@highflame/policy 2.2.35 → 2.2.37

package/_schemas/guardrails/templates/profiles/advanced_detection/pii.cedar

@@ -22,7 +22,8 @@
 @reject_message("Content blocked: national identifier (SSN, passport, or driver's license) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -44,7 +45,8 @@ when {
 @reject_message("Content blocked: credit card number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -63,7 +65,8 @@ when {
 @reject_message("Content blocked: bank account (IBAN) number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -85,7 +88,8 @@ when {
 @reject_message("Content blocked: medical record identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -109,7 +113,8 @@ when {
 @reject_message("Content blocked: tax identifier (ITIN or EIN) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -129,7 +134,8 @@ when {
 @reject_message("Content blocked: credential or API key patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -160,7 +166,8 @@ when {
 @reject_message("Content blocked: cryptocurrency wallet address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -179,7 +186,8 @@ when {
 @reject_message("Content blocked: personal name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -198,7 +206,8 @@ when {
 @reject_message("Content blocked: email address patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -217,7 +226,8 @@ when {
 @reject_message("Content blocked: phone number patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -236,7 +246,8 @@ when {
 @reject_message("Content blocked: date or time patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -258,7 +269,8 @@ when {
 @reject_message("Content blocked: URL patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -277,7 +289,8 @@ when {
 @reject_message("Content blocked: street address or location patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -298,7 +311,8 @@ when {
 @reject_message("Content blocked: organization name patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -317,7 +331,8 @@ when {
 @reject_message("Content blocked: occupation patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -336,7 +351,8 @@ when {
 @reject_message("Content blocked: username patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -355,7 +371,8 @@ when {
 @reject_message("Content blocked: employee or customer identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -376,7 +393,8 @@ when {
 @reject_message("Content blocked: device or network identifier patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -403,7 +421,8 @@ when {
 @reject_message("Content blocked: vehicle identifier (VIN or plate) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -423,7 +442,8 @@ when {
 @reject_message("Content blocked: salary or financial amount patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {
@@ -444,7 +464,8 @@ when {
 @reject_message("Content blocked: sensitive attribute (ethnicity, religion, etc.) patterns detected.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool", Guardrails::Action::"read_file", Guardrails::Action::"write_file"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/advanced_detection/secrets.cedar

@@ -18,7 +18,7 @@
 
 @id("data-protection.advanced-block-high-risk-secrets")
 @name("Block high-risk credential types")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains a cloud, GitHub, SSH, or database credential.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: high-risk credentials detected (cloud keys, GitHub tokens, SSH keys, or database URLs).")
@@ -26,6 +26,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"
@@ -48,7 +49,7 @@ when {
 
 @id("data-protection.advanced-block-api-tokens")
 @name("Block API keys and bearer tokens")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secret_types contains api_key, bearer_token, jwt_token, or OAuth credentials.")
 @severity("high")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Content blocked: API keys, bearer tokens, or OAuth credentials detected.")
@@ -56,6 +57,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"

package/_schemas/guardrails/templates/profiles/chat_assistant/security.cedar

@@ -18,13 +18,14 @@
 
 @id("security.chat-block-injection")
 @name("Block injection (chat profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 71 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Prompt blocked: prompt injection detected with high confidence (chat profile).")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {
@@ -33,13 +34,13 @@ when {
 
 @id("security.chat-block-jailbreak")
 @name("Block jailbreak (chat profile)")
-@description("Blocks process_prompt when jailbreak_score >= 66 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when jailbreak_score >= 66 (lower threshold for public chat).")
 @severity("high")
 @tags("category:security,threat:jailbreak,detection:ml,owasp:llm02")
 @reject_message("Prompt blocked: jailbreak attempt detected with high confidence (chat profile).")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/chat_assistant/trust_safety.cedar

@@ -19,13 +19,13 @@
 
 @id("trust-safety.chat-block-toxicity")
 @name("Block toxicity (chat profile)")
-@description("Blocks process_prompt when any toxicity score is >= 71 (lower threshold for public chat).")
+@description("Blocks process_prompt and process_response when any toxicity score is >= 71 (lower threshold for public chat).")
 @severity("critical")
 @tags("category:trust-safety,threat:harmful,threat:hate-speech,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: toxic content detected at the chat-profile threshold.")
 forbid (
     principal,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -37,13 +37,14 @@ when {
 
 @id("trust-safety.chat-block-restricted-topics")
 @name("Block restricted topics (chat profile)")
-@description("Blocks process_prompt and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
+@description("Blocks process_prompt, process_response, and call_tool when topic_confidence >= 71 and content_topics contains a restricted category.")
 @severity("high")
 @tags("category:trust-safety,threat:harmful,detection:ml,compliance:eu-ai-act")
 @reject_message("Prompt blocked: content discusses a topic restricted for chat assistants.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/data_pipeline/data_protection.cedar

@@ -17,7 +17,7 @@
 
 @id("data-protection.data-pipeline-block-secrets")
 @name("Block secrets in data pipeline")
-@description("Blocks process_prompt, call_tool, read_file, and write_file when secrets_detected is true.")
+@description("Blocks process_prompt, process_response, call_tool, read_file, and write_file when secrets_detected is true.")
 @severity("critical")
 @tags("category:data-protection,threat:secrets,detection:rule,owasp:llm06")
 @reject_message("Request blocked: secrets detected in a data pipeline — any credential exposure is unacceptable here.")
@@ -25,6 +25,7 @@ forbid (
     principal,
     action in [
         Guardrails::Action::"process_prompt",
+        Guardrails::Action::"process_response",
         Guardrails::Action::"call_tool",
         Guardrails::Action::"read_file",
         Guardrails::Action::"write_file"

package/_schemas/guardrails/templates/profiles/data_pipeline/security.cedar

@@ -17,13 +17,14 @@
 
 @id("security.data-pipeline-block-injection")
 @name("Block pipeline injection (data-pipeline profile)")
-@description("Blocks process_prompt and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
+@description("Blocks process_prompt, process_response, and call_tool when injection_score >= 66 (lower threshold for data pipelines).")
 @severity("high")
 @tags("category:security,threat:injection,detection:ml,owasp:llm01")
 @reject_message("Request blocked: prompt injection detected at the data-pipeline threshold — RAG inputs are high-risk for indirect injection.")
 forbid (
     principal,
-    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"call_tool"],
+    action in [Guardrails::Action::"process_prompt",
+Guardrails::Action::"process_response", Guardrails::Action::"call_tool"],
     resource
 )
 when {

package/_schemas/guardrails/templates/profiles/multi_agent/agent_trust.cedar

@@ -93,13 +93,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-injection")
 @name("Block injection on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and injection_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and injection_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,owasp:llm01")
+@tags("category:agent-identity,threat:injection,detection:ml,surface:process-prompt,surface:process-response,owasp:llm01")
 @reject_message("Prompt blocked: lower injection threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {
@@ -109,13 +109,13 @@ when {
 
 @id("agent-identity.multi-agent-autonomous-jailbreak")
 @name("Block jailbreak on autonomous agents (stricter)")
-@description("Blocks process_prompt when agent_type is \"autonomous\" and jailbreak_score >= 51.")
+@description("Blocks process_prompt and process_response when agent_type is \"autonomous\" and jailbreak_score >= 51.")
 @severity("high")
-@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,owasp:llm02")
+@tags("category:agent-identity,threat:jailbreak,detection:ml,surface:process-prompt,surface:process-response,owasp:llm02")
 @reject_message("Prompt blocked: lower jailbreak threshold applies to autonomous agents and was exceeded.")
 forbid (
     principal is Guardrails::Agent,
-    action == Guardrails::Action::"process_prompt",
+    action in [Guardrails::Action::"process_prompt", Guardrails::Action::"process_response"],
     resource
 )
 when {

package/_schemas/guardrails/templates/templates.json

@@ -482,15 +482,6 @@
         "compliance:hipaa"
       ]
     },
-    {
-      "id": "security.advanced-block-critical-severity",
-      "name": "Advanced Detection — Threat Severity",
-      "description": "Catch-all that blocks any content flagged as critical severity by any detector.",
-      "category": "security",
-      "file": "profiles/advanced_detection/threat_severity.cedar",
-      "severity": "critical",
-      "tags": ["category:security", "detection:aggregate", "posture:catch-all"]
-    },
     {
       "id": "agent-security.param-validation",
       "name": "Action Parameter Validation",

package/_schemas/overwatch/context.json

@@ -680,6 +680,36 @@
           "required": false,
           "description": "All operation classes observed in the tool call, emitted by the AST command classifiers. Subset of: 'readonly', 'write_enabling', 'execute_enabling', 'network_access', 'unknown'. A single command can carry several classes; combine with contains() to match shapes — e.g. tool_operation_classes.contains(\"network_access\") && tool_operation_classes.contains(\"execute_enabling\") catches download-and-run (curl | sh). Used by the Bash Operation Classes template. 'unknown' appears when any unrecognized or variable-expanded command was seen and should be treated as deny-worthy."
         },
+        {
+          "key": "resolved_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited (leading+trailing \\n) union of the statically-resolved absolute target paths a shell command touches, any capability, emitted by the bash AST detector. Cedar like is full-string anchored and every value starts with the \\n delimiter, so patterns must begin with '*': anchored sub-tree \"*\\n/etc/*\" (matches only paths under /etc, unlike the loose \"*/etc/*\" which also hits a project etc/ dir at any depth), bare directory \"*\\n/etc\\n*\" (e.g. rm -rf /etc, no trailing slash), exact file \"*\\n/etc/passwd\\n*\". Resolution is purely lexical (cwd-join + path.Clean; quoting, escapes, wrappers, cd/VAR/bash -c normalized); remote endpoints and dynamic operands are never fabricated."
+        },
+        {
+          "key": "read_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command reads or enumerates, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "write_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command writes, creates, or destroys (redirects, cp/mv/dd, curl/wget -o, scp/rsync local dest, tar/unzip/cpio extraction, yq -i), emitted by the bash AST detector. \\n-anchored: e.g. write_target_paths like \"*\\n/etc/cron.d/*\"."
+        },
+        {
+          "key": "exec_target_paths",
+          "type": "string",
+          "required": false,
+          "description": "Newline-delimited resolved absolute paths a shell command executes as a script, emitted by the bash AST detector. \\n-anchored: match with like patterns that begin with '*' (see resolved_target_paths)."
+        },
+        {
+          "key": "unresolved_target",
+          "type": "boolean",
+          "required": false,
+          "description": "True when a shell command's target hid behind a variable, glob, command substitution, or inline shell code that static analysis could not resolve, or when the 64-path / 4096-byte path-list cap truncated the results. Benign dev traffic sets this frequently (variables, globs, and command substitution are everywhere, and the truncation cap trips it too), so it is NOT a deny signal on its own — combine it with a path or operation match, and reserve a blanket deny-on-unresolved rule for high-assurance or allowlisted environments."
+        },
         {
           "key": "package_install_detected",
           "type": "boolean",

package/_schemas/overwatch/schema.cedarschema

@@ -246,6 +246,13 @@ action call_tool appliesTo {
     // --- Tool Operation Classifier ---
     tool_operation_classes?: Set<String>,  // subset of {"readonly", "write_enabling", "execute_enabling", "network_access", "unknown"}
 
+    // --- Bash AST resolved target paths (#411 / CAP-DET-007) — newline-delimited (leading+trailing \n); Cedar `like` is anchored so patterns start with "*": sub-tree "*\n/etc/*", bare dir "*\n/etc\n*", exact "*\n/etc/passwd\n*" ---
+    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability
+    read_target_paths?: String,      // paths the command reads or enumerates
+    write_target_paths?: String,     // paths the command writes, creates, or destroys
+    exec_target_paths?: String,      // paths executed as a script
+    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code
+
     // --- Session Detection History (cross-turn sticky flags) ---
     session_pii_detected?: Bool,
     session_pii_types?: Set<String>,

package/dist/agent_ops-context.gen.d.ts

@@ -41,6 +41,7 @@ export declare const AgentOpsContextKey: {
     readonly EncodedTypes: "encoded_types";
     readonly Event: "event";
     readonly ExecAllowlist: "exec_allowlist";
+    readonly ExecTargetPaths: "exec_target_paths";
     readonly FactualityScore: "factuality_score";
     readonly FlowCompartments: "flow_compartments";
     readonly FlowConfidentiality: "flow_confidentiality";
@@ -108,7 +109,9 @@ export declare const AgentOpsContextKey: {
     readonly PrincipalCompartments: "principal_compartments";
     readonly PrivilegeScope: "privilege_scope";
     readonly ProfanityScore: "profanity_score";
+    readonly ReadTargetPaths: "read_target_paths";
     readonly RequestId: "request_id";
+    readonly ResolvedTargetPaths: "resolved_target_paths";
     readonly Role: "role";
     readonly RpmExceeded: "rpm_exceeded";
     readonly RpmRemainingPct: "rpm_remaining_pct";
@@ -158,15 +161,17 @@ export declare const AgentOpsContextKey: {
     readonly TopicConfidence: "topic_confidence";
     readonly TpmExceeded: "tpm_exceeded";
     readonly TpmRemainingPct: "tpm_remaining_pct";
+    readonly UnresolvedTarget: "unresolved_target";
     readonly UserEmail: "user_email";
     readonly ViolenceScore: "violence_score";
     readonly WeaponsScore: "weapons_score";
     readonly WorkspaceRoot: "workspace_root";
     readonly WritablePaths: "writable_paths";
+    readonly WriteTargetPaths: "write_target_paths";
 };
 export type AgentOpsContextKey = (typeof AgentOpsContextKey)[keyof typeof AgentOpsContextKey];
 /**
  * The full set of authorable context attribute keys for AgentOps.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "request_id", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths"];
+export declare const AgentOpsContextKeys: readonly ["agent_framework", "agent_id", "agent_publisher", "agent_trust_level", "agent_type", "budget_exceeded", "budget_remaining_pct", "code_languages", "code_ratio", "command_injection_detected", "command_injection_score", "command_injection_type", "contains_code", "contains_non_ascii", "content_safety_blocked", "content_safety_score", "content_topics", "content_type", "conversation_turn", "crime_score", "cross_origin_detected", "cross_origin_score", "cross_origin_type", "cwd", "detected_language", "detected_script", "detected_threats", "detector_count", "direction", "egress_hosts", "encoded_content_detected", "encoded_count", "encoded_score", "encoded_types", "event", "exec_allowlist", "exec_target_paths", "factuality_score", "flow_compartments", "flow_confidentiality", "flow_data_types", "flow_integrity", "flow_origins", "flow_resolution_status", "flow_sink", "flow_sink_effects", "flow_sink_is_external", "hallucination_score", "hate_speech_score", "highest_severity", "identity_type", "indirect_injection_score", "indirect_injection_type", "injection_deep_context_score", "injection_pulse_score", "injection_score", "injection_type", "invisible_chars_detected", "invisible_chars_score", "is_english", "is_latin_script", "isolation_tier", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "keyword_categories", "keyword_count", "keyword_matched", "language_confidence", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_risk_type", "mcp_server", "mcp_server_verified", "mcp_tool", "mechanism_capabilities", "model_name", "model_provider", "multi_turn_detection", "network_egress", "package_check_status", "package_install_detected", "param_type_violation", "param_type_violations", "path", "path_traversal_detected", "path_traversal_severity", "path_traversal_type", "pattern_type", "phishing_detected", "pii_count", "pii_detected", "pii_score", "pii_types", "principal", "principal_clearances", "principal_compartments", "privilege_scope", "profanity_score", "read_target_paths", "request_id", "resolved_target_paths", "role", "rpm_exceeded", "rpm_remaining_pct", "rug_pull_detected", "rug_pull_score", "rug_pull_type", "script_confidence", "secret_count", "secret_types", "secrets_detected", "sentiment_score", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_max_sensitivity", "session_original_request", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "sql_injection_detected", "sql_injection_score", "sql_injection_type", "surface", "suspicious_pattern", "threat_categories", "threat_count", "timestamp", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_poisoning_type", "tool_risk_score", "topic_confidence", "tpm_exceeded", "tpm_remaining_pct", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "writable_paths", "write_target_paths"];

package/dist/agent_ops-context.gen.js

@@ -43,6 +43,7 @@ export const AgentOpsContextKey = {
     EncodedTypes: 'encoded_types',
     Event: 'event',
     ExecAllowlist: 'exec_allowlist',
+    ExecTargetPaths: 'exec_target_paths',
     FactualityScore: 'factuality_score',
     FlowCompartments: 'flow_compartments',
     FlowConfidentiality: 'flow_confidentiality',
@@ -110,7 +111,9 @@ export const AgentOpsContextKey = {
     PrincipalCompartments: 'principal_compartments',
     PrivilegeScope: 'privilege_scope',
     ProfanityScore: 'profanity_score',
+    ReadTargetPaths: 'read_target_paths',
     RequestId: 'request_id',
+    ResolvedTargetPaths: 'resolved_target_paths',
     Role: 'role',
     RpmExceeded: 'rpm_exceeded',
     RpmRemainingPct: 'rpm_remaining_pct',
@@ -160,11 +163,13 @@ export const AgentOpsContextKey = {
     TopicConfidence: 'topic_confidence',
     TpmExceeded: 'tpm_exceeded',
     TpmRemainingPct: 'tpm_remaining_pct',
+    UnresolvedTarget: 'unresolved_target',
     UserEmail: 'user_email',
     ViolenceScore: 'violence_score',
     WeaponsScore: 'weapons_score',
     WorkspaceRoot: 'workspace_root',
     WritablePaths: 'writable_paths',
+    WriteTargetPaths: 'write_target_paths',
 };
 /**
  * The full set of authorable context attribute keys for AgentOps.
@@ -207,6 +212,7 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.EncodedTypes,
     AgentOpsContextKey.Event,
     AgentOpsContextKey.ExecAllowlist,
+    AgentOpsContextKey.ExecTargetPaths,
     AgentOpsContextKey.FactualityScore,
     AgentOpsContextKey.FlowCompartments,
     AgentOpsContextKey.FlowConfidentiality,
@@ -274,7 +280,9 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.PrincipalCompartments,
     AgentOpsContextKey.PrivilegeScope,
     AgentOpsContextKey.ProfanityScore,
+    AgentOpsContextKey.ReadTargetPaths,
     AgentOpsContextKey.RequestId,
+    AgentOpsContextKey.ResolvedTargetPaths,
     AgentOpsContextKey.Role,
     AgentOpsContextKey.RpmExceeded,
     AgentOpsContextKey.RpmRemainingPct,
@@ -324,9 +332,11 @@ export const AgentOpsContextKeys = [
     AgentOpsContextKey.TopicConfidence,
     AgentOpsContextKey.TpmExceeded,
     AgentOpsContextKey.TpmRemainingPct,
+    AgentOpsContextKey.UnresolvedTarget,
     AgentOpsContextKey.UserEmail,
     AgentOpsContextKey.ViolenceScore,
     AgentOpsContextKey.WeaponsScore,
     AgentOpsContextKey.WorkspaceRoot,
     AgentOpsContextKey.WritablePaths,
+    AgentOpsContextKey.WriteTargetPaths,
 ];