@node9/policy-engine 1.31.0 → 1.33.0

package/dist/index.d.mts

@@ -971,7 +971,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v6";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -982,7 +982,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
+declare const CANONICAL_EXTRACTOR_HASH = "a0e2bb339fe67e19";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.d.ts

@@ -971,7 +971,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v6";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -982,7 +982,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
+declare const CANONICAL_EXTRACTOR_HASH = "a0e2bb339fe67e19";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.js

@@ -829,6 +829,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -844,25 +846,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -1028,8 +1051,35 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   "shield:project-jail:block-read-ssh",
   "shield:project-jail:block-read-aws",
   "shield:project-jail:block-read-env",
-  "shield:project-jail:review-read-credentials"
+  "shield:project-jail:review-read-credentials",
+  // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+  // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+  // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+  "review-drop-truncate-shell"
+]);
+var SQL_DB_CLIS = /* @__PURE__ */ new Set([
+  "psql",
+  "mysql",
+  "mariadb",
+  "sqlite3",
+  "sqlplus",
+  "cockroach",
+  "clickhouse-client",
+  "mongo",
+  "mongosh"
 ]);
+var SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
+function analyzeSqlDestructive(command) {
+  if (!SQL_DDL_RE.test(command)) return null;
+  const { actions } = analyzeShellCommand(command);
+  if (!actions.some((a) => SQL_DB_CLIS.has(a))) return null;
+  return {
+    ruleName: "review-drop-truncate-shell",
+    verdict: "review",
+    reason: "SQL DDL destructive statement inside a shell command",
+    description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -1278,19 +1328,20 @@ function extractShellDestinations(command) {
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -2014,6 +2065,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
+    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    if (sqlVerdict) {
+      return {
+        decision: sqlVerdict.verdict,
+        blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
+        reason: sqlVerdict.reason,
+        tier: 2,
+        ruleName: sqlVerdict.ruleName,
+        ruleDescription: sqlVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -3329,8 +3391,8 @@ function detectArgsPii(args) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
-var CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v6";
+var CANONICAL_EXTRACTOR_HASH = "a0e2bb339fe67e19";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -3492,7 +3554,7 @@ function extractCanonicalFindings(call, ctx) {
       })
     );
   }
-  if (DESTRUCTIVE_OP_RE.test(command)) {
+  if (command !== null && DESTRUCTIVE_OP_RE.test(normalizeCommandForPolicy(command))) {
     out.push(
       makeFinding({
         type: "destructive-op",

package/dist/index.mjs

@@ -722,6 +722,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -737,25 +739,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -921,8 +944,35 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   "shield:project-jail:block-read-ssh",
   "shield:project-jail:block-read-aws",
   "shield:project-jail:block-read-env",
-  "shield:project-jail:review-read-credentials"
+  "shield:project-jail:review-read-credentials",
+  // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+  // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+  // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+  "review-drop-truncate-shell"
+]);
+var SQL_DB_CLIS = /* @__PURE__ */ new Set([
+  "psql",
+  "mysql",
+  "mariadb",
+  "sqlite3",
+  "sqlplus",
+  "cockroach",
+  "clickhouse-client",
+  "mongo",
+  "mongosh"
 ]);
+var SQL_DDL_RE = /\b(DROP|TRUNCATE)\s+(TABLE|DATABASE|SCHEMA|INDEX)\b/i;
+function analyzeSqlDestructive(command) {
+  if (!SQL_DDL_RE.test(command)) return null;
+  const { actions } = analyzeShellCommand(command);
+  if (!actions.some((a) => SQL_DB_CLIS.has(a))) return null;
+  return {
+    ruleName: "review-drop-truncate-shell",
+    verdict: "review",
+    reason: "SQL DDL destructive statement inside a shell command",
+    description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -1171,19 +1221,20 @@ function extractShellDestinations(command) {
 var FS_OP_CACHE_MAX = 5e3;
 var fsOpCache = /* @__PURE__ */ new Map();
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -1907,6 +1958,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
+    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    if (sqlVerdict) {
+      return {
+        decision: sqlVerdict.verdict,
+        blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
+        reason: sqlVerdict.reason,
+        tier: 2,
+        ruleName: sqlVerdict.ruleName,
+        ruleDescription: sqlVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(
@@ -3222,8 +3284,8 @@ function detectArgsPii(args) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v4";
-var CANONICAL_EXTRACTOR_HASH = "dbe0199dae0f29f6";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v6";
+var CANONICAL_EXTRACTOR_HASH = "a0e2bb339fe67e19";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -3385,7 +3447,7 @@ function extractCanonicalFindings(call, ctx) {
       })
     );
   }
-  if (DESTRUCTIVE_OP_RE.test(command)) {
+  if (command !== null && DESTRUCTIVE_OP_RE.test(normalizeCommandForPolicy(command))) {
     out.push(
       makeFinding({
         type: "destructive-op",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",