Computer Use Guards

ComputerUseGuard

Source: crates/guards/chio-guards/src/computer_use.rs. A coarse gate for three action groups:

• Remote-session and side-channel actions whose tool name or action_type or custom_type argument starts with remote. or input..
• Browser navigation verbs (navigate, goto, open) checked against a blocked-domain list and an optional allowed-domain list.
• Screenshot-family verbs rate-limited by a token bucket (screenshot, screen_capture, screen_shot, capture, capture_screen, browser_screenshot).

Config

ComputerUseConfig fields:

Default allowed action types

pub fn default_allowed_action_types() -> Vec<String> {
    vec![
        "remote.session.connect".to_string(),
        "remote.session.disconnect".to_string(),
        "remote.session.reconnect".to_string(),
        "input.inject".to_string(),
        "remote.clipboard".to_string(),
        "remote.file_transfer".to_string(),
        "remote.audio".to_string(),
        "remote.drive_mapping".to_string(),
        "remote.printing".to_string(),
        "remote.session_share".to_string(),
    ]
}

Detection algorithm

1. Extract a computer-use action type: the tool name itself if it begins with remote. or input., otherwise an action_type, actionType, custom_type, or customType argument with the same prefix. If found, apply the mode mapping against the action-type allowlist and return.
2. Extract the action through extract_action_checked. A type-mismatched or unparseable call is a hard Err, and the guard denies it (Err(_) => GuardDecision::deny(Vec::new())), so a malformed call never reaches the step 3 allow. On a parsed ToolAction::BrowserAction, match the screenshot verb set first and consume a token on a screenshot; on a navigation verb, parse the host and check the blocked and allowed lists.
3. Once extract_action_checked succeeds and the action is not a BrowserAction, the call passes with Verdict::Allow.

Failure modes

• A type-mismatched or unparseable action call (extract_action_checked returns Err) denies. Guard boundaries use the checked extractor, not the best-effort extract_action, so a malformed call fails closed.
• Token-bucket mutex poisoning collapses to no tokens, so the rate limiter denies under Guardrail and FailClosed.
• Opaque navigation targets (CSS selectors, data URIs, about:, javascript:) pass through. Fine-grained domain checks belong to BrowserAutomationGuard.
• Mixed-case schemes, scheme-relative URLs (//host), userinfo segments (user@host), and bracketed IPv6 hosts all parse to the bare host, so wildcards match correctly.

InputInjectionCapabilityGuard

Source: crates/guards/chio-guards/src/input_injection.rs. A fine-grained gate that fires when tool_name is "input.inject" or "input_inject", when an action_type or custom_type argument equals input.inject, or when a recognized tool name (keyboard, mouse, touch, input) carries an input_type field.

Config

Failure modes

• An input_type outside the allowlist denies.
• A missing input_type on an injection-flagged call denies with strict = true and allows otherwise.
• With require_postcondition_probe set, a call missing both postcondition_probe_hash and postconditionProbeHash denies. Empty strings count as missing. The guard checks presence, never the digest or the action's result.

RemoteDesktopSideChannelGuard

Source: crates/guards/chio-guards/src/remote_desktop.rs. Per-channel toggles for six named side channels, plus a transfer-size ceiling. Session-lifecycle actions (remote.session.connect, remote.session.disconnect, remote.session.reconnect) belong to ComputerUseGuard.

Every channel toggle defaults to true. max_transfer_size_bytes is Option<u64> and defaults to None. When set, remote.file_transfer calls must include a transfer_size or transferSize u64 argument; a missing or non-integer transfer size with a configured ceiling denies. The default branch is fail-closed: an unknown remote.* type such as remote.webrtc denies.

BrowserAutomationGuard

Source: crates/guards/chio-guards/src/browser_automation.rs. Three policy axes on ToolAction::BrowserAction:

• Verb allowlist. Empty means any verb; defaults to a read-only set.
• Navigation domain gating with separate blocked and allowed lists.
• Credential detection on type and input verbs through built-in regex patterns plus operator-supplied extras.

Default allowed verbs

pub fn default_allowed_verbs() -> Vec<String> {
    vec![
        "navigate".to_string(),
        "goto".to_string(),
        "open".to_string(),
        "screenshot".to_string(),
        "screen_capture".to_string(),
        "capture".to_string(),
        "browser_screenshot".to_string(),
        "get_url".to_string(),
        "get_title".to_string(),
        "read".to_string(),
        "get_content".to_string(),
        "close".to_string(),
        "back".to_string(),
        "forward".to_string(),
        "reload".to_string(),
    ]
}

Verbs like type, click, fill, and submit_form deny unless added explicitly. A writeable session widens allowed_verbs and accepts the credential-detection cost on every type call.

Config

Built-in credential patterns

Compiled once through OnceLock. They cover AWS access keys (AKIA or ASIA plus 16 characters), GitHub PATs (gh[pousr]_*), Slack tokens (xox[abopsr]-*), JWT shapes (eyJ*.*.*), PEM private-key headers, generic password = ... and token = ... assignments, OpenAI sk-* keys, and Stripe sk_live_* and sk_test_* keys.

Selectors skip navigation gating. The guard treats values starting with #, ., [, a single /, or xpath= as CSS selectors. URLs like //host still parse and check.

EmbeddingAnomalyGuard

Source: crates/guards/chio-guards/src/embedding_anomaly.rs. Guard name: embedding-anomaly. A cosine-similarity anomaly detector over a pre-loaded database of known-threat embeddings.

Detection algorithm

1. Extract a query embedding from the arguments. Preferred shapes: embedding (array of numbers), vector, or embeddings (list of vectors, mean-pooled).
2. If no embedding is present, allow.
3. If the embedding has the wrong dimension or non-finite values, deny.
4. Score the request by cosine similarity against every pattern in the database, with hand-rolled f64 accumulation and no BLAS dependency.
5. Apply the threshold band. A top score ≥ threshold + ambiguity_band denies. A top score ≤ threshold - ambiguity_band allows. An in-band score dispatches on the configured ambiguous_policy.

Config

The pattern database is loaded at construction (EmbeddingAnomalyPatternDb::from_json or EmbeddingAnomalyGuard::from_json_file; EmbeddingAnomalyGuard::new(db, config) takes a pre-built database). It must be non-empty, have a uniform non-zero dimensionality, and carry only finite values. Construction returns EmbeddingAnomalyError::Parse, EmbeddingAnomalyError::Invalid, EmbeddingAnomalyError::Config, or EmbeddingAnomalyError::Io.

Evidence

Each PatternEntry carries an id, a category (such as prompt_injection), a stage (perception, cognition, action, or feedback), a human-readable label, and the embedding vector. The guard scans the full database for the maximum cosine; receipts emit the top-scoring entry alongside the threshold and band.

Evaluation cost drivers

Evaluation cost depends on the input and the configured patterns. The grid names the work each guard performs; benchmark your own action mix for latency.

HushSpec configuration

The computer-use rule blocks sit directly under the flat top-level rules: key, as in the policy above. HushSpec models the coarse allowlist, injection, side-channel toggles, and browser-automation gate, with only the fields the compiler consumes. There is no rules.embedding_anomaly block: like the jailbreak and prompt-injection guards, EmbeddingAnomalyGuard is operator- or code-wired.