@node9/policy-engine 1.67.1 → 1.67.3

package/dist/index.js

@@ -66,6 +66,7 @@ __export(src_exports, {
   detectArgsPii: () => detectArgsPii,
   detectDangerousEval: () => detectDangerousEval,
   detectDangerousShellExec: () => detectDangerousShellExec,
+  detectInlineExec: () => detectInlineExec,
   detectPii: () => detectPii,
   evaluateEgress: () => evaluateEgress,
   evaluateLoopWindow: () => evaluateLoopWindow,
@@ -84,6 +85,7 @@ __export(src_exports, {
   isIgnoredTool: () => isIgnoredTool,
   isPrivateHost: () => isPrivateHost,
   isProtectedHomePath: () => isProtectedHomePath,
+  isShellShapedTool: () => isShellShapedTool,
   isShieldVerdict: () => isShieldVerdict,
   matchSensitivePath: () => matchSensitivePath,
   matchesPattern: () => matchesPattern,
@@ -101,6 +103,7 @@ __export(src_exports, {
   summarizeBlast: () => summarizeBlast,
   summarizeScan: () => summarizeScan,
   toScanFinding: () => toScanFinding,
+  toolMatchesRule: () => toolMatchesRule,
   truncateBlastPath: () => truncateBlastPath,
   validateOverrides: () => validateOverrides,
   validateRegex: () => validateRegex,
@@ -806,6 +809,139 @@ function redactText(text) {
 
 // src/shell/index.ts
 var import_mvdan_sh = __toESM(require("mvdan-sh"));
+
+// src/rules/index.ts
+var import_picomatch = __toESM(require("picomatch"));
+
+// src/utils/regex.ts
+var import_safe_regex22 = __toESM(require("safe-regex2"));
+var MAX_REGEX_LENGTH = 256;
+var REGEX_CACHE_MAX = 500;
+var regexCache = /* @__PURE__ */ new Map();
+function validateRegex(pattern) {
+  if (!pattern) return "Pattern is required";
+  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    return `Invalid regex syntax: ${e.message}`;
+  }
+  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
+  if (!(0, import_safe_regex22.default)(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
+  return null;
+}
+function getCompiledRegex(pattern, flags = "") {
+  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
+  const key = `${pattern}\0${flags}`;
+  if (regexCache.has(key)) {
+    const cached = regexCache.get(key);
+    regexCache.delete(key);
+    regexCache.set(key, cached);
+    return cached;
+  }
+  if (validateRegex(pattern) !== null) return null;
+  try {
+    const re = new RegExp(pattern, flags);
+    if (regexCache.size >= REGEX_CACHE_MAX) {
+      const oldest = regexCache.keys().next().value;
+      if (oldest) regexCache.delete(oldest);
+    }
+    regexCache.set(key, re);
+    return re;
+  } catch {
+    return null;
+  }
+}
+
+// src/rules/index.ts
+function matchesPattern(text, patterns) {
+  const p = Array.isArray(patterns) ? patterns : [patterns];
+  if (p.length === 0) return false;
+  const isMatch = (0, import_picomatch.default)(p, { nocase: true, dot: true });
+  const target = text.toLowerCase();
+  const directMatch = isMatch(target);
+  if (directMatch) return true;
+  const withoutDotSlash = text.replace(/^\.\//, "");
+  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
+}
+var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function getNestedValue(obj, path) {
+  if (!obj || typeof obj !== "object") return null;
+  const segments = path.split(".");
+  for (const seg of segments) {
+    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
+  }
+  return segments.reduce((prev, curr) => prev?.[curr], obj);
+}
+function evaluateSmartConditions(args, rule) {
+  if (!rule.conditions || rule.conditions.length === 0) return true;
+  const mode = rule.conditionMode ?? "all";
+  const fieldCache = /* @__PURE__ */ new Map();
+  const resolveField = (field) => {
+    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
+    const rawVal = getNestedValue(args, field);
+    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
+    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
+    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
+    fieldCache.set(field, val);
+    return val;
+  };
+  const readingsCache = /* @__PURE__ */ new Map();
+  const resolveFieldReadings = (field) => {
+    const cached = readingsCache.get(field);
+    if (cached) return cached;
+    const primary = resolveField(field);
+    if (primary === null) {
+      readingsCache.set(field, []);
+      return [];
+    }
+    let out = [primary];
+    if (field === "command") {
+      const raw = getNestedValue(args, field);
+      if (typeof raw === "string") {
+        const collapsed = commandReadings(raw).map((r) => r.replace(/\s+/g, " ").trim());
+        out = [.../* @__PURE__ */ new Set([primary, ...collapsed])];
+      }
+    }
+    readingsCache.set(field, out);
+    return out;
+  };
+  const results = rule.conditions.map((cond) => {
+    const val = resolveField(cond.field);
+    switch (cond.op) {
+      case "exists":
+        return val !== null && val !== "";
+      case "notExists":
+        return val === null || val === "";
+      case "contains":
+        return val !== null && cond.value ? val.includes(cond.value) : false;
+      case "notContains":
+        return val !== null && cond.value ? !val.includes(cond.value) : true;
+      case "matches": {
+        if (val === null || !cond.value) return false;
+        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reM) return false;
+        return resolveFieldReadings(cond.field).some((v) => reM.test(v));
+      }
+      case "notMatches": {
+        if (!cond.value) return false;
+        if (val === null) return true;
+        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
+        if (!reN) return false;
+        return !resolveFieldReadings(cond.field).some((v) => reN.test(v));
+      }
+      case "matchesGlob":
+        return val !== null && cond.value ? import_picomatch.default.isMatch(val, cond.value) : false;
+      case "notMatchesGlob":
+        return val !== null && cond.value ? !import_picomatch.default.isMatch(val, cond.value) : false;
+      default:
+        return false;
+    }
+  });
+  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
+}
+
+// src/shell/index.ts
 var { syntax } = import_mvdan_sh.default;
 var sharedParser = syntax.NewParser();
 var MESSAGE_FLAGS = /* @__PURE__ */ new Set([
@@ -878,14 +1014,22 @@ function cachedNormalize(command, compute) {
   return result;
 }
 function normalizeCommandForPolicy(command) {
+  return commandReadingsImpl(command).posix;
+}
+function commandReadings(command) {
+  const r = commandReadingsImpl(command);
+  return r.separator === r.posix ? [r.posix] : [r.posix, r.separator];
+}
+function commandReadingsImpl(command) {
   return cachedNormalize(command, () => normalizeCommandForPolicyImpl(command));
 }
 function normalizeCommandForPolicyImpl(command) {
   const f = parseShared(command);
-  if (f === PARSE_FAIL) return command;
+  if (f === PARSE_FAIL) return { posix: command, separator: command };
   try {
     const strips = [];
     const rewrites = [];
+    const quoteOnlyRewrites = [];
     const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
@@ -930,22 +1074,23 @@ function normalizeCommandForPolicyImpl(command) {
         if (resolved === source) continue;
         if (resolved === "" || /\s/.test(resolved)) continue;
         rewrites.push([s, e, resolved]);
+        const quoteOnly = source.replace(/['"]/g, "");
+        if (quoteOnly !== source) quoteOnlyRewrites.push([s, e, quoteOnly]);
       }
       return true;
     });
-    const edits = [
-      ...strips.map(([s, e]) => [s, e, '""']),
-      ...rewrites
-    ];
-    if (edits.length === 0) return command;
-    edits.sort((a, b) => b[0] - a[0]);
-    let result = command;
-    for (const [s, e, rep] of edits) {
-      result = result.slice(0, s) + rep + result.slice(e);
-    }
-    return result;
+    const stripEdits = strips.map(([s, e]) => [s, e, '""']);
+    const apply = (extra) => {
+      const edits = [...stripEdits, ...extra];
+      if (edits.length === 0) return command;
+      edits.sort((a, b) => b[0] - a[0]);
+      let out = command;
+      for (const [s, e, rep] of edits) out = out.slice(0, s) + rep + out.slice(e);
+      return out;
+    };
+    return { posix: apply(rewrites), separator: apply(quoteOnlyRewrites) };
   } catch {
-    return command;
+    return { posix: command, separator: command };
   }
 }
 function scanArgsForDynamicExec(args, startIdx) {
@@ -1015,9 +1160,34 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "vi",
   "emacs",
   "code",
-  "type"
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
 ]);
-var FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
   ".npm/_npx",
@@ -1056,9 +1226,37 @@ var SENSITIVE_PATH_RULES = [
     // for the canonical test-asserted contract.
     rule: "shield:project-jail:block-read-env",
     reason: "Reading .env files is blocked by project-jail shield",
-    match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-      p
-    )
+    // Structural, not a list. The previous form enumerated seven suffixes and
+    // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+    // gitignored, all routinely holding real secrets — were never covered. A
+    // hand-written list of what to protect is only ever as complete as the day
+    // it was typed; this says "`.env` plus any suffix chain" and then names the
+    // exceptions, which is the direction that fails safe.
+    //
+    //   \.env          the segment itself
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //                  files. Without it a flat suffix class swallows both.
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+    //                  `(\.[\w-]+)*` reads the same but is rejected by
+    //                  safe-regex2, and this pattern runs on the hook hot path.
+    //
+    // The two exclusions are NOT the same shape, because the words do not mean
+    // the same thing:
+    //
+    //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+    //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+    //     These are checked into git by convention: already public, so blocking
+    //     them buys nothing and costs the most common legitimate agent read.
+    //
+    //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+    //     fixture. `.env.test` is the committed template and stays allowed, but
+    //     `.env.test.local` is gitignored by the `.env*.local` convention and
+    //     holds real values, so it must block. Using `\b` here — the obvious
+    //     symmetry — silently exempts every `.env.test.*` file.
+    //
+    // shields.test.ts:983-995 is the canonical contract; keep both in step.
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1187,6 +1385,208 @@ function chmodHasOpenPermMode(command) {
   }
   return found;
 }
+function isShellShapedTool(toolName, toolInspection) {
+  if (isBashTool(toolName)) return true;
+  if (!toolInspection) return false;
+  const pattern = Object.keys(toolInspection).find((p) => matchesPattern(toolName, p));
+  return pattern !== void 0 && toolInspection[pattern] === "command";
+}
+function toolMatchesRule(toolName, ruleTool, toolInspection) {
+  if (!ruleTool) return true;
+  if (matchesPattern(toolName, ruleTool)) return true;
+  return isShellShapedTool(toolName, toolInspection) && matchesPattern("bash", ruleTool);
+}
+var INLINE_INTERPRETER = /^(python[\d.]*|perl|ruby|node|tsx|ts-node|php|lua|deno|bun|pwsh|powershell(?:\.exe)?|osascript|rscript|irb|bash|sh|zsh|script|su)$/i;
+var RUNNER_WRAPPERS = /* @__PURE__ */ new Set([
+  "uv",
+  "uvx",
+  "poetry",
+  "pipenv",
+  "pdm",
+  "rye",
+  "hatch",
+  "conda",
+  "mamba",
+  "micromamba",
+  "npx",
+  "pnpm",
+  "yarn",
+  "bunx",
+  "watch",
+  "strace",
+  "ltrace",
+  "chroot",
+  "unshare",
+  "runuser"
+]);
+function isInlineCodeFlag(interp, w) {
+  const lw = w.toLowerCase();
+  if (lw === "--eval" || lw === "--command" || lw === "--print") return true;
+  if (/^(pwsh|powershell)/.test(interp)) return /^-(c|command|e|ec|enc|encodedcommand)$/i.test(lw);
+  if (!w.startsWith("-") || w.startsWith("--")) return false;
+  const codeLetters = /^(perl|ruby|lua|bun|osascript|rscript|irb)$/.test(interp) ? "e" : /^(node|tsx|ts-node)$/.test(interp) ? "ep" : interp === "php" ? "r" : "c";
+  const body = lw.slice(1);
+  const cutAt = /^(perl|ruby|node|tsx|ts-node)$/.test(interp) ? /[mirw]|[^a-z0-9]/ : /[^a-z0-9]/;
+  const cut = body.search(cutAt);
+  const bundle = cut >= 0 ? body.slice(0, cut) : body;
+  return [...codeLetters].some((l) => bundle.includes(l));
+}
+var _redirStdinOps = null;
+function redirStdinOps() {
+  if (_redirStdinOps) return _redirStdinOps;
+  _redirStdinOps = new Set(
+    [
+      deriveRedirOp("cat <<X\nX"),
+      deriveRedirOp("cat <<-X\nX"),
+      deriveRedirOp("cat < f"),
+      deriveRedirOp("cat <<< x")
+    ].filter((op) => op >= 0)
+  );
+  return _redirStdinOps;
+}
+function deriveBinaryOp(sample) {
+  try {
+    const f = sharedParser.Parse(sample, "cmd");
+    let op = -1;
+    syntax.Walk(f, (node) => {
+      const n = node;
+      if (n && syntax.NodeType(n) === "BinaryCmd" && op < 0) op = n.Op;
+      return true;
+    });
+    return op;
+  } catch {
+    return -1;
+  }
+}
+var _listOps = null;
+function listOps() {
+  if (_listOps) return _listOps;
+  _listOps = new Set(
+    [deriveBinaryOp("a && b"), deriveBinaryOp("a || b")].filter((o) => o >= 0)
+  );
+  return _listOps;
+}
+var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
+function unwrapCommandHead(words) {
+  let i = 0;
+  while (i < words.length) {
+    const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
+    if (head === "find") {
+      const x = words.findIndex(
+        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
+      );
+      if (x < 0) break;
+      i = x + 1;
+      continue;
+    }
+    if (!COMMAND_WRAPPERS.has(head) && !RUNNER_WRAPPERS.has(head)) break;
+    i++;
+    let targetConsumed = false;
+    while (i < words.length) {
+      const t = words[i];
+      if (t === null) {
+        i++;
+        continue;
+      }
+      const lt = t.toLowerCase();
+      if (/^[A-Za-z_]\w*=/.test(t)) {
+        i++;
+        continue;
+      }
+      if (t.startsWith("-")) {
+        i++;
+        const nxt = words[i];
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+          i++;
+        continue;
+      }
+      if (lt === "run" || lt === "exec" || lt === "dlx" || /^\d+(\.\d+)?[smhd]?$/.test(lt)) {
+        i++;
+        continue;
+      }
+      if (!targetConsumed && WRAPPER_TAKES_TARGET.has(head)) {
+        targetConsumed = true;
+        i++;
+        continue;
+      }
+      break;
+    }
+  }
+  return i;
+}
+function inlineExecStmt(stmt, pipeFed) {
+  const cmd = stmt?.Cmd;
+  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return false;
+  const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0) return false;
+  const headIdx = unwrapCommandHead(words);
+  const rawHead = words[headIdx];
+  if (rawHead == null) return false;
+  const interp = (rawHead.split("/").pop() ?? "").toLowerCase();
+  if (!INLINE_INTERPRETER.test(interp)) return false;
+  let args = words.slice(headIdx + 1);
+  if (interp === "deno" && (args[0] ?? "").toLowerCase() === "eval") return true;
+  if (INTERP_LEADING_TARGET.has(interp)) {
+    const firstFlag = args.findIndex((a) => a == null || a.startsWith("-"));
+    args = firstFlag >= 0 ? args.slice(firstFlag) : [];
+  }
+  let positionals = 0;
+  let selectedProgram = false;
+  for (const a of args) {
+    if (a == null) {
+      positionals++;
+      selectedProgram = true;
+      continue;
+    }
+    if (!selectedProgram && isInlineCodeFlag(interp, a)) return true;
+    if (a === "-m") {
+      selectedProgram = true;
+      continue;
+    }
+    if (a === "-" && !selectedProgram) return true;
+    if (!a.startsWith("-")) {
+      positionals++;
+      selectedProgram = true;
+    }
+  }
+  const redirs = stmt.Redirs || cmd.Redirs || [];
+  const stdinFed = redirs.some((r) => r && redirStdinOps().has(r.Op));
+  if (positionals === 0 && (stdinFed || pipeFed)) {
+    if (!/^(bash|sh|zsh)$/i.test(interp)) return true;
+  }
+  return false;
+}
+function detectInlineExec(command) {
+  const f = parseShared(command);
+  if (f === PARSE_FAIL) {
+    return /(^|[|;&]|&&)\s*(?:[\w./-]*\/)?(python[\d.]*|perl|ruby|node|php|lua|deno|bun|pwsh|osascript|rscript|bash|sh|zsh)\s+-{1,2}[a-z]*[ceEr]/i.test(
+      command
+    );
+  }
+  let found = false;
+  try {
+    syntax.Walk(f, (node) => {
+      if (!node || found) return false;
+      const n = node;
+      const t = syntax.NodeType(n);
+      if (t === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
+        if (inlineExecStmt(n.Y, true)) {
+          found = true;
+          return false;
+        }
+      }
+      if (t === "Stmt" && inlineExecStmt(n, false)) {
+        found = true;
+        return false;
+      }
+      return true;
+    });
+  } catch {
+    return found;
+  }
+  return found;
+}
 function analyzeChmod777(command) {
   if (!/chmod/i.test(command.replace(/[\\'"]/g, ""))) return null;
   if (!chmodHasOpenPermMode(command)) return null;
@@ -2064,117 +2464,6 @@ function parseAllSshHostsFromCommand(command) {
   return extractAllSshHosts(tokens.slice(1));
 }
 
-// src/rules/index.ts
-var import_picomatch = __toESM(require("picomatch"));
-
-// src/utils/regex.ts
-var import_safe_regex22 = __toESM(require("safe-regex2"));
-var MAX_REGEX_LENGTH = 100;
-var REGEX_CACHE_MAX = 500;
-var regexCache = /* @__PURE__ */ new Map();
-function validateRegex(pattern) {
-  if (!pattern) return "Pattern is required";
-  if (pattern.length > MAX_REGEX_LENGTH) return `Pattern exceeds max length of ${MAX_REGEX_LENGTH}`;
-  try {
-    new RegExp(pattern);
-  } catch (e) {
-    return `Invalid regex syntax: ${e.message}`;
-  }
-  if (/\\\d+[*+{]/.test(pattern)) return "Quantified backreferences are forbidden (ReDoS risk)";
-  if (!(0, import_safe_regex22.default)(pattern)) return "Pattern rejected: potential ReDoS vulnerability detected";
-  return null;
-}
-function getCompiledRegex(pattern, flags = "") {
-  if (flags && !/^[gimsuy]+$/.test(flags)) return null;
-  const key = `${pattern}\0${flags}`;
-  if (regexCache.has(key)) {
-    const cached = regexCache.get(key);
-    regexCache.delete(key);
-    regexCache.set(key, cached);
-    return cached;
-  }
-  if (validateRegex(pattern) !== null) return null;
-  try {
-    const re = new RegExp(pattern, flags);
-    if (regexCache.size >= REGEX_CACHE_MAX) {
-      const oldest = regexCache.keys().next().value;
-      if (oldest) regexCache.delete(oldest);
-    }
-    regexCache.set(key, re);
-    return re;
-  } catch {
-    return null;
-  }
-}
-
-// src/rules/index.ts
-function matchesPattern(text, patterns) {
-  const p = Array.isArray(patterns) ? patterns : [patterns];
-  if (p.length === 0) return false;
-  const isMatch = (0, import_picomatch.default)(p, { nocase: true, dot: true });
-  const target = text.toLowerCase();
-  const directMatch = isMatch(target);
-  if (directMatch) return true;
-  const withoutDotSlash = text.replace(/^\.\//, "");
-  return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
-}
-var FORBIDDEN_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function getNestedValue(obj, path) {
-  if (!obj || typeof obj !== "object") return null;
-  const segments = path.split(".");
-  for (const seg of segments) {
-    if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
-  }
-  return segments.reduce((prev, curr) => prev?.[curr], obj);
-}
-function evaluateSmartConditions(args, rule) {
-  if (!rule.conditions || rule.conditions.length === 0) return true;
-  const mode = rule.conditionMode ?? "all";
-  const fieldCache = /* @__PURE__ */ new Map();
-  const resolveField = (field) => {
-    if (fieldCache.has(field)) return fieldCache.get(field) ?? null;
-    const rawVal = getNestedValue(args, field);
-    const rawStr = rawVal !== null && rawVal !== void 0 ? String(rawVal) : null;
-    const stripped = field === "command" && rawStr !== null ? normalizeCommandForPolicy(rawStr) : rawStr;
-    const val = stripped !== null ? stripped.replace(/\s+/g, " ").trim() : null;
-    fieldCache.set(field, val);
-    return val;
-  };
-  const results = rule.conditions.map((cond) => {
-    const val = resolveField(cond.field);
-    switch (cond.op) {
-      case "exists":
-        return val !== null && val !== "";
-      case "notExists":
-        return val === null || val === "";
-      case "contains":
-        return val !== null && cond.value ? val.includes(cond.value) : false;
-      case "notContains":
-        return val !== null && cond.value ? !val.includes(cond.value) : true;
-      case "matches": {
-        if (val === null || !cond.value) return false;
-        const reM = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reM) return false;
-        return reM.test(val);
-      }
-      case "notMatches": {
-        if (!cond.value) return false;
-        if (val === null) return true;
-        const reN = getCompiledRegex(cond.value, cond.flags ?? "");
-        if (!reN) return false;
-        return !reN.test(val);
-      }
-      case "matchesGlob":
-        return val !== null && cond.value ? import_picomatch.default.isMatch(val, cond.value) : false;
-      case "notMatchesGlob":
-        return val !== null && cond.value ? !import_picomatch.default.isMatch(val, cond.value) : false;
-      default:
-        return false;
-    }
-  });
-  return mode === "any" ? results.some((r) => r) : results.every((r) => r);
-}
-
 // src/policy/index.ts
 function resolveCheck(v) {
   return v === "off" || v === "block" ? v : "review";
@@ -2182,41 +2471,6 @@ function resolveCheck(v) {
 function resolveCheckTight(v) {
   return v === "block" ? "block" : "review";
 }
-var INLINE_INTERP = /^(python[\d.]*|bash|sh|zsh|perl|ruby|node|php|lua)$/i;
-var INLINE_SHELL = /^(bash|sh|zsh)$/i;
-function detectInlineExec(command) {
-  const pipeFed = command.includes("|");
-  const segments = command.split(/\|\||&&|;|\||\n|\$\(|`|\(/);
-  for (const rawSeg of segments) {
-    const tokens = rawSeg.trim().split(/\s+/).filter(Boolean);
-    let i = 0;
-    while (i < tokens.length && /^[A-Za-z_]\w*=/.test(tokens[i])) i++;
-    if (i >= tokens.length) continue;
-    const base = tokens[i].split("/").pop() ?? tokens[i];
-    if (!INLINE_INTERP.test(base)) continue;
-    const args = tokens.slice(i + 1);
-    let hadRedirect = false;
-    const positionals = [];
-    for (let j = 0; j < args.length; j++) {
-      const a = args[j];
-      if (a === "-") return true;
-      if (a.startsWith("<")) {
-        hadRedirect = true;
-        if (a === "<" || a === "<<") j++;
-        continue;
-      }
-      if (a.startsWith("-")) {
-        if (/^-(c|e|eval)$/i.test(a)) return true;
-        continue;
-      }
-      positionals.push(a);
-    }
-    if (positionals.length === 0 && (hadRedirect || pipeFed) && !INLINE_SHELL.test(base)) {
-      return true;
-    }
-  }
-  return false;
-}
 var VERDICT_RANK = {
   allow: 0,
   review: 1,
@@ -2230,6 +2484,12 @@ function resolvePinned(matches) {
     (best, r) => VERDICT_RANK[r.verdict] > VERDICT_RANK[best.verdict] ? r : best
   );
 }
+function strictestVerdict(candidates) {
+  if (candidates.length === 0) return void 0;
+  return candidates.reduce(
+    (best, c) => VERDICT_RANK[c.decision] > VERDICT_RANK[best.decision] ? c : best
+  );
+}
 function tokenize2(toolName) {
   return toolName.toLowerCase().split(/[_.\-\s]+/).filter(Boolean);
 }
@@ -2241,6 +2501,11 @@ function extractShellCommand(toolName, args, toolInspection) {
   const value = getNestedValue(args, fieldPath);
   return typeof value === "string" ? value : null;
 }
+function inspectsShellCommand(toolName, toolInspection) {
+  const patterns = Object.keys(toolInspection);
+  const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
+  return matchingPattern !== void 0 && toolInspection[matchingPattern] === "command";
+}
 function isSqlTool(toolName, toolInspection) {
   const patterns = Object.keys(toolInspection);
   const matchingPattern = patterns.find((p) => matchesPattern(toolName, p));
@@ -2312,8 +2577,10 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
       };
     }
   }
-  if (wouldBeIgnored) return { decision: "allow" };
-  const bashCommand = agent !== "Terminal" && isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : null;
+  if (wouldBeIgnored && !context.skipIgnoredFastPath) return { decision: "allow" };
+  const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
+  const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
+  const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -2363,8 +2630,14 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   }
   if (config.policy.smartRules.length > 0) {
     const rmCleanupWaiver = bashCommand !== null && isRmCreatedInCommandCleanup(bashCommand);
+    const astSuppressed = (rule) => {
+      if (bashCommand === null || !rule.name || !AST_FS_REGEX_RULES.has(rule.name)) return false;
+      const knob = rule.name === "review-drop-truncate-shell" ? resolveCheck(config.policy.commandChecks?.sqlDdl) : rule.name === "shield:filesystem:review-chmod-777" ? resolveCheck(config.policy.commandChecks?.chmod) : void 0;
+      if (knob === "off" && rule.pinned) return false;
+      return true;
+    };
     const matches = config.policy.smartRules.filter(
-      (rule) => matchesPattern(toolName, rule.tool) && !(bashCommand !== null && rule.name && AST_FS_REGEX_RULES.has(rule.name)) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
+      (rule) => toolMatchesRule(toolName, rule.tool, config.policy.toolInspection) && !astSuppressed(rule) && !(rmCleanupWaiver && rule.name === "review-rm" && rule.verdict === "review") && evaluateSmartConditions(args, rule)
     );
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
@@ -2395,15 +2668,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const analyzed = analyzeShellCommand(shellCommand);
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
-    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
-    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
-      return {
-        decision: inlineAction === "block" ? "block" : "review",
-        blockedByLabel: "Node9 Standard (Inline Execution)",
-        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
-        tier: 3
-      };
-    }
+    const candidates = [];
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {
@@ -2414,24 +2679,33 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         tier: 3
       };
     }
+    const ptVerdict = pipeChainVerdict(
+      shellCommand,
+      isTrustedHost,
+      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
+    );
+    if (ptVerdict?.decision === "allow") return ptVerdict;
+    if (ptVerdict) candidates.push(ptVerdict);
+    const inlineAction = resolveCheck(config.policy.commandChecks?.inlineExec);
+    if (inlineAction !== "off" && detectInlineExec(shellCommand)) {
+      candidates.push({
+        decision: inlineAction === "block" ? "block" : "review",
+        blockedByLabel: "Node9 Standard (Inline Execution)",
+        ruleDescription: "The AI is running code directly from the command line. Review the full script below before allowing it to execute.",
+        tier: 3
+      });
+    }
     if (evalVerdict === "review") {
-      return {
-        // Class B tighten-only: commandChecks.evalDynamic may upgrade to
-        // block but can never turn this off (eval-remote above is Class A —
-        // no knob at all).
+      candidates.push({
         decision: resolveCheckTight(config.policy.commandChecks?.evalDynamic),
         blockedByLabel: "Node9: Eval Dynamic Content",
         reason: "eval of dynamic content (variable or subshell expansion) requires approval",
         ruleDescription: "The AI is running a command that includes a variable or subshell expansion. The actual command executed at runtime may differ from what is shown here.",
         tier: 3
-      };
+      });
     }
-    const ptVerdict = pipeChainVerdict(
-      shellCommand,
-      isTrustedHost,
-      resolveCheckTight(config.policy.commandChecks?.pipeChainHigh)
-    );
-    if (ptVerdict) return ptVerdict;
+    const builtin = strictestVerdict(candidates);
+    if (builtin) return builtin;
     if (config.policy.egress?.enabled) {
       const dests = extractShellDestinations(shellCommand);
       if (dests.length > 0) {
@@ -3696,15 +3970,15 @@ function detectArgsPii(args) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v6";
-var CANONICAL_EXTRACTOR_HASH = "a0e2bb339fe67e19";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
+var CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
   const ts = call.timestamp;
   const toolNameLower = call.toolName.toLowerCase();
   const command = typeof call.args.command === "string" ? call.args.command : null;
-  const isBash = isBashTool(call.toolName) && command !== null;
+  const isShell = isShellShapedTool(call.toolName, ctx.toolInspection) && command !== null;
   if (call.outputBytes !== void 0 && call.outputBytes > LONG_OUTPUT_THRESHOLD_BYTES) {
     out.push(
       makeFinding({
@@ -3779,7 +4053,7 @@ function extractCanonicalFindings(call, ctx) {
       );
     }
   }
-  if (!isBash || command === null) {
+  if (!isShell || command === null) {
     return out;
   }
   const fsVerdict = analyzeFsOperation(command);
@@ -3805,7 +4079,7 @@ function extractCanonicalFindings(call, ctx) {
   for (const source of ctx.rules) {
     const r = source.rule;
     if (r.verdict === "allow") continue;
-    if (r.tool && !matchesPattern(toolNameLower, r.tool)) continue;
+    if (!toolMatchesRule(toolNameLower, r.tool, ctx.toolInspection)) continue;
     if (r.name && AST_FS_REGEX_RULES.has(r.name)) continue;
     if (!evaluateSmartConditions(call.args, r)) continue;
     out.push(
@@ -4082,6 +4356,7 @@ var ENGINE_VERSION = "1.4.0";
   detectArgsPii,
   detectDangerousEval,
   detectDangerousShellExec,
+  detectInlineExec,
   detectPii,
   evaluateEgress,
   evaluateLoopWindow,
@@ -4100,6 +4375,7 @@ var ENGINE_VERSION = "1.4.0";
   isIgnoredTool,
   isPrivateHost,
   isProtectedHomePath,
+  isShellShapedTool,
   isShieldVerdict,
   matchSensitivePath,
   matchesPattern,
@@ -4117,6 +4393,7 @@ var ENGINE_VERSION = "1.4.0";
   summarizeBlast,
   summarizeScan,
   toScanFinding,
+  toolMatchesRule,
   truncateBlastPath,
   validateOverrides,
   validateRegex,