@highflame/policy 2.2.41 → 2.2.43

package/dist/overwatch-context.gen.d.ts

@@ -5,6 +5,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export declare const OverwatchContextKey: {
+    readonly BudgetExceeded: "budget_exceeded";
+    readonly BudgetRemainingPct: "budget_remaining_pct";
     readonly Content: "content";
     readonly CrimeScore: "crime_score";
     readonly Cwd: "cwd";
@@ -99,4 +101,4 @@ export type OverwatchContextKey = (typeof OverwatchContextKey)[keyof typeof Over
  * The full set of authorable context attribute keys for Overwatch.
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
-export declare const OverwatchContextKeys: readonly ["content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];
+export declare const OverwatchContextKeys: readonly ["budget_exceeded", "budget_remaining_pct", "content", "crime_score", "cwd", "detected_threats", "event", "exec_target_paths", "exit_code", "hate_speech_score", "highest_severity", "indirect_injection_score", "injection_deep_context_score", "injection_pulse_score", "injection_score", "invisible_chars_detected", "invisible_chars_score", "jailbreak_deep_context_score", "jailbreak_pulse_score", "jailbreak_score", "loop_count", "loop_detected", "loop_tool", "malicious_package_detected", "malicious_package_score", "malicious_packages", "max_threat_severity", "mcp_config_risk", "mcp_risk_score", "mcp_server", "mcp_server_verified", "mcp_tool", "package_advisory_count", "package_check_status", "package_ecosystems", "package_install_detected", "package_names", "package_risk_score", "packages_checked", "path", "pattern_type", "pii_count", "pii_detected", "pii_score", "pii_types", "privilege_scope", "profanity_score", "prompt_text", "read_target_paths", "resolved_target_paths", "response_content", "role", "rug_pull_detected", "rug_pull_score", "secret_count", "secret_types", "secrets_detected", "sequence_risk", "session_command_injection", "session_cumulative_risk_score", "session_injection_detected", "session_max_command_injection_score", "session_max_injection_score", "session_max_jailbreak_score", "session_max_pii_score", "session_max_secret_score", "session_pii_detected", "session_pii_types", "session_secret_types", "session_secrets_detected", "session_threat_turns", "sexual_score", "source", "suspicious_pattern", "threat_categories", "threat_count", "tool_category", "tool_is_builtin", "tool_is_sensitive", "tool_name", "tool_operation_classes", "tool_poisoning_detected", "tool_poisoning_score", "tool_risk_score", "unresolved_target", "user_email", "violence_score", "weapons_score", "workspace_root", "write_target_paths"];

package/dist/overwatch-context.gen.js

@@ -7,6 +7,8 @@
  * Overwatch Cedar schema and are used at policy evaluation time.
  */
 export const OverwatchContextKey = {
+    BudgetExceeded: 'budget_exceeded',
+    BudgetRemainingPct: 'budget_remaining_pct',
     Content: 'content',
     CrimeScore: 'crime_score',
     Cwd: 'cwd',
@@ -101,6 +103,8 @@ export const OverwatchContextKey = {
  * Iterate this to enumerate the authorable surface (cockpit, conformance).
  */
 export const OverwatchContextKeys = [
+    OverwatchContextKey.BudgetExceeded,
+    OverwatchContextKey.BudgetRemainingPct,
     OverwatchContextKey.Content,
     OverwatchContextKey.CrimeScore,
     OverwatchContextKey.Cwd,

package/dist/overwatch-detectors.gen.js

@@ -84,6 +84,20 @@ export const OVERWATCH_DETECTORS = [
         defendsAgainst: ["unbounded_consumption", "excessive_agency"],
         exampleAttacks: [{ title: "Runaway tool loop", vulnerabilityId: "unbounded_consumption", snippet: "(agentic) the same shell command is invoked 30x in a row", expectedSignal: { "loop_detected": true } }],
     },
+    {
+        id: "budget_checker",
+        displayName: "Budget Checker",
+        category: "agent_behavior",
+        stability: "stable",
+        tier: "fast",
+        inhouse: false,
+        model: null,
+        latencyP50Ms: null,
+        emits: [{ name: "budget_remaining_pct", type: "Long", modifiable: false, semantic: "severity_0_100", description: "Remaining session token budget (0-100). Default-filled to 100 when no metering ran." }, { name: "budget_exceeded", type: "Bool", modifiable: false, semantic: "boolean_flag", description: "True iff the session token budget has been exceeded. Absent when no metering ran, so policies must guard with `context has`." }],
+        supportedModes: ["enforce", "monitor", "alert"],
+        defendsAgainst: ["unbounded_consumption"],
+        exampleAttacks: [{ title: "Runaway autonomous session", vulnerabilityId: "unbounded_consumption", snippet: "(agentic) one prompt drives hundreds of tool calls, burning the session's token budget unattended", expectedSignal: { "budget_exceeded": true } }],
+    },
     {
         id: "tool_risk",
         displayName: "Tool Risk",
@@ -214,6 +228,8 @@ export const OVERWATCH_DETECTORS = [
 // Semantic field → contributing detector ids (producesAttrs + normalizationAliases,
 // resolved at codegen). Used by the client field→detector resolver — no Shield round-trip.
 export const OVERWATCH_FIELD_TO_DETECTORS = {
+    "budget_exceeded": ["budget_checker"],
+    "budget_remaining_pct": ["budget_checker"],
     "crime_score": ["toxicity"],
     "exec_target_paths": ["bash_ast_classifier"],
     "hate_speech_score": ["toxicity"],

package/dist/parser.d.ts

@@ -25,7 +25,8 @@ export interface ParseResult {
  *
  * Uses the official cedar-wasm engine for parsing, ensuring correctness.
  * Policies with features that can't be represented as PolicyRule (e.g.,
- * unless clauses, complex expressions) are returned in the unstructured array.
+ * template slots) are returned in the unstructured array. Cedar `unless`
+ * clauses are represented as negated condition expressions.
  *
  * @param cedarText - Cedar policy text to parse
  * @returns ParseResult with structured rules, unstructured policies, and errors

package/dist/parser.js

@@ -25,7 +25,8 @@ function normalizeEntityRef(ref) {
  *
  * Uses the official cedar-wasm engine for parsing, ensuring correctness.
  * Policies with features that can't be represented as PolicyRule (e.g.,
- * unless clauses, complex expressions) are returned in the unstructured array.
+ * template slots) are returned in the unstructured array. Cedar `unless`
+ * clauses are represented as negated condition expressions.
  *
  * @param cedarText - Cedar policy text to parse
  * @returns ParseResult with structured rules, unstructured policies, and errors
@@ -154,12 +155,6 @@ function cedarJsonToRule(policy, policyId, index, originalText) {
  * Check if a Cedar policy can be represented as PolicyRule
  */
 function canRepresentAsRule(policy) {
-    // Unless clauses can't be represented
-    for (const cond of policy.conditions) {
-        if (cond.kind === "unless") {
-            return false;
-        }
-    }
     // Template slots can't be represented
     if (hasSlot(policy.principal) || hasSlot(policy.resource)) {
         return false;
@@ -289,27 +284,38 @@ function mapActionScope(scope) {
 function mapConditions(conditions, originalText) {
     const result = [];
     let hasUnmapped = false;
-    // Collect condition expressions from all when clauses
+    // Collect condition expressions from all when/unless clauses.
     const expressions = [];
+    // A policy may carry several `when` clauses, which Cedar ANDs together.
+    // Each clause must recover ITS OWN text: a previous version always read the
+    // first clause, so a second clause that fell through to the `raw` fallback
+    // was stored as a duplicate of the first and its real content was lost.
+    const clauses = originalText ? extractConditionClauses(originalText) : [];
+    let clauseIndex = 0;
     for (const cond of conditions) {
-        if (cond.kind !== "when") {
-            continue;
-        }
+        const clauseText = clauses[clauseIndex]?.text;
+        clauseIndex++;
         // Flat mapping (backward compat)
         const parsed = mapConditionBody(cond.body);
-        if (parsed.condition) {
+        if (cond.kind === "when" && parsed.condition) {
             result.push(parsed.condition);
         }
-        else if (parsed.raw) {
+        else if (parsed.raw || cond.kind === "unless") {
             hasUnmapped = true;
         }
-        // Recursive mapping (new)
-        expressions.push(mapConditionBodyToExpression(cond.body, originalText));
+        const expression = mapConditionBodyToExpression(cond.body, clauseText);
+        expressions.push(cond.kind === "unless" ? { kind: 'not', child: expression } : expression);
     }
-    // Extract readable Cedar condition text instead of storing JSON AST
+    // Extract readable Cedar condition text instead of storing JSON AST.
+    // With several clauses, join them — `when { A } when { B }` is `A && B`, so
+    // collapsing them into one guard keeps the regenerated policy equivalent
+    // rather than silently dropping every clause after the first.
     let rawCondition;
-    if (hasUnmapped && originalText) {
-        rawCondition = extractWhenClause(originalText);
+    if (hasUnmapped && clauses.length > 0) {
+        const equivalent = clauses.map(({ kind, text }) => kind === 'unless' ? `!(${text})` : `(${text})`);
+        rawCondition = clauses.length === 1 && clauses[0].kind === 'when'
+            ? clauses[0].text
+            : equivalent.join(" && ");
     }
     // Build the final condition expression
     let conditionExpression;
@@ -326,29 +332,105 @@ function mapConditions(conditions, originalText) {
     };
 }
 /**
- * Extract the readable condition text from a Cedar policy's when clause.
- * Given: `forbid (...)\nwhen { context.path like "/etc/*" };`
- * Returns: `context.path like "/etc/*"`
+ * Extract the readable condition text of every `when` clause, in source order.
+ *
+ * Given: `forbid (...)\nwhen { context.path like "/etc/*" }\nwhen { resource in X };`
+ * Returns: `['context.path like "/etc/*"', 'resource in X']`
+ *
+ * Scanning is string-literal aware, which matters for correctness rather than
+ * tidiness — a naive brace count mis-reads a clause in two ways, and this text
+ * is re-emitted into policy Cedar via `rawCondition`:
+ *
+ *   when { context.path like "/etc/}" && context.a == 1 }
+ *     → a `}` inside the literal ends the clause early, yielding text that is
+ *       cut mid-string and is not valid Cedar.
+ *   when { context.msg == "when { x" }
+ *     → the `{` inside the literal unbalances the count, so the scan runs past
+ *       the clause and swallows the `;` and whatever follows.
+ *
+ * The builder's dangerous-pattern guard rejects the second shape, but a
+ * rejected rawCondition with no flat conditions to fall back on emits the rule
+ * with NO `when` clause at all — an unconditional permit or forbid. Getting the
+ * boundaries right is what keeps that path unreachable.
+ *
+ * Brace depth still applies outside literals, so record literals (`{ a: 1 }`)
+ * inside a clause do not terminate it early.
  */
-function extractWhenClause(cedarText) {
-    const whenPrefix = "when {";
-    const idx = cedarText.indexOf(whenPrefix);
-    if (idx < 0) {
-        return "";
+function extractWhenClauses(cedarText) {
+    return extractConditionClauses(cedarText)
+        .filter(({ kind }) => kind === 'when')
+        .map(({ text }) => text);
+}
+function extractConditionClauses(cedarText) {
+    const result = [];
+    let i = 0;
+    let inString = false;
+    while (i < cedarText.length) {
+        const ch = cedarText[i];
+        if (inString) {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            i++;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            i++;
+            continue;
+        }
+        const precededByIdent = i > 0 && /[A-Za-z0-9_]/.test(cedarText[i - 1]);
+        const kind = cedarText.startsWith('when {', i)
+            ? 'when'
+            : cedarText.startsWith('unless {', i)
+                ? 'unless'
+                : undefined;
+        if (!precededByIdent && kind) {
+            const start = i + `${kind} {`.length;
+            const end = findClauseEnd(cedarText, start);
+            result.push({ kind, text: cedarText.substring(start, end).trim() });
+            i = Math.min(end + 1, cedarText.length);
+            continue;
+        }
+        i++;
     }
-    const body = cedarText.substring(idx + whenPrefix.length);
+    return result;
+}
+/**
+ * Index of the `}` closing a clause body that starts at `start`, or the end of
+ * the text when the braces never balance. String-literal aware — see
+ * `extractWhenClauses`.
+ */
+function findClauseEnd(cedarText, start) {
     let depth = 1;
-    for (let i = 0; i < body.length; i++) {
-        if (body[i] === "{")
+    let inString = false;
+    for (let i = start; i < cedarText.length; i++) {
+        const ch = cedarText[i];
+        if (inString) {
+            if (ch === "\\") {
+                i++;
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === "{")
             depth++;
-        if (body[i] === "}") {
+        if (ch === "}") {
             depth--;
-            if (depth === 0) {
-                return body.substring(0, i).trim();
-            }
+            if (depth === 0)
+                return i;
         }
     }
-    return body.trim();
+    return cedarText.length;
 }
 /**
  * Map a Cedar expression body to PolicyCondition
@@ -388,8 +470,13 @@ function mapConditionBody(body) {
 /**
  * Recursively walk the Cedar JSON AST to build a ConditionExpression tree.
  * Flattens binary && / || chains into n-ary and/or nodes.
+ *
+ * `clauseText` is the source text of the `when` clause this expression came
+ * from — already extracted by the caller, never the whole policy. It is only
+ * used for the `raw` fallback below, so a clause the walker cannot model keeps
+ * its own text instead of borrowing another clause's.
  */
-function mapConditionBodyToExpression(expr, originalText) {
+function mapConditionBodyToExpression(expr, clauseText) {
     // Logical AND — flatten binary chain
     if (expr["&&"]) {
         const children = flattenBinaryChain("&&", expr);
@@ -402,7 +489,7 @@ function mapConditionBodyToExpression(expr, originalText) {
     }
     // Negation
     if (expr["!"]) {
-        const child = mapConditionBodyToExpression(expr["!"].arg, originalText);
+        const child = mapConditionBodyToExpression(expr["!"].arg, clauseText);
         return { kind: 'not', child };
     }
     // Has (existence check): { has: { left: { Var: "context" }, attr: "field" } }
@@ -434,7 +521,7 @@ function mapConditionBodyToExpression(expr, originalText) {
             return mapped;
     }
     // Fallback — extract readable text if possible
-    const text = originalText ? extractWhenClause(originalText) : JSON.stringify(expr);
+    const text = clauseText ?? JSON.stringify(expr);
     return { kind: 'raw', text };
 }
 /**