@node9/policy-engine 1.61.0 → 1.62.0

package/dist/index.d.mts

@@ -712,6 +712,13 @@ declare function computeSecurityScore(opts: {
  */
 declare function classifyScanSignal(key: keyof ScanSignals): Severity;
 /**
+ * @deprecated Score-1 redesign (2026-07): the Report score is now LIVE +
+ * POSTURE via {@link computeAgentDeviceScore}; session-scan findings moved to
+ * the onboarding forecast and no longer feed a "current risk" number (they
+ * are lifetime data — blending them inflated the score with pre-install
+ * history). Kept exported for npm back-compat (removal = breaking major);
+ * do not add new callers.
+ *
  * Compute a 0-100 risk-posture score that blends audit-log severity counts
  * with forward-only scan signal counts.
  *
@@ -752,6 +759,44 @@ declare function computeBlendedSecurityScore(opts: {
     score: number;
     tier: ScoreTier;
 };
+/**
+ * The Report's "how at-risk am I RIGHT NOW?" score: a 0.5/0.5 blend of
+ *
+ *   runtime = computeSecurityScore(live audit counts)  — what node9 CAUGHT
+ *             in the window (rate-based, unchanged math);
+ *   posture = the fleet-average machine posture score  — how exposed the
+ *             machines are NOW (already includes disk/secret exposure via
+ *             the posture scorecard's secrets check).
+ *
+ * Session-scan (lifetime) findings deliberately do NOT feed this score —
+ * they are pre-install history, not current risk (they surface in the
+ * onboarding forecast instead).
+ *
+ * Missing-data semantics (the day-1 false-100 fix):
+ *   - no activity AND no posture → { score: null, tier: null } — the caller
+ *     renders "not enough data", NEVER an invented 100/healthy;
+ *   - no activity, posture known → posture IS the risk (a fresh machine that
+ *     can read ~/.aws scores badly regardless of activity);
+ *   - activity, no posture yet   → the pure runtime score;
+ *   - both → round(0.5·runtime + 0.5·posture).
+ *
+ * An EARNED 100 (real activity, nothing caught) blends normally — only the
+ * no-data 100 is suppressed. Pure; posture defensively clamped to [0,100].
+ */
+declare function computeAgentDeviceScore(opts: {
+    /** LIVE audit-window severity counts — scan never feeds this score. */
+    audit: {
+        critical: number;
+        high: number;
+        medium: number;
+        total: number;
+    };
+    /** Fleet-average machine posture score, or null when no machine reports. */
+    posture: number | null;
+}): {
+    score: number | null;
+    tier: ScoreTier | null;
+};
 
 /**
  * One sensitive path that the blast walker found readable on disk.
@@ -1055,4 +1100,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -712,6 +712,13 @@ declare function computeSecurityScore(opts: {
  */
 declare function classifyScanSignal(key: keyof ScanSignals): Severity;
 /**
+ * @deprecated Score-1 redesign (2026-07): the Report score is now LIVE +
+ * POSTURE via {@link computeAgentDeviceScore}; session-scan findings moved to
+ * the onboarding forecast and no longer feed a "current risk" number (they
+ * are lifetime data — blending them inflated the score with pre-install
+ * history). Kept exported for npm back-compat (removal = breaking major);
+ * do not add new callers.
+ *
  * Compute a 0-100 risk-posture score that blends audit-log severity counts
  * with forward-only scan signal counts.
  *
@@ -752,6 +759,44 @@ declare function computeBlendedSecurityScore(opts: {
     score: number;
     tier: ScoreTier;
 };
+/**
+ * The Report's "how at-risk am I RIGHT NOW?" score: a 0.5/0.5 blend of
+ *
+ *   runtime = computeSecurityScore(live audit counts)  — what node9 CAUGHT
+ *             in the window (rate-based, unchanged math);
+ *   posture = the fleet-average machine posture score  — how exposed the
+ *             machines are NOW (already includes disk/secret exposure via
+ *             the posture scorecard's secrets check).
+ *
+ * Session-scan (lifetime) findings deliberately do NOT feed this score —
+ * they are pre-install history, not current risk (they surface in the
+ * onboarding forecast instead).
+ *
+ * Missing-data semantics (the day-1 false-100 fix):
+ *   - no activity AND no posture → { score: null, tier: null } — the caller
+ *     renders "not enough data", NEVER an invented 100/healthy;
+ *   - no activity, posture known → posture IS the risk (a fresh machine that
+ *     can read ~/.aws scores badly regardless of activity);
+ *   - activity, no posture yet   → the pure runtime score;
+ *   - both → round(0.5·runtime + 0.5·posture).
+ *
+ * An EARNED 100 (real activity, nothing caught) blends normally — only the
+ * no-data 100 is suppressed. Pure; posture defensively clamped to [0,100].
+ */
+declare function computeAgentDeviceScore(opts: {
+    /** LIVE audit-window severity counts — scan never feeds this score. */
+    audit: {
+        critical: number;
+        high: number;
+        medium: number;
+        total: number;
+    };
+    /** Fleet-average machine posture score, or null when no machine reports. */
+    posture: number | null;
+}): {
+    score: number | null;
+    tier: ScoreTier | null;
+};
 
 /**
  * One sensitive path that the blast walker found readable on disk.
@@ -1055,4 +1100,4 @@ declare function previewArgs(input: Record<string, unknown>, max: number): strin
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTRUCTIVE_OP_RE, DLP_PATTERNS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShieldVerdict, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, summarizeBlast, summarizeScan, toScanFinding, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -57,6 +57,7 @@ __export(src_exports, {
   classifyAuditEntry: () => classifyAuditEntry,
   classifyRuleSeverity: () => classifyRuleSeverity,
   classifyScanSignal: () => classifyScanSignal,
+  computeAgentDeviceScore: () => computeAgentDeviceScore,
   computeArgsHash: () => computeArgsHash,
   computeBlendedSecurityScore: () => computeBlendedSecurityScore,
   computeScanScore: () => computeScanScore,
@@ -1140,7 +1141,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1460,6 +1461,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2218,8 +2310,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -3456,6 +3549,17 @@ function computeBlendedSecurityScore(opts) {
   }
   return computeSecurityScore({ critical, high, medium, total });
 }
+function computeAgentDeviceScore(opts) {
+  const { audit } = opts;
+  const posture = Number.isFinite(opts.posture) ? Math.max(0, Math.min(100, opts.posture)) : null;
+  const tierOf = (s) => s >= 80 ? "good" : s >= 50 ? "at-risk" : "critical";
+  if (audit.total === 0 && posture === null) return { score: null, tier: null };
+  if (audit.total === 0) return { score: posture, tier: tierOf(posture) };
+  const runtime = computeSecurityScore(audit);
+  if (posture === null) return runtime;
+  const score = Math.round(0.5 * runtime.score + 0.5 * posture);
+  return { score, tier: tierOf(score) };
+}
 
 // src/blast/index.ts
 function truncateBlastPath(full) {
@@ -3909,6 +4013,7 @@ var ENGINE_VERSION = "1.4.0";
   classifyAuditEntry,
   classifyRuleSeverity,
   classifyScanSignal,
+  computeAgentDeviceScore,
   computeArgsHash,
   computeBlendedSecurityScore,
   computeScanScore,

package/dist/index.mjs

@@ -1031,7 +1031,7 @@ function analyzeSqlDestructive(command) {
     description: "The AI wants to drop or truncate a database table via the shell. This permanently deletes the table structure or all its data."
   };
 }
-var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx", "+x"]);
+var CHMOD_OPEN_PERM_TOKENS = /* @__PURE__ */ new Set(["777", "0777", "a+rwx"]);
 var COMMAND_WRAPPERS = /* @__PURE__ */ new Set([
   "sudo",
   "doas",
@@ -1351,6 +1351,97 @@ function analyzeFsOperation(command) {
   fsOpCache.set(normalized, computed);
   return computed;
 }
+var stripDotSlash = (p) => p.replace(/^\.\//, "");
+function isSensitiveCleanupName(p) {
+  const base = p.replace(/^.*[\\/]/, "");
+  return /^\.env(\.|$)/i.test(base) || /(?:^|[\\/])\.(?:ssh|aws|gnupg|git)(?:[\\/]|$)/i.test(p) || /\.(?:pem|key|p12|pfx|crt)$/i.test(base) || /^\.?(?:netrc|npmrc|pgpass|htpasswd)$/i.test(base) || /^id_(?:rsa|dsa|ecdsa|ed25519)/i.test(base) || /credential/i.test(p) || /secret/i.test(base);
+}
+function isWaivableCleanupTarget(p) {
+  if (/^[/~]/.test(p) || /^\$/.test(p)) return false;
+  if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(p)) return false;
+  if (/[*?[{]/.test(p)) return false;
+  if (isSensitiveCleanupName(p)) return false;
+  return true;
+}
+function deriveRedirOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
+  deriveRedirOp("cat <<X\nX"),
+  deriveRedirOp("cat <<-X\nX")
+]);
+function collectSameCommandCreations(f) {
+  const created = /* @__PURE__ */ new Set();
+  try {
+    const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
+    for (const stmt of stmts) {
+      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      const redirs = stmt.Redirs || [];
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      for (const r of redirs) {
+        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+          const w = resolveWordLiteral(r.Word);
+          if (w) created.add(stripDotSlash(w));
+        }
+      }
+    }
+  } catch {
+    return created;
+  }
+  return created;
+}
+function isRmCreatedInCommandCleanup(command) {
+  if (!/\brm\b/.test(command)) return false;
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) return false;
+  const created = collectSameCommandCreations(f);
+  if (created.size === 0) return false;
+  let sawRm = false;
+  let ok = true;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || !ok) return false;
+      const n = node;
+      if (syntax.NodeType(n) !== "CallExpr") return true;
+      const args = n.Args || [];
+      const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
+      if (name !== "rm") return true;
+      sawRm = true;
+      const { flags, paths } = extractLiteralArgs(n);
+      if (args.length - 1 > flags.length + paths.length) {
+        ok = false;
+        return false;
+      }
+      if (paths.length === 0) {
+        ok = false;
+        return false;
+      }
+      for (const p of paths) {
+        const np = stripDotSlash(p);
+        if (!created.has(np) || !isWaivableCleanupTarget(np)) {
+          ok = false;
+          return false;
+        }
+      }
+      return true;
+    });
+  } catch {
+    return false;
+  }
+  return sawRm && ok;
+}
 function analyzeFsOperationImpl(command) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
@@ -2109,8 +2200,9 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
   }
   if (config.policy.smartRules.length > 0) {
+    const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && evaluateSmartConditions(args, rule)
+      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -3347,6 +3439,17 @@ function computeBlendedSecurityScore(opts) {
   }
   return computeSecurityScore({ critical, high, medium, total });
 }
+function computeAgentDeviceScore(opts) {
+  const { audit } = opts;
+  const posture = Number.isFinite(opts.posture) ? Math.max(0, Math.min(100, opts.posture)) : null;
+  const tierOf = (s) => s >= 80 ? "good" : s >= 50 ? "at-risk" : "critical";
+  if (audit.total === 0 && posture === null) return { score: null, tier: null };
+  if (audit.total === 0) return { score: posture, tier: tierOf(posture) };
+  const runtime = computeSecurityScore(audit);
+  if (posture === null) return runtime;
+  const score = Math.round(0.5 * runtime.score + 0.5 * posture);
+  return { score, tier: tierOf(score) };
+}
 
 // src/blast/index.ts
 function truncateBlastPath(full) {
@@ -3799,6 +3902,7 @@ export {
   classifyAuditEntry,
   classifyRuleSeverity,
   classifyScanSignal,
+  computeAgentDeviceScore,
   computeArgsHash,
   computeBlendedSecurityScore,
   computeScanScore,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",