@highflame/policy 2.2.40 → 2.2.42

package/dist/guardrails-defaults.gen.js

@@ -1193,8 +1193,23 @@ const GUARDRAILS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// ========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -1221,7 +1236,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -1229,7 +1244,12 @@ forbid (
     principal,
     action == Guardrails::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const GUARDRAILS_SECURITY_CHAT_ASSISTANT_CEDAR = `// =============================================================================
 // Chat Assistant — Security
@@ -3451,6 +3471,205 @@ when {
     !(["treasury@example.com", "payroll@example.com"].contains(context.action_params.recipient))
 };
 `;
+const GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Data Leakage
+// =============================================================================
+// Guards what the MODEL SAYS BACK, not what the user sends in.
+//
+// Every other guardrails template binds process_response alongside
+// process_prompt and the tool/file actions, which is right for a threat that
+// is the same in both directions. Data leakage is not that: the risk is
+// specific to egress, and a tenant who wants to police only their outputs had
+// no template to enable. That gap is why one deployed tenant hand-authored a
+// rule named "Block PII in outputs" and bound it to process_prompt — the only
+// action that covered responses before the direction split (ADR 0031).
+//
+// These rules bind process_response ALONE. That is the point: ADR 0031 created
+// the distinct trigger precisely so a policy could be scoped to one direction
+// from its head, and this profile is what that is for. Enabling it cannot
+// change how prompts are treated.
+//
+// Context keys consumed:
+//   - pii_detected:      Bool
+//   - pii_count:         Long
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure), OWASP LLM06
+//
+// Category:  privacy
+// Namespace: Guardrails
+// =============================================================================
+
+@id("privacy.output-block-pii")
+@name("Block PII in model responses")
+@description("Blocks process_response when the model's own output contains PII. Scoped to the response direction only — prompts are unaffected.")
+@severity("high")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_detected && context.pii_detected == true
+};
+
+// Bulk disclosure is a separate finding from a single incidental match: a
+// response carrying many distinct PII items is an exfiltration shape rather
+// than a mention, and is worth its own severity and message even though the
+// rule above already blocks it. Kept as a distinct rule so a tenant running
+// the first in monitor mode can still enforce on bulk.
+@id("privacy.output-block-bulk-pii")
+@name("Block bulk PII disclosure in model responses")
+@description("Blocks process_response when the output carries five or more PII items — a disclosure shape rather than an incidental mention.")
+@severity("critical")
+@tags("category:privacy,threat:data-leak,surface:process-response,detection:rule,owasp:llm06")
+@reject_message("Response blocked: the model's output contained bulk personal data.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has pii_count && context.pii_count >= 5
+};
+`;
+const GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR = `// =============================================================================
+// Output Protection — Harmful Content
+// =============================================================================
+// The companion to data_leakage.cedar: what the model says back, judged for
+// safety rather than for disclosure.
+//
+// Same scoping rule and same reason — process_response ALONE (ADR 0031). A
+// tenant enabling this is saying "hold my model's answers to a standard",
+// which is a different decision from "police what users send me", and the two
+// should be separately enableable.
+//
+// Thresholds match the org-wide toxicity defaults rather than tightening them.
+// An output profile that silently enforced stricter limits than the tenant's
+// existing prompt rules would surprise anyone comparing the two.
+//
+// Context keys consumed:
+//   - violence_score:     Long (0-100)
+//   - hate_speech_score:  Long (0-100)
+//   - sexual_score:       Long (0-100)
+//   - injection_score:    Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling), OWASP LLM01
+//
+// Category:  trust-safety
+// Namespace: Guardrails
+// =============================================================================
+
+@id("trust-safety.output-block-toxic")
+@name("Block toxic model responses")
+@description("Blocks process_response when the model's own output scores high for violence or hate speech.")
+@severity("high")
+@tags("category:trust-safety,threat:harmful,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as harmful.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has violence_score && context.violence_score >= 70 ||
+    context has hate_speech_score && context.hate_speech_score >= 70
+};
+
+@id("trust-safety.output-block-sexual")
+@name("Block sexual content in model responses")
+@description("Blocks process_response when the model's own output scores high for sexual content.")
+@severity("critical")
+@tags("category:trust-safety,threat:sexual,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output was flagged as explicit.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has sexual_score && context.sexual_score >= 91
+};
+`;
+const GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR = `// =============================================================================
+// Output Protection — Injection Carried Back
+// =============================================================================
+// Split from harmful_content.cedar because its category is \`security\`, not
+// \`trust-safety\`, and a template wrapper may only carry rules of its own
+// category (HFP-LINT-TMPL-006). The split is the honest outcome: this is a
+// different threat with a different owner, not a toxicity variant.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE.
+//
+// Context keys consumed:
+//   - injection_score:  Long (0-100)
+//
+// Compliance:
+//   - OWASP LLM05 (Improper Output Handling)
+//
+// Category:  security
+// Namespace: Guardrails
+// =============================================================================
+
+// Injection scored on an OUTPUT is a different finding from injection scored on
+// a prompt. On the way in it is a user attacking the model; on the way out it
+// is content the model is handing to the caller — a downstream agent, a
+// renderer, or another tool — which is OWASP LLM05's improper output handling.
+// Worth its own rule so the two can be tuned and reasoned about separately.
+@id("security.output-block-injection-carried-back")
+@name("Block injection payloads carried back in model responses")
+@description("Blocks process_response when the output itself scores as an injection payload — content the caller may execute or forward.")
+@severity("high")
+@tags("category:security,threat:injection,surface:process-response,detection:ml,owasp:llm05")
+@reject_message("Response blocked: the model's output contained an injection payload.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has injection_score && context.injection_score >= 80
+};
+`;
+const GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR = `// =============================================================================
+// Output Protection — Credentials
+// =============================================================================
+// Split from data_leakage.cedar: secrets are category \`data-protection\`, PII is
+// \`privacy\`, and a template wrapper may only carry rules of its own category
+// (HFP-LINT-TMPL-006). Relabelling one to fit the other would put a wrong
+// category on the wire, where it drives signals[] and the severity rollup.
+//
+// Same scoping rule as the rest of this profile — process_response ALONE, so a
+// tenant can police what the model says without touching what users send.
+//
+// Context keys consumed:
+//   - secrets_detected:  Bool
+//
+// Compliance:
+//   - OWASP LLM02 (Sensitive Information Disclosure)
+//
+// Category:  data-protection
+// Namespace: Guardrails
+// =============================================================================
+
+@id("data-protection.output-block-secrets")
+@name("Block secrets in model responses")
+@description("Blocks process_response when the model's own output contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller.")
+@severity("critical")
+@tags("category:data-protection,threat:secrets,surface:process-response,detection:rule,owasp:llm02")
+@reject_message("Response blocked: the model's output contained credentials.")
+forbid (
+    principal,
+    action == Guardrails::Action::"process_response",
+    resource
+)
+when {
+    context has secrets_detected && context.secrets_detected == true
+};
+`;
 // =============================================================================
 // CATEGORIES
 // =============================================================================
@@ -3790,6 +4009,42 @@ export const GUARDRAILS_TEMPLATES = [
         severity: 'high',
         tags: ['category:agent-security', 'surface:call-tool', 'aarm:r3', 'posture:deny-default'],
     },
+    {
+        id: 'privacy.output-protection',
+        name: 'Output Protection — Data Leakage',
+        description: 'Block PII, secrets and bulk disclosure in the model\'s own responses. Scoped to the response direction only, so prompts are unaffected.',
+        category: 'privacy',
+        cedarText: GUARDRAILS_PRIVACY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:privacy', 'threat:data-leak', 'surface:process-response', 'detection:rule'],
+    },
+    {
+        id: 'trust-safety.output-protection',
+        name: 'Output Protection — Harmful Content',
+        description: 'Hold the model\'s own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.',
+        category: 'trust-safety',
+        cedarText: GUARDRAILS_TRUST_SAFETY_OUTPUT_PROTECTION_CEDAR,
+        severity: 'critical',
+        tags: ['category:trust-safety', 'threat:harmful', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'security.output-block-injection-carried-back',
+        name: 'Output Protection — Injection Carried Back',
+        description: 'Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.',
+        category: 'security',
+        cedarText: GUARDRAILS_SECURITY_OUTPUT_BLOCK_INJECTION_CARRIED_BACK_CEDAR,
+        severity: 'high',
+        tags: ['category:security', 'threat:injection', 'surface:process-response', 'detection:ml'],
+    },
+    {
+        id: 'data-protection.output-block-secrets',
+        name: 'Output Protection — Credentials',
+        description: 'Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.',
+        category: 'data-protection',
+        cedarText: GUARDRAILS_DATA_PROTECTION_OUTPUT_BLOCK_SECRETS_CEDAR,
+        severity: 'critical',
+        tags: ['category:data-protection', 'threat:secrets', 'surface:process-response', 'detection:rule'],
+    },
 ];
 // =============================================================================
 // TEMPLATES METADATA
@@ -3857,7 +4112,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "is_active": true
     }
   ],
@@ -3869,7 +4127,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "organization",
       "file": "defaults/baseline.cedar",
       "severity": "low",
-      "tags": ["category:organization", "posture:permit-default"],
+      "tags": [
+        "category:organization",
+        "posture:permit-default"
+      ],
       "auto_deploy": true
     },
     {
@@ -3879,7 +4140,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "defaults/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.injection",
@@ -4023,7 +4288,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-identity",
       "file": "defaults/agent_identity.cedar",
       "severity": "critical",
-      "tags": ["category:agent-identity", "scope:per-agent", "owasp:llm01"]
+      "tags": [
+        "category:agent-identity",
+        "scope:per-agent",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "tools.mcp-tool-permissions",
@@ -4032,7 +4301,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "tools",
       "file": "mcp_tool_permissions.cedar",
       "severity": "critical",
-      "tags": ["category:tools", "threat:supply-chain", "posture:deny-default"]
+      "tags": [
+        "category:tools",
+        "threat:supply-chain",
+        "posture:deny-default"
+      ]
     },
     {
       "id": "tools.mcp-server-allowlist",
@@ -4082,7 +4355,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/code_agent/security.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets"
+      ]
     },
     {
       "id": "security.code-agent-encoding",
@@ -4104,7 +4380,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/code_agent/path_security.cedar",
       "severity": "critical",
-      "tags": ["category:security", "threat:secrets", "threat:path-traversal"]
+      "tags": [
+        "category:security",
+        "threat:secrets",
+        "threat:path-traversal"
+      ]
     },
     {
       "id": "agent-security.code-agent",
@@ -4143,7 +4423,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/data_pipeline/data_protection.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "security.data-pipeline-block-injection",
@@ -4152,7 +4436,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "security",
       "file": "profiles/data_pipeline/security.cedar",
       "severity": "high",
-      "tags": ["category:security", "threat:injection", "owasp:llm01"]
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "owasp:llm01"
+      ]
     },
     {
       "id": "agent-security.data-pipeline",
@@ -4161,7 +4449,10 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "agent-security",
       "file": "profiles/data_pipeline/agentic_security.cedar",
       "severity": "critical",
-      "tags": ["category:agent-security", "threat:exfiltration"]
+      "tags": [
+        "category:agent-security",
+        "threat:exfiltration"
+      ]
     },
     {
       "id": "agent-identity.multi-agent-trust",
@@ -4270,7 +4561,11 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
       "category": "data-protection",
       "file": "profiles/advanced_detection/secrets.cedar",
       "severity": "critical",
-      "tags": ["category:data-protection", "threat:secrets", "owasp:llm06"]
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "owasp:llm06"
+      ]
     },
     {
       "id": "privacy.advanced-pii",
@@ -4300,6 +4595,62 @@ export const GUARDRAILS_TEMPLATES_JSON = `{
         "aarm:r3",
         "posture:deny-default"
       ]
+    },
+    {
+      "id": "privacy.output-protection",
+      "name": "Output Protection — Data Leakage",
+      "description": "Block PII, secrets and bulk disclosure in the model's own responses. Scoped to the response direction only, so prompts are unaffected.",
+      "category": "privacy",
+      "file": "profiles/output_protection/data_leakage.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:privacy",
+        "threat:data-leak",
+        "surface:process-response",
+        "detection:rule"
+      ]
+    },
+    {
+      "id": "trust-safety.output-protection",
+      "name": "Output Protection — Harmful Content",
+      "description": "Hold the model's own responses to a safety standard: toxicity, explicit content, and injection payloads carried back to the caller. Response direction only.",
+      "category": "trust-safety",
+      "file": "profiles/output_protection/harmful_content.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:trust-safety",
+        "threat:harmful",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "security.output-block-injection-carried-back",
+      "name": "Output Protection — Injection Carried Back",
+      "description": "Block responses that themselves score as an injection payload — content a caller, downstream agent or renderer may execute. Response direction only.",
+      "category": "security",
+      "file": "profiles/output_protection/injection_carried_back.cedar",
+      "severity": "high",
+      "tags": [
+        "category:security",
+        "threat:injection",
+        "surface:process-response",
+        "detection:ml"
+      ]
+    },
+    {
+      "id": "data-protection.output-block-secrets",
+      "name": "Output Protection — Credentials",
+      "description": "Block responses whose own content contains credentials, API keys or tokens — the canonical way a leaked secret reaches a caller. Response direction only.",
+      "category": "data-protection",
+      "file": "profiles/output_protection/credentials.cedar",
+      "severity": "critical",
+      "tags": [
+        "category:data-protection",
+        "threat:secrets",
+        "surface:process-response",
+        "detection:rule"
+      ]
     }
   ]
 }

package/dist/guardrails-detectors.gen.d.ts

@@ -1,5 +1,5 @@
 import type { DetectorCard } from './detector-card-types.gen';
-export declare const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.3.0";
+export declare const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.4.0";
 export declare const GUARDRAILS_DETECTORS: readonly DetectorCard[];
 export declare const GUARDRAILS_FIELD_TO_DETECTORS: Readonly<Record<string, readonly string[]>>;
 export declare function guardrailsDetectorById(id: string): DetectorCard | undefined;

package/dist/guardrails-detectors.gen.js

@@ -1,4 +1,4 @@
-export const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.3.0";
+export const GUARDRAILS_DETECTOR_SPEC_VERSION = "1.4.0";
 export const GUARDRAILS_DETECTORS = [
     {
         id: "pii",
@@ -401,11 +401,25 @@ export const GUARDRAILS_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI package install", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
     },
+    {
+        id: "package_reputation",
+        displayName: "Package Reputation (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Install of a package carrying a malicious advisory", vulnerabilityId: "supply_chain", snippet: "pip install evil-pkg", expectedSignal: { "malicious_package_detected": true } }],
+    },
     {
         id: "sentiment",
         displayName: "Sentiment Analysis",
@@ -510,9 +524,9 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
     "loop_tool": ["loop_detector"],
-    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_detected": ["malicious_package", "package_reputation"],
     "malicious_package_score": ["malicious_package"],
-    "malicious_packages": ["malicious_package"],
+    "malicious_packages": ["malicious_package", "package_reputation"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_input_request_detected": ["mcp_input_request"],
     "mcp_input_request_methods": ["mcp_input_request"],
@@ -527,12 +541,12 @@ export const GUARDRAILS_FIELD_TO_DETECTORS = {
     "mip_label_name": ["file_metadata"],
     "multi_turn_detection": ["deepcontext"],
     "non_ascii_score": ["security"],
-    "package_advisory_count": ["malicious_package"],
+    "package_advisory_count": ["package_reputation"],
     "package_check_status": ["malicious_package"],
-    "package_ecosystems": ["malicious_package"],
+    "package_ecosystems": ["package_reputation"],
     "package_install_detected": ["malicious_package"],
-    "package_names": ["malicious_package"],
-    "package_risk_score": ["malicious_package"],
+    "package_names": ["package_reputation"],
+    "package_risk_score": ["package_reputation"],
     "packages_checked": ["malicious_package"],
     "path_traversal_detected": ["path_traversal"],
     "path_traversal_severity": ["path_traversal"],

package/dist/overwatch-context.gen.d.ts

@@ -5,6 +5,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export declare const OverwatchContextKey: {
+    readonly BudgetExceeded: "budget_exceeded";
+    readonly BudgetRemainingPct: "budget_remaining_pct";
     readonly Content: "content";
     readonly CrimeScore: "crime_score";
     readonly Cwd: "cwd";
@@ -99,4 +101,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];
+export declare const OverwatchContextKeys: readonly ["budget_exceeded", "budget_remaining_pct", "content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];

package/dist/overwatch-context.gen.js

@@ -7,6 +7,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export const OverwatchContextKey = {
+    BudgetExceeded: 'budget_exceeded',
+    BudgetRemainingPct: 'budget_remaining_pct',
     Content: 'content',
     CrimeScore: 'crime_score',
     Cwd: 'cwd',
@@ -101,6 +103,8 @@ export const OverwatchContextKey = {
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
 export const OverwatchContextKeys = [
+    OverwatchContextKey.BudgetExceeded,
+    OverwatchContextKey.BudgetRemainingPct,
     OverwatchContextKey.Content,
     OverwatchContextKey.CrimeScore,
     OverwatchContextKey.Cwd,