feat(proxy): scan result content on the wire for agent-directed text (#2245)

Synced from sferarc/pgbeam@a5fbfca

Author: SferaDev

src/pgbeam/models.py

@@ -2091,9 +2091,9 @@ class PolicyProfile(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, accepted and stored but not yet enforced: no released proxy build reads this field, so today every value behaves like off. Once enforcement ships on the data-plane relay path, values on their way out to an agent will be checked for instruction-shaped content (stored prompt injection). off will scan nothing and cost nothing. annotate will forward every value unchanged and record what it found. block will additionally refuse the statement with an error naming the column, and never drop a row silently. A proxy build without result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. Findings currently surface in the proxy's own metrics and logs, as column names, techniques and coverage counts; the audit event, the anomaly feed and the webhook stream are not wired to them yet. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
-    # Byte budget for one statement's content scan, spanning all values in the result. Stored but not yet read by any released proxy build, like content_scan_mode. Once enforced, values past it are reported unscannable rather than skipped quietly. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
+    # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]
     # When the policy profile was created.
     created_at: str
@@ -2139,9 +2139,9 @@ class PolicyProfileInput(TypedDict):
     egress_bytes_per_day: NotRequired[int]
     # Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
     max_affected_rows: NotRequired[int]
-    # Result-content scanning, accepted and stored but not yet enforced: no released proxy build reads this field, so today every value behaves like off. Once enforcement ships on the data-plane relay path, values on their way out to an agent will be checked for instruction-shaped content (stored prompt injection). off will scan nothing and cost nothing. annotate will forward every value unchanged and record what it found. block will additionally refuse the statement with an error naming the column, and never drop a row silently. A proxy build without result-content scanning ignores this field.
+    # Result-content scanning, enforced on the data-plane relay path: values on their way out to an agent are checked for instruction-shaped content (stored prompt injection). off scans nothing and costs nothing. annotate scans and forwards every value unchanged, recording what it found. block is accepted and scans exactly as annotate does, but refusing the statement is not implemented yet, so today it also forwards every value. No mode drops or rewrites a row. Findings currently surface in the proxy's own metrics and logs, as column names, techniques and coverage counts; the audit event, the anomaly feed and the webhook stream are not wired to them yet. Values the scan cannot read (binary-format columns, columns this profile masks, and anything past content_scan_max_bytes) are counted as unscanned rather than reported clean. A proxy build older than result-content scanning ignores this field.
     content_scan_mode: NotRequired[Literal["off", "annotate", "block"]]
-    # Byte budget for one statement's content scan, spanning all values in the result. Stored but not yet read by any released proxy build, like content_scan_mode. Once enforced, values past it are reported unscannable rather than skipped quietly. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
+    # Byte budget for one statement's content scan, spanning all values in the result. Values past it are reported unscannable rather than skipped quietly. The budget covers a whole statement, so the statements of one simple-query batch share it rather than each getting a fresh allowance. 0 uses the scanner default (4 MiB), which covers an interactive result set and deliberately does not cover a bulk export.
     content_scan_max_bytes: NotRequired[int]