@node9/policy-engine 1.60.0 → 1.61.1

package/dist/index.js

@@ -1140,7 +1140,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1460,6 +1460,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2218,8 +2309,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/dist/index.mjs

@@ -1031,7 +1031,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1351,6 +1351,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2109,8 +2200,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.60.0",
+  "version": "1.61.1",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",