@highflame/policy 2.2.40 → 2.2.42

package/dist/agent_ops-defaults.gen.js

@@ -1648,8 +1648,23 @@ const AGENT_OPS_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// =========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -1676,7 +1691,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -1684,7 +1699,12 @@ forbid (
     principal,
     action == AgentOps::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const AGENT_OPS_SECURITY_CHAT_ASSISTANT_CEDAR = `// =============================================================================
 // Chat Assistant — Security
@@ -4460,8 +4480,8 @@ const AGENT_OPS_ORGANIZATION_DENY_BASELINE_CEDAR = `// =========================
 // =============================================================================
 
 @id("organization.deny-baseline")
-@name("Block all actions (deny baseline)")
-@description("Blocks all actions; pair with scoped permit rules for a deny-by-default posture.")
+@name("Block all actions (kill switch)")
+@description("Blocks all actions unconditionally. A kill switch, not a baseline: forbid beats permit in Cedar, so this also disables every permit in the set.")
 @severity("high")
 @tags("category:organization,posture:deny-default,scope:org-wide")
 @reject_message("Request blocked: this organization uses a deny-by-default baseline — only explicitly permitted actions are allowed.")

package/dist/ai_gateway-defaults.gen.js

@@ -370,8 +370,23 @@ const AI_GATEWAY_TOOLS_MCP_SERVER_ALLOWLIST_CEDAR = `// ========================
 // MCP Server Allowlist
 // =============================================================================
 // Restricts MCP server connections to a pre-approved list. Customize the
-// \`context.mcp_server\` values in the permit rule to match the allowed
-// servers for your environment.
+// \`context.mcp_server\` values to match the allowed servers for your
+// environment — the SAME list appears in both rules and both must be edited.
+//
+// Both rules are conditional on the allowlist, and both are needed:
+//
+//   permit ... when   { allowlisted }  grants access; Cedar is default-deny,
+//                                      so without this nothing allows the
+//                                      allowlisted servers either.
+//   forbid ... unless { allowlisted }  claws back everything else, including
+//                                      when a broad Baseline Permit is loaded.
+//
+// The forbid MUST carry the negation. \`forbid\` always beats \`permit\` in Cedar,
+// so an UNCONDITIONAL forbid denies the allowlisted servers too — which is
+// what this template used to do (highflame-policy#186).
+//
+// The \`context has mcp_server\` guard stays inside both conditions: a request
+// naming no server cannot be on the allowlist, so it is denied.
 //
 // Context keys consumed:
 //   - mcp_server: String
@@ -398,7 +413,7 @@ when {
 
 @id("tools.deny-non-allowlisted-mcp")
 @name("Block non-allowlisted MCP servers")
-@description("Blocks connect_server unconditionally so only the allowlist permit applies.")
+@description("Blocks connect_server unless mcp_server is in the allowlist.")
 @severity("medium")
 @tags("category:tools,surface:connect-server,scope:org-wide,posture:deny-default")
 @reject_message("MCP server connection blocked: server is not on the allowlist.")
@@ -406,7 +421,12 @@ forbid (
     principal,
     action == AIGateway::Action::"connect_server",
     resource
-);
+)
+unless {
+    context has mcp_server &&
+        (context.mcp_server == "filesystem" ||
+         context.mcp_server == "playwright")
+};
 `;
 const AI_GATEWAY_TOOLS_MCP_TOOL_PERMISSIONS_CEDAR = `// =============================================================================
 // MCP Tool Permissions

package/dist/ai_gateway-detectors.gen.d.ts

@@ -1,5 +1,5 @@
 import type { DetectorCard } from './detector-card-types.gen';
-export declare const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.0.0";
+export declare const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.1.0";
 export declare const AI_GATEWAY_DETECTORS: readonly DetectorCard[];
 export declare const AI_GATEWAY_FIELD_TO_DETECTORS: Readonly<Record<string, readonly string[]>>;
 export declare function aiGatewayDetectorById(id: string): DetectorCard | undefined;

package/dist/ai_gateway-detectors.gen.js

@@ -1,4 +1,4 @@
-export const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.0.0";
+export const AI_GATEWAY_DETECTOR_SPEC_VERSION = "1.1.0";
 export const AI_GATEWAY_DETECTORS = [
     {
         id: "injection",
@@ -177,11 +177,25 @@ export const AI_GATEWAY_DETECTORS = [
         inhouse: false,
         model: null,
         latencyP50Ms: 250,
-        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
+        emits: [{ name: "package_install_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff a package install/download command was recognized in the event." }, { name: "packages_checked", type: "Long", modifiable: false, semantic: "count", description: "Number of unique packages checked against osv.dev." }, { name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_package_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "100 when a malicious package was detected, 0 otherwise." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_check_status", type: "String", modifiable: false, semantic: "category_label", description: "Set to 'degraded' when the osv.dev lookup failed (fail-open); empty otherwise." }],
         supportedModes: ["enforce", "monitor", "alert"],
         defendsAgainst: ["supply_chain"],
         exampleAttacks: [{ title: "Typosquatted PyPI install via MCP bash tool", vulnerabilityId: "supply_chain", snippet: "pip install reqeusts", expectedSignal: {} }],
     },
+    {
+        id: "package_reputation",
+        displayName: "Package Reputation (OSV)",
+        category: "tool_safety",
+        stability: "preview",
+        tier: "slow",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: 250,
+        emits: [{ name: "malicious_package_detected", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff any referenced package has a known-malicious (MAL-) OSV advisory." }, { name: "malicious_packages", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Malicious packages as ecosystem/name[@version] strings." }, { name: "package_names", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Names of all packages parsed from install commands (without ecosystem prefix), e.g. 'requests', 'left-pad'. Available even when the osv.dev lookup fails." }, { name: "package_ecosystems", type: "Set<String>", modifiable: false, semantic: "category_set", description: "Unique package ecosystems seen in this event, e.g. 'PyPI', 'npm'. Useful for policies that restrict which ecosystems are permitted." }, { name: "package_advisory_count", type: "Long", modifiable: false, semantic: "count", description: "Total non-malicious OSV advisories (GHSA- / CVE- IDs) found across all checked packages. Excludes MAL- entries counted in malicious_package_detected." }, { name: "package_risk_score", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Graduated supply-chain risk score (0-100). 100 when any malicious package is found; proportional to advisory_count for advisory-only packages; 0 when all packages are clean." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["supply_chain"],
+        exampleAttacks: [{ title: "Install of a package carrying a malicious advisory", vulnerabilityId: "supply_chain", snippet: "pip install evil-pkg", expectedSignal: { "malicious_package_detected": true } }],
+    },
 ];
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
@@ -196,20 +210,20 @@ export const AI_GATEWAY_FIELD_TO_DETECTORS = {
     "jailbreak_score": ["injection"],
     "loop_count": ["loop_detector"],
     "loop_detected": ["loop_detector"],
-    "malicious_package_detected": ["malicious_package"],
+    "malicious_package_detected": ["malicious_package", "package_reputation"],
     "malicious_package_score": ["malicious_package"],
-    "malicious_packages": ["malicious_package"],
+    "malicious_packages": ["malicious_package", "package_reputation"],
     "mcp_config_risk": ["mcp_risk"],
     "mcp_risk_score": ["mcp_risk"],
     "mcp_server": ["mcp_risk"],
     "mcp_server_verified": ["mcp_risk"],
     "mcp_tool": ["mcp_risk"],
-    "package_advisory_count": ["malicious_package"],
+    "package_advisory_count": ["package_reputation"],
     "package_check_status": ["malicious_package"],
-    "package_ecosystems": ["malicious_package"],
+    "package_ecosystems": ["package_reputation"],
     "package_install_detected": ["malicious_package"],
-    "package_names": ["malicious_package"],
-    "package_risk_score": ["malicious_package"],
+    "package_names": ["package_reputation"],
+    "package_risk_score": ["package_reputation"],
     "packages_checked": ["malicious_package"],
     "pattern_type": ["action_pattern"],
     "pii_count": ["pii"],

package/dist/ai_gateway-entities.gen.js

@@ -7,7 +7,7 @@
 export const AI_GATEWAY_ENTITIES = {
     principals: ['MCP_Client', 'User'],
     resources: ['FilePath', 'LlmPrompt', 'LlmResponse', 'Server', 'Tool'],
-    actions: ['call_tool', 'connect_server', 'process_prompt', 'process_response', 'read_file', 'write_file'],
+    actions: ['call_tool', 'connect_server', 'list', 'process_prompt', 'process_response', 'read_file', 'write_file'],
 };
 /**
  * Per-action entity mapping for AiGateway.
@@ -22,6 +22,10 @@ export const AI_GATEWAY_ACTION_ENTITIES = {
         principals: ['MCP_Client', 'User'],
         resources: ['Server'],
     },
+    'list': {
+        principals: ['MCP_Client', 'User'],
+        resources: ['Server'],
+    },
     'process_prompt': {
         principals: ['MCP_Client', 'User'],
         resources: ['LlmPrompt'],