@highflame/policy 2.2.40 → 2.2.41

package/dist/agent_ops-defaults.gen.js

@@ -1648,8 +1648,23 @@ const AGENT_OPS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// =========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -1676,7 +1691,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -1684,7 +1699,12 @@ forbid (
     principal,
     action == AgentOps::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const AGENT_OPS_SECURITY_CHAT_ASSISTANT_CEDAR = `// =============================================================================
 // Chat Assistant — Security
@@ -4460,8 +4480,8 @@ const AGENT_OPS_ORGANIZATION_DENY_BASELINE_CEDAR = `// =========================
 // =============================================================================
 
 @id("organization.deny-baseline")
-@name("Block all actions (deny baseline)")
-@description("Blocks all actions; pair with scoped permit rules for a deny-by-default posture.")
+@name("Block all actions (kill switch)")
+@description("Blocks all actions unconditionally. A kill switch, not a baseline: forbid beats permit in Cedar, so this also disables every permit in the set.")
 @severity("high")
 @tags("category:organization,posture:deny-default,scope:org-wide")
 @reject_message("Request blocked: this organization uses a deny-by-default baseline — only explicitly permitted actions are allowed.")

package/dist/ai_gateway-defaults.gen.js

@@ -370,8 +370,23 @@ const AI_GATEWAY_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// ========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -398,7 +413,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -406,7 +421,12 @@ forbid (
     principal,
     action == AIGateway::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const AI_GATEWAY_TOOLS_MCP_TOOL_PERMISSIONS_CEDAR = `// =============================================================================
 // MCP Tool Permissions

package/dist/ai_gateway-detectors.gen.d.ts

@@ -1,5 +1,5 @@
 import type { DetectorCard } from './detector-card-types.gen';
-export declare const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.0.0";
+export declare const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.1.0";
 export declare const AI_GATEWAY_DETECTORS: readonly DetectorCard[];
 export declare const AI_GATEWAY_FIELD_TO_DETECTORS: Readonly<Record<string, readonly string[]>>;
 export declare function aiGatewayDetectorById(id: string): DetectorCard | undefined;

package/dist/ai_gateway-detectors.gen.js

@@ -1,4 +1,4 @@
-export const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.0.0";
+export const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.1.0";
 export const AI_GATEWAY_DETECTORS = [
     {
         id: "injection",
@@ -177,11 +177,25 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI install via MCP bash tool", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
     },
+    {
+        id: "package_reputation",
+        displayName: "Package Reputation (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Install of a package carrying a malicious advisory", vulnerabilityId: "supply_chain", snippet: "pip install evil-pkg", expectedSignal: { "malicious_package_detected": true } }],
+    },
 ];
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
@@ -196,20 +210,20 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "jailbreak_score": ["injection"],
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
-    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_detected": ["malicious_package", "package_reputation"],
     "malicious_package_score": ["malicious_package"],
-    "malicious_packages": ["malicious_package"],
+    "malicious_packages": ["malicious_package", "package_reputation"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_risk_score": ["mcp_risk"],
     "mcp_server": ["mcp_risk"],
     "mcp_server_verified": ["mcp_risk"],
     "mcp_tool": ["mcp_risk"],
-    "package_advisory_count": ["malicious_package"],
+    "package_advisory_count": ["package_reputation"],
     "package_check_status": ["malicious_package"],
-    "package_ecosystems": ["malicious_package"],
+    "package_ecosystems": ["package_reputation"],
     "package_install_detected": ["malicious_package"],
-    "package_names": ["malicious_package"],
-    "package_risk_score": ["malicious_package"],
+    "package_names": ["package_reputation"],
+    "package_risk_score": ["package_reputation"],
     "packages_checked": ["malicious_package"],
     "pattern_type": ["action_pattern"],
     "pii_count": ["pii"],

package/dist/guardrails-defaults.gen.js

@@ -1193,8 +1193,23 @@ const GUARDRAILS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// ========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -1221,7 +1236,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -1229,7 +1244,12 @@ forbid (
     principal,
     action == Guardrails::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const GUARDRAILS_SECURITY_CHAT_ASSISTANT_CEDAR = `// =============================================================================
 // Chat Assistant — Security

package/dist/guardrails-detectors.gen.d.ts

@@ -1,5 +1,5 @@
 import type { DetectorCard } from './detector-card-types.gen';
-export declare const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.3.0";
+export declare const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.4.0";
 export declare const GUARDRAILS_DETECTORS: readonly DetectorCard[];
 export declare const GUARDRAILS_FIELD_TO_DETECTORS: Readonly<Record<string, readonly string[]>>;
 export declare function guardrailsDetectorById(id: string): DetectorCard | undefined;

package/dist/guardrails-detectors.gen.js

@@ -1,4 +1,4 @@
-export const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.3.0";
+export const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.4.0";
 export const GUARDRAILS_DETECTORS = [
     {
         id: "pii",
@@ -401,11 +401,25 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI package install", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
     },
+    {
+        id: "package_reputation",
+        displayName: "Package Reputation (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Install of a package carrying a malicious advisory", vulnerabilityId: "supply_chain", snippet: "pip install evil-pkg", expectedSignal: { "malicious_package_detected": true } }],
+    },
     {
         id: "sentiment",
         displayName: "Sentiment Analysis",
@@ -510,9 +524,9 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
     "loop_tool": ["loop_detector"],
-    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_detected": ["malicious_package", "package_reputation"],
     "malicious_package_score": ["malicious_package"],
-    "malicious_packages": ["malicious_package"],
+    "malicious_packages": ["malicious_package", "package_reputation"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_input_request_detected": ["mcp_input_request"],
     "mcp_input_request_methods": ["mcp_input_request"],
@@ -527,12 +541,12 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "mip_label_name": ["file_metadata"],
     "multi_turn_detection": ["deepcontext"],
     "non_ascii_score": ["security"],
-    "package_advisory_count": ["malicious_package"],
+    "package_advisory_count": ["package_reputation"],
     "package_check_status": ["malicious_package"],
-    "package_ecosystems": ["malicious_package"],
+    "package_ecosystems": ["package_reputation"],
     "package_install_detected": ["malicious_package"],
-    "package_names": ["malicious_package"],
-    "package_risk_score": ["malicious_package"],
+    "package_names": ["package_reputation"],
+    "package_risk_score": ["package_reputation"],
     "packages_checked": ["malicious_package"],
     "path_traversal_detected": ["path_traversal"],
     "path_traversal_severity": ["path_traversal"],

package/dist/overwatch-defaults.gen.js

@@ -1547,7 +1547,23 @@ const OVERWATCH_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// =========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match allowed servers.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -1573,7 +1589,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -1581,7 +1597,11 @@ forbid (
     principal,
     action == Overwatch::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" || context.mcp_server == "playwright")
+};
 `;
 const OVERWATCH_TOOLS_MCP_TOOL_PERMISSIONS_CEDAR = `// =============================================================================
 // MCP Tool Permissions
@@ -1652,8 +1672,8 @@ const OVERWATCH_ORGANIZATION_DENY_BASELINE_CEDAR = `// =========================
 // =============================================================================
 
 @id("organization.deny-baseline")
-@name("Block all actions (deny baseline)")
-@description("Blocks all actions; pair with scoped permit rules for a deny-by-default posture.")
+@name("Block all actions (kill switch)")
+@description("Blocks all actions unconditionally. A kill switch, not a baseline: forbid beats permit in Cedar, so this also disables every permit in the set.")
 @severity("high")
 @tags("category:organization,posture:deny-default,scope:org-wide")
 @reject_message("Request blocked: this organization uses a deny-by-default baseline — only explicitly permitted actions are allowed.")

package/dist/overwatch-detectors.gen.d.ts

@@ -1,5 +1,5 @@
 import type { DetectorCard } from './detector-card-types.gen';
-export declare const OVERWATCH_DETECTOR_SPEC_VERSION = "1.0.0";
+export declare const OVERWATCH_DETECTOR_SPEC_VERSION = "1.1.0";
 export declare const OVERWATCH_DETECTORS: readonly DetectorCard[];
 export declare const OVERWATCH_FIELD_TO_DETECTORS: Readonly<Record<string, readonly string[]>>;
 export declare function overwatchDetectorById(id: string): DetectorCard | undefined;

package/dist/overwatch-detectors.gen.js

@@ -1,4 +1,4 @@
-export const OVERWATCH_DETECTOR_SPEC_VERSION = "1.0.0";
+export const OVERWATCH_DETECTOR_SPEC_VERSION = "1.1.0";
 export const OVERWATCH_DETECTORS = [
     {
         id: "injection",
@@ -191,11 +191,25 @@ export const OVERWATCH_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the tool call." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories found across all checked packages." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100)." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI package install", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }, { title: "Malicious npm package install", vulnerabilityId: "supply_chain", snippet: "npm install event-stream@3.3.6", expectedSignal: {} }],
     },
+    {
+        id: "package_reputation",
+        displayName: "Package Reputation (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Install of a package carrying a malicious advisory", vulnerabilityId: "supply_chain", snippet: "pip install evil-pkg", expectedSignal: { "malicious_package_detected": true } }],
+    },
 ];
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
@@ -215,20 +229,20 @@ export const OVERWATCH_FIELD_TO_DETECTORS = {
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
     "loop_tool": ["loop_detector"],
-    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_detected": ["malicious_package", "package_reputation"],
     "malicious_package_score": ["malicious_package"],
-    "malicious_packages": ["malicious_package"],
+    "malicious_packages": ["malicious_package", "package_reputation"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_risk_score": ["mcp_risk"],
     "mcp_server": ["mcp_risk"],
     "mcp_server_verified": ["mcp_risk"],
     "mcp_tool": ["mcp_risk"],
-    "package_advisory_count": ["malicious_package"],
+    "package_advisory_count": ["package_reputation"],
     "package_check_status": ["malicious_package"],
-    "package_ecosystems": ["malicious_package"],
+    "package_ecosystems": ["package_reputation"],
     "package_install_detected": ["malicious_package"],
-    "package_names": ["malicious_package"],
-    "package_risk_score": ["malicious_package"],
+    "package_names": ["package_reputation"],
+    "package_risk_score": ["package_reputation"],
     "packages_checked": ["malicious_package"],
     "pattern_type": ["action_pattern"],
     "pii_count": ["pii"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@highflame/policy",
-  "version": "2.2.40",
+  "version": "2.2.41",
   "engines": {
     "node": ">=18"
   },