pgbeam 0.2.8__tar.gz → 0.2.9__tar.gz

{pgbeam-0.2.8 → pgbeam-0.2.9}/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pgbeam/python-sdk
 
+## 0.2.9
+
+### Patch Changes
+
+- 16ed7f3: feat(proxy): content_scan_mode=block now blocks, and it does it out loud (roadmap item 7, rung 3)
+
 ## 0.2.8
 
 ### Patch Changes

{pgbeam-0.2.8 → pgbeam-0.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgbeam
-Version: 0.2.8
+Version: 0.2.9
 Summary: Python SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol
 Project-URL: Homepage, https://pgbeam.com
 Project-URL: Documentation, https://pgbeam.com/docs/python-sdk

{pgbeam-0.2.8 → pgbeam-0.2.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pgbeam"
-version = "0.2.8"
+version = "0.2.9"
 description = "Python SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol"
 readme = "README.md"
 license = "Apache-2.0"

{pgbeam-0.2.8 → pgbeam-0.2.9}/src/pgbeam/models.py

@@ -2146,7 +2146,7 @@ class PolicyProfile(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and the webhook stream is not wired to it yet. A finding the structural detectors report at high confidence also raises an anomaly alert, at most one per credential per hour; lower-confidence findings stay in the audit trail. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block scans the same way and refuses instead: a value the structural detectors report at high confidence withholds that row and the rest of the exchange, and the statement's completion is replaced with an error (SQLSTATE 42501) naming the column, so a withheld result reads as a failed statement rather than a short one. Rows the scan had already cleared stay delivered, because this is a streaming protocol; what block guarantees is that no value carrying such a finding is ever sent to the agent. A lower-confidence finding never refuses, under any mode. No mode rewrites a value or withholds a row without saying so. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and it is delivered to any endpoint subscribed to the content_flagged webhook event, at either confidence, with decision_rule telling them apart. A finding the structural detectors report at high confidence also raises an anomaly alert, at most one per credential per hour; lower-confidence findings stay in the audit trail and the webhook stream. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
     # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]
@@ -2194,7 +2194,7 @@ class PolicyProfileInput(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and the webhook stream is not wired to it yet. A finding the structural detectors report at high confidence also raises an anomaly alert, at most one per credential per hour; lower-confidence findings stay in the audit trail. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block scans the same way and refuses instead: a value the structural detectors report at high confidence withholds that row and the rest of the exchange, and the statement's completion is replaced with an error (SQLSTATE 42501) naming the column, so a withheld result reads as a failed statement rather than a short one. Rows the scan had already cleared stay delivered, because this is a streaming protocol; what block guarantees is that no value carrying such a finding is ever sent to the agent. A lower-confidence finding never refuses, under any mode. No mode rewrites a value or withholds a row without saying so. A flagged statement records one content_flagged audit entry naming the columns, the techniques and whether the scan covered the whole result, alongside the proxy's own metrics and logs; the entry carries no value from the row itself, and it is delivered to any endpoint subscribed to the content_flagged webhook event, at either confidence, with decision_rule telling them apart. A finding the structural detectors report at high confidence also raises an anomaly alert, at most one per credential per hour; lower-confidence findings stay in the audit trail and the webhook stream. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
     # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]
@@ -2994,6 +2994,7 @@ WebhookEventType = Literal[
     "approval_requested",
     "anomaly_alert",
     "canary_tripped",
+    "content_flagged",
     "audit_checkpoint",
     "webhook.test",
 ]