from a verified registry" },
                 { "key": "tool_operation_classes", "type": "array", "required": false, "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: \'readonly\', \'write_enabling\', \'execute_enabling\', \'network_access\', \'unknown\'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. \'unknown\' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy." },
+                { "key": "resolved_target_paths", "type": "string", "required": false, "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with \'*\': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." },
+                { "key": "read_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "write_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"." },
+                { "key": "exec_target_paths", "type": "string", "required": false, "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with \'*\' (see resolved_target_paths)." },
+                { "key": "unresolved_target", "type": "boolean", "required": false, "description": "True when a shell command\'s target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." },
                 { "key": "package_install_detected", "type": "boolean", "required": false, "description": "True iff a package install/download command was recognized in the tool call arguments." },
                 { "key": "malicious_package_detected", "type": "boolean", "required": false, "description": "True iff any referenced package has a known-malicious (MAL-) OSV advisory." },
                 { "key": "malicious_package_score", "type": "number", "required": false, "description": "100 when a malicious package was detected, 0 otherwise." },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.34",
+  "version": "2.2.36",
   "engines": {
     "node": ">=18"
   },

package/_schemas/sentry/templates/defaults/file_safety.cedar

@@ -1,31 +0,0 @@
-// =============================================================================
-// File & Attachment Safety (Default)
-// =============================================================================
-// Blocks file uploads to AI chat services when document content contains
-// secrets. PII in uploads is handled by the canonical privacy.* templates
-// (defaults/pii*.cedar), which scope to upload_file.
-//
-// Context keys consumed:
-//   - secrets_detected: Bool
-//
-// Compliance:
-//   - NIST 800-53 SC-28; GDPR Art. 32
-//
-// Category:  file-safety
-// Namespace: Sentry
-// =============================================================================
-
-@id("file-safety.block-upload-secrets")
-@name("Block file uploads with secrets")
-@description("Blocks upload_file when secrets_detected is true.")
-@severity("critical")
-@tags("category:file-safety,threat:secrets,detection:rule,surface:upload-file,owasp:llm06")
-@reject_message("File upload blocked: secrets or credentials detected in document content.")
-forbid (
-    principal,
-    action == Sentry::Action::"upload_file",
-    resource
-)
-when {
-    context has secrets_detected && context.secrets_detected == true
-};