pgbeam 0.2.2__tar.gz → 0.2.4__tar.gz

{pgbeam-0.2.2 → pgbeam-0.2.4}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @pgbeam/python-sdk
 
+## 0.2.4
+
+### Patch Changes
+
+- 631f106: feat(contentscan): a flagged result records a content_flagged audit entry
+
+## 0.2.3
+
+### Patch Changes
+
+- a5fbfca: feat(proxy): scan result content on the wire for agent-directed text
+
 ## 0.2.2
 
 ### Patch Changes

{pgbeam-0.2.2 → pgbeam-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgbeam
-Version: 0.2.2
+Version: 0.2.4
 Summary: Python SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol
 Project-URL: Homepage, https://pgbeam.com
 Project-URL: Documentation, https://pgbeam.com/docs/python-sdk

{pgbeam-0.2.2 → pgbeam-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pgbeam"
-version = "0.2.2"
+version = "0.2.4"
 description = "Python SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol"
 readme = "README.md"
 license = "Apache-2.0"

{pgbeam-0.2.2 → pgbeam-0.2.4}/src/pgbeam/models.py

@@ -602,7 +602,7 @@ class AuditChainVerification(TypedDict):
     verified_at: str
 
 
-# Coarse outcome filter that groups audit events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated. The progress events approval_requested, approved and migration_flagged group under no decision: each belongs to a statement that goes on to record its own outcome, so grouping them would count that statement twice. auto_approved is not one of those: it is the only row an auto-approved write produces, so it groups under `allow` like any other completed statement.
+# Coarse outcome filter that groups audit events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated. The progress events approval_requested, approved and migration_flagged group under no decision, and so does content_flagged: each belongs to a statement that records its own outcome as well, so grouping them would count that statement twice. auto_approved is not one of those: it is the only row an auto-approved write produces, so it groups under `allow` like any other completed statement.
 AuditDecision = Literal["allow", "block", "mask", "truncate"]
 
 
@@ -617,7 +617,7 @@ class AuditLogEntry(TypedDict):
     credential_id: NotRequired[str | None]
     # Data plane region that served the statement.
     region: NotRequired[str]
-    # Event type (query, auto_approved, blocked, masked, truncated, budget_exhausted, canary_tripped, rejected, approval_expired, auth_failed, credential_expired, approval_requested, approved, migration_flagged, entries_dropped). `approved` is a statement a reviewer released from an approval hold, which then runs and records its own outcome; `auto_approved` is a write a policy waved through without a human, and is the only row that write produces.
+    # Event type (query, auto_approved, blocked, masked, truncated, budget_exhausted, canary_tripped, rejected, approval_expired, auth_failed, credential_expired, approval_requested, approved, migration_flagged, content_flagged, entries_dropped). `approved` is a statement a reviewer released from an approval hold, which then runs and records its own outcome; `auto_approved` is a write a policy waved through without a human, and is the only row that write produces; `content_flagged` is not an outcome at all, but the result-content scan reporting instruction-shaped text in the values a statement returned, which were forwarded to the agent unchanged.
     event: str
     # The statement text (truncated).
     sql: NotRequired[str]
@@ -2091,9 +2091,9 @@ class PolicyProfile(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, accepted and stored but not yet enforced: no released proxy build reads this field, so today every value behaves like off. Once enforcement ships on the data-plane relay path, values on their way out to an agent will be checked for instruction-shaped content (stored prompt injection). off will scan nothing and cost nothing. annotate will forward every value unchanged and record what it found. block will additionally refuse the statement with an error naming the column, and never drop a row silently. A proxy build without result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and the anomaly feed and the webhook stream are not wired to it yet. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
-    # Byte budget for one statement's content scan, spanning all values in the result. Stored but not yet read by any released proxy build, like content_scan_mode. Once enforced, values past it are reported unscannable rather than skipped quietly. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
+    # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]
     # When the policy profile was created.
     created_at: str
@@ -2139,9 +2139,9 @@ class PolicyProfileInput(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, accepted and stored but not yet enforced: no released proxy build reads this field, so today every value behaves like off. Once enforcement ships on the data-plane relay path, values on their way out to an agent will be checked for instruction-shaped content (stored prompt injection). off will scan nothing and cost nothing. annotate will forward every value unchanged and record what it found. block will additionally refuse the statement with an error naming the column, and never drop a row silently. A proxy build without result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and the anomaly feed and the webhook stream are not wired to it yet. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
-    # Byte budget for one statement's content scan, spanning all values in the result. Stored but not yet read by any released proxy build, like content_scan_mode. Once enforced, values past it are reported unscannable rather than skipped quietly. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
+    # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]