@highflame/policy 2.2.35 → 2.2.36

package/dist/guardrails-detectors.gen.js

@@ -443,7 +443,7 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }],
+        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths the command touches, any capability. Every value is \\n-anchored and Cedar `like` is full-string anchored, so patterns MUST start with `*`: anchored sub-tree `*\\n/etc/*` (matches only paths under /etc, unlike the loose `*/etc/*` which also hits a project `etc/` dir at any depth); bare directory target `*\\n/etc\\n*` (e.g. `rm -rf /etc`, no trailing slash); exact file `*\\n/etc/passwd\\n*`. Purely lexical resolution (cwd-join + path.Clean; quoting/escape/wrapper/cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys (redirects, writers, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i). \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["command_injection", "unauthorized_access"],
         exampleAttacks: [{ title: "Destructive shell op", vulnerabilityId: "command_injection", snippet: "rm -rf / --no-preserve-root", expectedSignal: {} }],
@@ -479,6 +479,7 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "encoded_count": ["encoded_injection"],
     "encoded_score": ["encoded_injection"],
     "encoded_types": ["encoded_injection"],
+    "exec_target_paths": ["bash_ast_classifier"],
     "factuality_score": ["hallucination"],
     "file_extension": ["file_metadata"],
     "file_name": ["file_metadata"],
@@ -549,6 +550,8 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
     "prompt_injection_score": ["deepcontext"],
+    "read_target_paths": ["bash_ast_classifier"],
+    "resolved_target_paths": ["bash_ast_classifier"],
     "rpm_exceeded": ["budget_checker"],
     "rpm_remaining_pct": ["budget_checker"],
     "rug_pull_detected": ["rug_pull"],
@@ -590,8 +593,10 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "topic_confidence": ["topic"],
     "tpm_exceeded": ["budget_checker"],
     "tpm_remaining_pct": ["budget_checker"],
+    "unresolved_target": ["bash_ast_classifier"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["bash_ast_classifier"],
 };
 export function guardrailsDetectorById(id) {
     return GUARDRAILS_DETECTORS.find((d) => d.id === id);

package/dist/overwatch-context.gen.d.ts

@@ -10,6 +10,7 @@ export declare const OverwatchContextKey: {
     readonly Cwd: "cwd";
     readonly DetectedThreats: "detected_threats";
     readonly Event: "event";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly ExitCode: "exit_code";
     readonly HateSpeechScore: "hate_speech_score";
     readonly HighestSeverity: "highest_severity";
@@ -50,6 +51,8 @@ export declare const OverwatchContextKey: {
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
     readonly PromptText: "prompt_text";
+    readonly ReadTargetPaths: "read_target_paths";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly ResponseContent: "response_content";
     readonly Role: "role";
     readonly RugPullDetected: "rug_pull_detected";
@@ -84,14 +87,16 @@ export declare const OverwatchContextKey: {
     readonly ToolPoisoningDetected: "tool_poisoning_detected";
     readonly ToolPoisoningScore: "tool_poisoning_score";
     readonly ToolRiskScore: "tool_risk_score";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly UserEmail: "user_email";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
     readonly WorkspaceRoot: "workspace_root";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof OverwatchContextKey];
 /**
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "user_email", "violence_score", "weapons_score", "workspace_root"];
+export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];

package/dist/overwatch-context.gen.js

@@ -12,6 +12,7 @@ export const OverwatchContextKey = {
     Cwd: 'cwd',
     DetectedThreats: 'detected_threats',
     Event: 'event',
+    ExecTargetPaths: 'exec_target_paths',
     ExitCode: 'exit_code',
     HateSpeechScore: 'hate_speech_score',
     HighestSeverity: 'highest_severity',
@@ -52,6 +53,8 @@ export const OverwatchContextKey = {
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
     PromptText: 'prompt_text',
+    ReadTargetPaths: 'read_target_paths',
+    ResolvedTargetPaths: 'resolved_target_paths',
     ResponseContent: 'response_content',
     Role: 'role',
     RugPullDetected: 'rug_pull_detected',
@@ -86,10 +89,12 @@ export const OverwatchContextKey = {
     ToolPoisoningDetected: 'tool_poisoning_detected',
     ToolPoisoningScore: 'tool_poisoning_score',
     ToolRiskScore: 'tool_risk_score',
+    UnresolvedTarget: 'unresolved_target',
     UserEmail: 'user_email',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
     WorkspaceRoot: 'workspace_root',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for Overwatch.
@@ -101,6 +106,7 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.Cwd,
     OverwatchContextKey.DetectedThreats,
     OverwatchContextKey.Event,
+    OverwatchContextKey.ExecTargetPaths,
     OverwatchContextKey.ExitCode,
     OverwatchContextKey.HateSpeechScore,
     OverwatchContextKey.HighestSeverity,
@@ -141,6 +147,8 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.PrivilegeScope,
     OverwatchContextKey.ProfanityScore,
     OverwatchContextKey.PromptText,
+    OverwatchContextKey.ReadTargetPaths,
+    OverwatchContextKey.ResolvedTargetPaths,
     OverwatchContextKey.ResponseContent,
     OverwatchContextKey.Role,
     OverwatchContextKey.RugPullDetected,
@@ -175,8 +183,10 @@ export const OverwatchContextKeys = [
     OverwatchContextKey.ToolPoisoningDetected,
     OverwatchContextKey.ToolPoisoningScore,
     OverwatchContextKey.ToolRiskScore,
+    OverwatchContextKey.UnresolvedTarget,
     OverwatchContextKey.UserEmail,
     OverwatchContextKey.ViolenceScore,
     OverwatchContextKey.WeaponsScore,
     OverwatchContextKey.WorkspaceRoot,
+    OverwatchContextKey.WriteTargetPaths,
 ];

package/dist/overwatch-detectors.gen.js

@@ -107,7 +107,7 @@ export const OVERWATCH_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 2,
-        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }],
+        emits: [{ name: "tool_operation_classes", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Operation classes parsed from the command (e.g. file_delete, network_egress, privilege_escalation)." }, { name: "resolved_target_paths", type: "String", modifiable: false, description: "Newline-delimited (leading+trailing \\n) union of statically-resolved absolute target paths the command touches, any capability. Every value is \\n-anchored and Cedar `like` is full-string anchored, so patterns MUST start with `*`: anchored sub-tree `*\\n/etc/*` (matches only paths under /etc, unlike the loose `*/etc/*` which also hits a project `etc/` dir at any depth); bare directory target `*\\n/etc\\n*` (e.g. `rm -rf /etc`, no trailing slash); exact file `*\\n/etc/passwd\\n*`. Purely lexical resolution (cwd-join + path.Clean; quoting/escape/wrapper/cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated." }, { name: "read_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command reads or enumerates. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "write_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths the command writes, creates, or destroys (redirects, writers, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i). \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "exec_target_paths", type: "String", modifiable: false, description: "Newline-delimited resolved absolute paths executed as a script. \\n-anchored — match with `like` patterns starting with `*` (see resolved_target_paths)." }, { name: "unresolved_target", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["command_injection", "unauthorized_access"],
         exampleAttacks: [{ title: "Destructive shell op", vulnerabilityId: "command_injection", snippet: "rm -rf / --no-preserve-root", expectedSignal: {} }],
@@ -201,6 +201,7 @@ export const OVERWATCH_DETECTORS = [
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const OVERWATCH_FIELD_TO_DETECTORS = {
     "crime_score": ["toxicity"],
+    "exec_target_paths": ["bash_ast_classifier"],
     "hate_speech_score": ["toxicity"],
     "indirect_injection_score": ["deepcontext"],
     "injection_deep_context_score": ["deepcontext"],
@@ -235,6 +236,8 @@ export const OVERWATCH_FIELD_TO_DETECTORS = {
     "pii_score": ["pii"],
     "pii_types": ["pii"],
     "profanity_score": ["toxicity"],
+    "read_target_paths": ["bash_ast_classifier"],
+    "resolved_target_paths": ["bash_ast_classifier"],
     "rug_pull_detected": ["rug_pull"],
     "rug_pull_score": ["rug_pull"],
     "secret_count": ["secrets"],
@@ -260,8 +263,10 @@ export const OVERWATCH_FIELD_TO_DETECTORS = {
     "tool_poisoning_detected": ["tool_poisoning"],
     "tool_poisoning_score": ["tool_poisoning"],
     "tool_risk_score": ["tool_risk"],
+    "unresolved_target": ["bash_ast_classifier"],
     "violence_score": ["toxicity"],
     "weapons_score": ["toxicity"],
+    "write_target_paths": ["bash_ast_classifier"],
 };
 export function overwatchDetectorById(id) {
     return OVERWATCH_DETECTORS.find((d) => d.id === id);