@node9/policy-engine 1.65.1 → 1.67.0

package/dist/index.d.mts

@@ -329,10 +329,27 @@ interface PolicyConfig {
         dlp: {
             enabled: boolean;
             scanIgnoredTools: boolean;
+            /** Inline-ask v2: 'block' upgrades review-severity DLP matches to a hard
+             *  block. Optional for back-compat with callers that don't set it. */
+            reviewAction?: 'review' | 'block';
         };
         /** Egress / destination control (GAP-5). Optional for back-compat with
          *  callers/tests that build a PolicyConfig without it. */
         egress?: EgressPolicy;
+        /** Command-checks governance (command-checks-governance-spec.md): admin
+         *  knobs for the built-in detections' REVIEW-severity findings only.
+         *  Block-severity findings (pipe-critical, eval-remote, rm-rf-home,
+         *  nuclear, suspect binary) have NO key here — non-weakenable by
+         *  construction. Class-B keys (evalDynamic, pipeChainHigh) exclude 'off'.
+         *  rmAdvisory is consumed by the PROXY at advisory-rule injection. */
+        commandChecks?: {
+            inlineExec?: 'off' | 'review' | 'block';
+            rmAdvisory?: 'off' | 'review' | 'block';
+            chmod?: 'off' | 'review' | 'block';
+            sqlDdl?: 'off' | 'review' | 'block';
+            evalDynamic?: 'review' | 'block';
+            pipeChainHigh?: 'review' | 'block';
+        };
     };
     settings: {
         mode: string;

package/dist/index.d.ts

@@ -329,10 +329,27 @@ interface PolicyConfig {
         dlp: {
             enabled: boolean;
             scanIgnoredTools: boolean;
+            /** Inline-ask v2: 'block' upgrades review-severity DLP matches to a hard
+             *  block. Optional for back-compat with callers that don't set it. */
+            reviewAction?: 'review' | 'block';
         };
         /** Egress / destination control (GAP-5). Optional for back-compat with
          *  callers/tests that build a PolicyConfig without it. */
         egress?: EgressPolicy;
+        /** Command-checks governance (command-checks-governance-spec.md): admin
+         *  knobs for the built-in detections' REVIEW-severity findings only.
+         *  Block-severity findings (pipe-critical, eval-remote, rm-rf-home,
+         *  nuclear, suspect binary) have NO key here — non-weakenable by
+         *  construction. Class-B keys (evalDynamic, pipeChainHigh) exclude 'off'.
+         *  rmAdvisory is consumed by the PROXY at advisory-rule injection. */
+        commandChecks?: {
+            inlineExec?: 'off' | 'review' | 'block';
+            rmAdvisory?: 'off' | 'review' | 'block';
+            chmod?: 'off' | 'review' | 'block';
+            sqlDdl?: 'off' | 'review' | 'block';
+            evalDynamic?: 'review' | 'block';
+            pipeChainHigh?: 'review' | 'block';
+        };
     };
     settings: {
         mode: string;

package/dist/index.js

@@ -2176,6 +2176,47 @@ function evaluateSmartConditions(args, rule) {
 }
 
 // src/policy/index.ts
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+var INLINE_SHELL = /^(bash|sh|zsh)$/i;
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2217,7 +2258,7 @@ function checkDangerousSql(sql) {
     return "UPDATE without WHERE \u2014 updates every row";
   return null;
 }
-function pipeChainVerdict(command, isTrustedHost) {
+function pipeChainVerdict(command, isTrustedHost, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -2248,7 +2289,7 @@ function pipeChainVerdict(command, isTrustedHost) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -2262,7 +2303,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -2271,7 +2315,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -2286,10 +2334,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -2297,10 +2347,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -2343,10 +2395,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -2364,14 +2416,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);

package/dist/index.mjs

@@ -2066,6 +2066,47 @@ function evaluateSmartConditions(args, rule) {
 }
 
 // src/policy/index.ts
+function resolveCheck(v) {
+  return v === "off" || v === "block" ? v : "review";
+}
+function resolveCheckTight(v) {
+  return v === "block" ? "block" : "review";
+}
+var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
+var INLINE_SHELL = /^(bash|sh|zsh)$/i;
+function detectInlineExec(command) {
+  const pipeFed = command.includes("|");
+  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
+  for (const rawSeg of segments) {
+    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
+    let i = 0;
+    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
+    if (i >= tokens.length) continue;
+    const base = tokens[i].split("/").pop() ?? tokens[i];
+    if (!INLINE_INTERP.test(base)) continue;
+    const args = tokens.slice(i + 1);
+    let hadRedirect = false;
+    const positionals = [];
+    for (let j = 0; j < args.length; j++) {
+      const a = args[j];
+      if (a === "-") return true;
+      if (a.startsWith("<")) {
+        hadRedirect = true;
+        if (a === "<" || a === "<<") j++;
+        continue;
+      }
+      if (a.startsWith("-")) {
+        if (/^-(c|e|eval)$/i.test(a)) return true;
+        continue;
+      }
+      positionals.push(a);
+    }
+    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
+      return true;
+    }
+  }
+  return false;
+}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2107,7 +2148,7 @@ function checkDangerousSql(sql) {
     return "UPDATE without WHERE \u2014 updates every row";
   return null;
 }
-function pipeChainVerdict(command, isTrustedHost) {
+function pipeChainVerdict(command, isTrustedHost, highAction = "review") {
   const pipeAnalysis = analyzePipeChain(command);
   if (!pipeAnalysis.isPipeline) return null;
   if (pipeAnalysis.risk !== "critical" && pipeAnalysis.risk !== "high") return null;
@@ -2138,7 +2179,7 @@ function pipeChainVerdict(command, isTrustedHost) {
     };
   }
   return {
-    decision: "review",
+    decision: highAction,
     blockedByLabel: "Node9: Pipe-Chain Exfiltration (high)",
     reason: `Sensitive file piped to network sink: ${pipeAnalysis.sourceFiles.join(", ")} \u2192 ${sinks.join(", ")}`,
     tier: 3
@@ -2152,7 +2193,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const dlpMatch = args !== void 0 ? scanArgs(args) : null;
     if (dlpMatch) {
       return {
-        decision: dlpMatch.severity,
+        // reviewAction:'block' (inline-ask v2): the admin upgraded
+        // review-severity matches to a hard block — every evaluatePolicy
+        // caller (orchestrator, explain, gateway) must agree with the gate.
+        decision: dlpMatch.severity === "block" || config.policy.dlp.reviewAction === "block" ? "block" : "review",
         blockedByLabel: `DLP: ${dlpMatch.patternName}`,
         reason: `${dlpMatch.patternName} detected in ${dlpMatch.fieldPath}`
       };
@@ -2161,7 +2205,11 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   if (wouldBeIgnored) return { decision: "allow" };
   const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
   if (bashCommand !== null) {
-    const pipeVerdict = pipeChainVerdict(bashCommand, isTrustedHost);
+    const pipeVerdict = pipeChainVerdict(
+      bashCommand,
+      isTrustedHost,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (pipeVerdict) return pipeVerdict;
     const fsVerdict = analyzeFsOperation(bashCommand);
     if (fsVerdict) {
@@ -2176,10 +2224,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: fsVerdict.reason
       };
     }
-    const sqlVerdict = analyzeSqlDestructive(bashCommand);
+    const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
+    const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
     if (sqlVerdict) {
       return {
-        decision: sqlVerdict.verdict,
+        // analyzeSqlDestructive is typed review-only, so the knob maps 1:1.
+        decision: sqlAction === "block" ? "block" : "review",
         blockedByLabel: `Node9 (AST): ${sqlVerdict.ruleName}`,
         reason: sqlVerdict.reason,
         tier: 2,
@@ -2187,10 +2237,12 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleDescription: sqlVerdict.description
       };
     }
-    const chmodVerdict = analyzeChmod777(bashCommand);
+    const chmodAction = resolveCheck(config.policy.commandChecks?.chmod);
+    const chmodVerdict = chmodAction === "off" ? null : analyzeChmod777(bashCommand);
     if (chmodVerdict) {
       return {
-        decision: chmodVerdict.verdict,
+        // analyzeChmod777 is typed review-only, so the knob maps 1:1.
+        decision: chmodAction === "block" ? "block" : "review",
         blockedByLabel: `project-jail (AST): ${chmodVerdict.ruleName}`,
         reason: chmodVerdict.reason,
         tier: 2,
@@ -2233,10 +2285,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const INLINE_EXEC_PATTERN = /^(python3?|bash|sh|zsh|perl|ruby|node|php|lua)\s+(-c|-e|-eval)\s/i;
-    if (INLINE_EXEC_PATTERN.test(shellCommand.trim())) {
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
       return {
-        decision: "review",
+        decision: inlineAction === "block" ? "block" : "review",
         blockedByLabel: "Node9 Standard (Inline Execution)",
         ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
         tier: 3
@@ -2254,14 +2306,21 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     }
     if (evalVerdict === "review") {
       return {
-        decision: "review",
+        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
+        // block but can never turn this off (eval-remote above is Class A —
+        // no knob at all).
+        decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
       };
     }
-    const ptVerdict = pipeChainVerdict(shellCommand, isTrustedHost);
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
     if (ptVerdict) return ptVerdict;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.65.1",
+  "version": "1.67.0",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",