@node9/policy-engine 1.63.0 → 1.65.0

package/dist/index.js

@@ -3179,6 +3179,7 @@ var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
   aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
   smartRules: [
     {
       name: "shield:redis:block-flushall",
@@ -3187,7 +3188,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHALL\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
           flags: "i"
         }
       ],
@@ -3201,7 +3202,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHDB\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
           flags: "i"
         }
       ],
@@ -3215,7 +3216,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
           flags: "i"
         }
       ],
@@ -3229,7 +3230,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+SET\\b",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
           flags: "i"
         }
       ],
@@ -3243,7 +3244,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
           flags: "i"
         }
       ],

package/dist/index.mjs

@@ -3069,6 +3069,7 @@ var redis_default = {
   name: "redis",
   description: "Protects Redis instances from destructive AI operations",
   aliases: [],
+  _scopeNote: "Every rule requires Redis to actually be involved: a client in the command (redis-cli / valkey-cli, in either order \u2014 `redis-cli FLUSHALL` and `echo FLUSHALL | redis-cli` are both real), OR the command field holding the bare keyword, which is what the MCP redis_command tool sends ({ command: 'FLUSHALL', args: [] }). Without the client requirement these rules matched the WORD anywhere \u2014 including prose in a heredoc writing a file \u2014 which produced two observed false positives: a test fixture describing the shield, and a commit message naming the rule. Every other builtin shield already scopes this way (aws s3, docker system prune, kubectl delete, gh repo delete). See redis-scope.spec.ts.",
   smartRules: [
     {
       name: "shield:redis:block-flushall",
@@ -3077,7 +3078,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHALL\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHALL\\b|\\bFLUSHALL\\b.*(redis|valkey)-cli|^ ?FLUSHALL\\b|\\.flushall\\s*\\(",
           flags: "i"
         }
       ],
@@ -3091,7 +3092,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bFLUSHDB\\b",
+          value: "(redis|valkey)-cli.*\\bFLUSHDB\\b|\\bFLUSHDB\\b.*(redis|valkey)-cli|^ ?FLUSHDB\\b|\\.flushdb\\s*\\(",
           flags: "i"
         }
       ],
@@ -3105,7 +3106,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+RESETSTAT\\b",
+          value: "(redis|valkey)-cli.*CONFIG\\s+RESETSTAT|^ ?CONFIG\\s+RESETSTAT",
           flags: "i"
         }
       ],
@@ -3119,7 +3120,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bCONFIG\\s+SET\\b",
+          value: "(redis|valkey)-cli.*\\bCONFIG\\s+SET\\b|\\bCONFIG\\s+SET\\b.*(redis|valkey)-cli|^ ?CONFIG\\s+SET\\b",
           flags: "i"
         }
       ],
@@ -3133,7 +3134,7 @@ var redis_default = {
         {
           field: "command",
           op: "matches",
-          value: "\\bDEL\\b.*[*?\\[]|redis-cli.*--scan.*\\|.*xargs.*del",
+          value: "(redis|valkey)-cli.*\\bDEL\\b.*[*?\\[]|^ ?DEL\\b.*[*?\\[]|-cli.*--scan.*xargs.*del",
           flags: "i"
         }
       ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.63.0",
+  "version": "1.65.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",