feat: treat query_knowledge_sources results as sensitive by default

[abhinav-m22]

• Fixes Prompt Injection via Knowledge Base Ingestion #4348

This PR closes a critical prompt-injection and RAG-poisoning escalation path by ensuring that results from the built-in query_knowledge_sources tool are treated as sensitive by default.

Backend

• Special-cased query_knowledge_sources in TrustedDataPolicyModel.evaluateBulk to skip the automatic trust bypass for built-in tools.
• Implemented a fail-closed fallback: if the tool record is missing from the database, the system defaults to untrusted rather than trusted.

UI

• Modified /api/tools/with-assignments to support an explicit inclusion filter for specific built-in tools.
• Updated the Tool Guardrails page to expose query_knowledge_sources in the tools table while keeping other infrastructure tools hidden.

Docs and Tests

• Updated codegen-archestra-mcp-server-docs.ts to reflect the trust exception for this tool in the auto-generated platform documentation.
• Implemented comprehensive unit tests verifying that both standard and branded KB tool results are treated as untrusted and follow normal policy evaluation.
• Added integration tests proving that restricted tools are successfully blocked when invoked after a KB query.

[abhinav-m22]

Hi @joeyorlando!
PR is ready for review. The KB query results (query_knowledge_sources) are marked as sensitive by default and exposed the tool in the UI as suggested.

[Konstantinov-Innokentii]

@joeyorlando - assigning you as a reviewer since you own the original issue.

[joeyorlando]

I pushed a few minor changes to platform/backend/src/standalone-scripts/codegen-archestra-mcp-server-docs.ts - you'll just need to rerun pnpm codegen to regenerate the contents here

[abhinav-m22]

sure, done

[joeyorlando]

in terms of "migration", where are the default tool invocation + tool result policies being set/assigned for the query_knowledge_sources tool?

[abhinav-m22]

in terms of "migration", where are the default tool invocation + tool result policies being set/assigned for the query_knowledge_sources tool?

@joeyorlando missed that point. I was leaning on the evaluator's "no policy = untrusted" fallback at evaluation time.

Just fixed it in seedArchestraTools which is the same startup-seed pattern as migratePlaywrightToolsToDynamicCredential.

It now ensures default rows in both tool_invocation_policies (allow_when_context_is_untrusted) and trusted_data_policies (mark_as_untrusted).