Computer Use Agent Guards

Five guards in chio-guards work the CUA surface: a coarse allowlist of action types, a fine-grained gate on input injection, per-channel toggles for remote-desktop side channels, a browser-automation gate with credential detection, and a cosine-similarity anomaly detector. They compose conjunctively so a coarse pass does not weaken a fine-grained deny.

ComputerUseGuard

Source: crates/chio-guards/src/computer_use.rs. Coarse gate that recognises three CUA surfaces:

• Remote-session and side-channel actions whose tool name or action_type / custom_type argument starts with remote. or input..
• Browser navigation verbs (navigate, goto, open) checked against a blocked-domain list and an optional allowed-domain list.
• Screenshot-family verbs rate-limited via a token bucket (screenshot, screen_capture, screen_shot, capture, capture_screen, browser_screenshot).

Config

ComputerUseConfig fields:

Default allowed action types

pub fn default_allowed_action_types() -> Vec<String> {
    vec![
        "remote.session.connect".into(),
        "remote.session.disconnect".into(),
        "remote.session.reconnect".into(),
        "input.inject".into(),
        "remote.clipboard".into(),
        "remote.file_transfer".into(),
        "remote.audio".into(),
        "remote.drive_mapping".into(),
        "remote.printing".into(),
        "remote.session_share".into(),
    ]
}

Enforcement modes

The mode determines how the allowlist outcome maps to a verdict:

Detection algorithm

• Step 1: extract a CUA action type. Tool name itself if it begins with remote. or input.; otherwise an action_type / actionType / custom_type / customType argument with the same prefix. If found, apply the mode mapping against the action-type allowlist.
• Step 2: extract the action via extract_action. If it is ToolAction::BrowserAction, first match against the screenshot verb set; on a screenshot, consume a token from the bucket. On nav verbs, parse the host and check the blocked / allowed lists.
• Step 3: anything else passes with Verdict::Allow.

Failure modes

• Token-bucket mutex poisoning collapses to "no tokens" so the rate-limiter denies under Guardrail / FailClosed.
• Opaque navigation targets (CSS selectors, data URIs, about:, javascript:) are passed through. Fine-grained domain checks belong to BrowserAutomationGuard.
• Mixed-case schemes, scheme-relative URLs (//host), userinfo segments (user@host), and bracketed IPv6 hosts all parse to the bare host so wildcards match correctly.

InputInjectionCapabilityGuard

Source: crates/chio-guards/src/input_injection.rs. Fine-grained gate that fires when tool_name == "input.inject" / "input_inject", when an action_type / custom_type argument equals input.inject, or when a recognised tool name (keyboard, mouse, touch, input) carries an input_type field.

Config

Failure modes

• input_type outside the allowlist: Deny.
• Missing input_type on an injection-flagged call with strict = true: Deny; otherwise Allow.
• require_postcondition_probe set and the call is missing both postcondition_probe_hash and postconditionProbeHash: Deny. Empty strings count as missing.

RemoteDesktopSideChannelGuard

Source: crates/chio-guards/src/remote_desktop.rs. Per-channel toggles for six named side channels, plus a transfer-size ceiling. Session-lifecycle actions (remote.session.connect, remote.session.disconnect, remote.session.reconnect) are not claimed here; they belong to ComputerUseGuard.

Every channel toggle defaults to true. The max_transfer_size_bytes knob is Option<u64> and defaults to None. When set, remote.file_transfer calls must include a transfer_size / transferSize u64 argument. Missing or non-integer transfer size with a configured ceiling: Deny.

BrowserAutomationGuard

Source: crates/chio-guards/src/browser_automation.rs. Three policy axes on ToolAction::BrowserAction:

• Verb allowlist. Empty means "any verb"; defaults to a read-only set.
• Navigation domain gating with separate blocked and allowed lists.
• Credential detection on type / input verbs via built-in regex patterns plus operator-supplied extras.

Default allowed verbs

pub fn default_allowed_verbs() -> Vec<String> {
    vec![
        "navigate".into(),
        "goto".into(),
        "open".into(),
        "screenshot".into(),
        "screen_capture".into(),
        "capture".into(),
        "browser_screenshot".into(),
        "get_url".into(),
        "get_title".into(),
        "read".into(),
        "get_content".into(),
        "close".into(),
        "back".into(),
        "forward".into(),
        "reload".into(),
    ]
}

The default verb set is read-only. Verbs like type, click, fill, and submit_form are denied unless added explicitly. Operators that want a writeable session need to widen allowed_verbs and accept the credential-detection cost on every type call.

Config

Built-in credential patterns

Compiled once via OnceLock. Cover AWS access keys (AKIA / ASIA + 16 chars), GitHub PATs (gh[pousr]_*), Slack tokens (xox[abopsr]-*), JWT shapes (eyJ*.*.* ), PEM private-key headers, generic password = ... / token = ... assignments, OpenAI sk-* keys, and Stripe sk_live_* / sk_test_* keys.

SpiderSenseGuard

Source: crates/chio-guards/src/spider_sense.rs. Cosine-similarity anomaly detector over a pre-loaded pattern database of known-threat embeddings.

Detection algorithm

1. Extract a query embedding from the arguments. Preferred shapes: embedding (array of numbers), vector, or embeddings (list of vectors, mean-pooled).
2. If no embedding is present: Allow.
3. If the embedding has the wrong dimension or non-finite values: Deny.
4. Score the request via cosine similarity against every pattern in the DB. Hand-rolled f64 accumulation, no BLAS dependency.
5. Apply the threshold band: top score ≥ threshold + ambiguity_band: Deny. Top score ≤ threshold - ambiguity_band: Allow. In-band: dispatch on the configured ambiguous_policy.

Config

The pattern DB is loaded at construction time (PatternDb::from_json or SpiderSenseGuard::from_json_file). It must be non-empty, have a uniform non-zero dimensionality, and carry only finite values. Construction errors surface as SpiderSenseError::Parse, SpiderSenseError::Invalid, or SpiderSenseError::Config.

Evidence

Each PatternEntry carries an id, category (e.g. prompt_injection), stage (perception / cognition / action / feedback), a human-readable label, and the embedding vector. The guard scans the full DB for the maximum cosine; receipts emit the top scoring entry alongside the threshold and band.

Performance class

Cost ordering, lowest first:

HushSpec snippet

hushspec: "0.1.0"
guards:
  cua:
    computer_use:
      enabled: true
      mode: fail_closed
      blocked_domains:
        - "169.254.169.254"
        - "*.internal.example"
      allowed_domains:
        - "*.corp.example"
      screenshot_rate_per_second: 2.0
      screenshot_burst: 5
    input_injection:
      enabled: true
      allowed_input_types: ["keyboard", "mouse"]
      require_postcondition_probe: true
      strict: true
    remote_desktop:
      enabled: true
      clipboard_enabled: false
      file_transfer_enabled: true
      session_share_enabled: false
      audio_enabled: false
      drive_mapping_enabled: false
      printing_enabled: false
      max_transfer_size_bytes: 1048576
    browser_automation:
      enabled: true
      allowed_domains:
        - "*.corp.example"
      blocked_domains:
        - "169.254.169.254"
      allowed_verbs:
        - "navigate"
        - "screenshot"
        - "get_content"
        - "type"
      credential_detection: true
    spider_sense:
      enabled: true
      pattern_db_path: "/etc/chio/spider_sense_patterns.json"
      similarity_threshold: 0.85
      ambiguity_band: 0.10
      top_k: 5
      ambiguous_policy: deny

Next steps

• Approval & HITL for human escalation on CUA actions that exceed automatic policy.
• Network Guards for the broader egress and SSRF posture that browser nav inherits.
• Advisory Guards for non-blocking observation of CUA patterns before promotion.