@node9/policy-engine 1.67.2 → 1.67.3

package/dist/index.d.mts

@@ -1117,7 +1117,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1128,7 +1128,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "80f40f974263b281";
+declare const CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.d.ts

@@ -1117,7 +1117,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1128,7 +1128,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "80f40f974263b281";
+declare const CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**

package/dist/index.js

@@ -1160,9 +1160,34 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "vi",
   "emacs",
   "code",
-  "type"
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
 ]);
-var FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
   ".npm/_npx",
@@ -1201,9 +1226,37 @@ var SENSITIVE_PATH_RULES = [
     // for the canonical test-asserted contract.
     rule: "shield:project-jail:block-read-env",
     reason: "Reading .env files is blocked by project-jail shield",
-    match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-      p
-    )
+    // Structural, not a list. The previous form enumerated seven suffixes and
+    // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+    // gitignored, all routinely holding real secrets — were never covered. A
+    // hand-written list of what to protect is only ever as complete as the day
+    // it was typed; this says "`.env` plus any suffix chain" and then names the
+    // exceptions, which is the direction that fails safe.
+    //
+    //   \.env          the segment itself
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //                  files. Without it a flat suffix class swallows both.
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+    //                  `(\.[\w-]+)*` reads the same but is rejected by
+    //                  safe-regex2, and this pattern runs on the hook hot path.
+    //
+    // The two exclusions are NOT the same shape, because the words do not mean
+    // the same thing:
+    //
+    //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+    //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+    //     These are checked into git by convention: already public, so blocking
+    //     them buys nothing and costs the most common legitimate agent read.
+    //
+    //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+    //     fixture. `.env.test` is the committed template and stays allowed, but
+    //     `.env.test.local` is gitignored by the `.env*.local` convention and
+    //     holds real values, so it must block. Using `\b` here — the obvious
+    //     symmetry — silently exempts every `.env.test.*` file.
+    //
+    // shields.test.ts:983-995 is the canonical contract; keep both in step.
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -3917,8 +3970,8 @@ function detectArgsPii(args) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
-var CANONICAL_EXTRACTOR_HASH = "80f40f974263b281";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
+var CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];

package/dist/index.mjs

@@ -1047,9 +1047,34 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "vi",
   "emacs",
   "code",
-  "type"
+  "type",
+  // — the 22 that were missing —
+  "grep",
+  "egrep",
+  "fgrep",
+  "rg",
+  "ag",
+  "ack",
+  "awk",
+  "gawk",
+  "sed",
+  "cut",
+  "tr",
+  "jq",
+  "yq",
+  "od",
+  "xxd",
+  "hexdump",
+  "strings",
+  "sort",
+  "uniq",
+  "tac",
+  "nl",
+  "dd"
 ]);
-var FS_OP_PRESCREEN_RE = /(?:^|[\s|;&(`\n])(?:rm|cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type)\b/;
+var FS_OP_PRESCREEN_RE = new RegExp(
+  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+);
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
   ".npm/_npx",
@@ -1088,9 +1113,37 @@ var SENSITIVE_PATH_RULES = [
     // for the canonical test-asserted contract.
     rule: "shield:project-jail:block-read-env",
     reason: "Reading .env files is blocked by project-jail shield",
-    match: (p) => /(?:^|[\\/])\.env(?:\.(?:local|production|staging|development|production\.local|staging\.local|development\.local))?$/i.test(
-      p
-    )
+    // Structural, not a list. The previous form enumerated seven suffixes and
+    // anchored on `$`, so `.env.prod`, `.env.ci` and `.env.local.bak` — all
+    // gitignored, all routinely holding real secrets — were never covered. A
+    // hand-written list of what to protect is only ever as complete as the day
+    // it was typed; this says "`.env` plus any suffix chain" and then names the
+    // exceptions, which is the direction that fails safe.
+    //
+    //   \.env          the segment itself
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //                  files. Without it a flat suffix class swallows both.
+    //   (?![\w-])      a boundary, so `.environment` and `.envrc` are NOT .env
+    //   [\w.-]*$       any suffix chain. Flat class, no nested quantifier —
+    //                  `(\.[\w-]+)*` reads the same but is rejected by
+    //                  safe-regex2, and this pattern runs on the hook hot path.
+    //
+    // The two exclusions are NOT the same shape, because the words do not mean
+    // the same thing:
+    //
+    //   (?!\.(?:example|sample|template)\b)  — "this file is a fixture", and it
+    //     stays a fixture whatever follows, so `.env.example.md` is allowed too.
+    //     These are checked into git by convention: already public, so blocking
+    //     them buys nothing and costs the most common legitimate agent read.
+    //
+    //   (?!\.test$)  — anchored, because `test` names an ENVIRONMENT, not a
+    //     fixture. `.env.test` is the committed template and stays allowed, but
+    //     `.env.test.local` is gitignored by the `.env*.local` convention and
+    //     holds real values, so it must block. Using `\b` here — the obvious
+    //     symmetry — silently exempts every `.env.test.*` file.
+    //
+    // shields.test.ts:983-995 is the canonical contract; keep both in step.
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -3804,8 +3857,8 @@ function detectArgsPii(args) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v8";
-var CANONICAL_EXTRACTOR_HASH = "80f40f974263b281";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v9";
+var CANONICAL_EXTRACTOR_HASH = "4ebf40dfe1d7c0a1";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "1.67.2",
+  "version": "1.67.3",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",