@node9/policy-engine 1.43.0 → 1.45.0

package/dist/index.js

@@ -1109,7 +1109,12 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
   // raw-regex smart rule is suppressed for bash — its cond1 read a grep
   // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
-  "review-drop-truncate-shell"
+  "review-drop-truncate-shell",
+  // chmod 777 is now owned by the AST detector (analyzeChmod777) so the raw-
+  // regex smart rule is suppressed for bash — it matched `chmod 777` inside a
+  // `node -e` / `python -c` string literal (a detection pattern, not a run
+  // command) → false positive.
+  "shield:filesystem:review-chmod-777"
 ]);
 var SQL_DB_CLIS = /* @__PURE__ */ new Set([
   "psql",
@@ -1134,6 +1139,62 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+  "sudo",
+  "doas",
+  "env",
+  "xargs",
+  "time",
+  "nice",
+  "ionice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "timeout",
+  "command",
+  "exec"
+]);
+function chmodHasOpenPermMode(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const name = (words[0] ?? "").toLowerCase();
+      let idx = -1;
+      if (name === "chmod") idx = 0;
+      else if (COMMAND_WRAPPERS.has(name))
+        idx = words.findIndex((w, i) => i > 0 && w?.toLowerCase() === "chmod");
+      if (idx < 0) return true;
+      for (let i = idx + 1; i < words.length; i++) {
+        const w = words[i];
+        if (w !== null && w.startsWith("-")) continue;
+        if (w !== null && CHMOD_OPEN_PERM_TOKENS.has(w.toLowerCase())) found = true;
+        break;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
+function analyzeChmod777(command) {
+  if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
+  if (!chmodHasOpenPermMode(command)) return null;
+  return {
+    ruleName: "shield:filesystem:review-chmod-777",
+    verdict: "review",
+    reason: "chmod 777 requires human approval (filesystem shield)",
+    description: "The AI wants to make a file world-writable/executable (chmod 777). This removes the permission protection on the file so any user or process can modify or run it."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -2130,6 +2191,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
+    const chmodVerdict = analyzeChmod777(bashCommand);
+    if (chmodVerdict) {
+      return {
+        decision: chmodVerdict.verdict,
+        blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
+        reason: chmodVerdict.reason,
+        tier: 2,
+        ruleName: chmodVerdict.ruleName,
+        ruleDescription: chmodVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(

package/dist/index.mjs

@@ -1001,7 +1001,12 @@ var AST_FS_REGEX_RULES = /* @__PURE__ */ new Set([
   // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
   // raw-regex smart rule is suppressed for bash — its cond1 read a grep
   // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
-  "review-drop-truncate-shell"
+  "review-drop-truncate-shell",
+  // chmod 777 is now owned by the AST detector (analyzeChmod777) so the raw-
+  // regex smart rule is suppressed for bash — it matched `chmod 777` inside a
+  // `node -e` / `python -c` string literal (a detection pattern, not a run
+  // command) → false positive.
+  "shield:filesystem:review-chmod-777"
 ]);
 var SQL_DB_CLIS = /* @__PURE__ */ new Set([
   "psql",
@@ -1026,6 +1031,62 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
+  "sudo",
+  "doas",
+  "env",
+  "xargs",
+  "time",
+  "nice",
+  "ionice",
+  "nohup",
+  "setsid",
+  "stdbuf",
+  "timeout",
+  "command",
+  "exec"
+]);
+function chmodHasOpenPermMode(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const words = (n.Args || []).map((a) => resolveWordLiteral(a));
+      if (words.length === 0) return true;
+      const name = (words[0] ?? "").toLowerCase();
+      let idx = -1;
+      if (name === "chmod") idx = 0;
+      else if (COMMAND_WRAPPERS.has(name))
+        idx = words.findIndex((w, i) => i > 0 && w?.toLowerCase() === "chmod");
+      if (idx < 0) return true;
+      for (let i = idx + 1; i < words.length; i++) {
+        const w = words[i];
+        if (w !== null && w.startsWith("-")) continue;
+        if (w !== null && CHMOD_OPEN_PERM_TOKENS.has(w.toLowerCase())) found = true;
+        break;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
+function analyzeChmod777(command) {
+  if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
+  if (!chmodHasOpenPermMode(command)) return null;
+  return {
+    ruleName: "shield:filesystem:review-chmod-777",
+    verdict: "review",
+    reason: "chmod 777 requires human approval (filesystem shield)",
+    description: "The AI wants to make a file world-writable/executable (chmod 777). This removes the permission protection on the file so any user or process can modify or run it."
+  };
+}
 function isProtectedHomePath(rawPath) {
   let p = rawPath.replace(/^\$HOME[\\/]?|^\$\{HOME\}[\\/]?/, "~/");
   let underHome = false;
@@ -2022,6 +2083,17 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
+    const chmodVerdict = analyzeChmod777(bashCommand);
+    if (chmodVerdict) {
+      return {
+        decision: chmodVerdict.verdict,
+        blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
+        reason: chmodVerdict.reason,
+        tier: 2,
+        ruleName: chmodVerdict.ruleName,
+        ruleDescription: chmodVerdict.description
+      };
+    }
   }
   if (config.policy.smartRules.length > 0) {
     const matchedRule = config.policy.smartRules.find(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",