@node9/policy-engine 2.12.0 → 2.13.1

package/dist/index.d.mts

@@ -217,6 +217,7 @@ interface FsOpVerdict {
 declare const BASH_TOOL_NAMES: Set<string>;
 declare function isBashTool(toolName: string): boolean;
 declare const AST_FS_REGEX_RULES: Set<string>;
+declare const COMMAND_WRAPPERS: Set<string>;
 /**
  * Does `toolName` carry a shell command? True for BASH_TOOL_NAMES spellings and
  * for any tool whose toolInspection field is `command` (e.g. `terminal.execute`).
@@ -235,6 +236,11 @@ declare function isShellShapedTool(toolName: string, toolInspection?: Record<str
  * void them. An absent rule scope matches everything (callers' prior semantics).
  */
 declare function toolMatchesRule(toolName: string, ruleTool: string | string[] | undefined, toolInspection?: Record<string, string>): boolean;
+/** Strip leading wrappers/runners from a resolved arg list, returning the index
+ *  of the real command head. Handles `sudo -u www python3`, `env -u FOO python3`,
+ *  `timeout 5 python3`, `uv run python`, `conda run -n env python`,
+ *  `chroot /mnt python3`. */
+declare function unwrapCommandHead(words: (string | null)[]): number;
 /**
  * AST-aware inline-execution detector. Returns true when the command runs code
  * supplied on the command line, via stdin, or via a pipe into a bare
@@ -255,6 +261,7 @@ interface ShellDestination {
     /** The raw argument token the host came from (for UI / audit). */
     raw: string;
 }
+declare const NET_BINARIES: Set<string>;
 /**
  * Parse a destination host out of a single token. Handles scheme URLs
  * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
@@ -1196,7 +1203,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v13";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1207,7 +1214,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+declare const CANONICAL_EXTRACTOR_HASH = "4622a2f41696af04";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1327,4 +1334,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.d.ts

@@ -217,6 +217,7 @@ interface FsOpVerdict {
 declare const BASH_TOOL_NAMES: Set<string>;
 declare function isBashTool(toolName: string): boolean;
 declare const AST_FS_REGEX_RULES: Set<string>;
+declare const COMMAND_WRAPPERS: Set<string>;
 /**
  * Does `toolName` carry a shell command? True for BASH_TOOL_NAMES spellings and
  * for any tool whose toolInspection field is `command` (e.g. `terminal.execute`).
@@ -235,6 +236,11 @@ declare function isShellShapedTool(toolName: string, toolInspection?: Record<str
  * void them. An absent rule scope matches everything (callers' prior semantics).
  */
 declare function toolMatchesRule(toolName: string, ruleTool: string | string[] | undefined, toolInspection?: Record<string, string>): boolean;
+/** Strip leading wrappers/runners from a resolved arg list, returning the index
+ *  of the real command head. Handles `sudo -u www python3`, `env -u FOO python3`,
+ *  `timeout 5 python3`, `uv run python`, `conda run -n env python`,
+ *  `chroot /mnt python3`. */
+declare function unwrapCommandHead(words: (string | null)[]): number;
 /**
  * AST-aware inline-execution detector. Returns true when the command runs code
  * supplied on the command line, via stdin, or via a pipe into a bare
@@ -255,6 +261,7 @@ interface ShellDestination {
     /** The raw argument token the host came from (for UI / audit). */
     raw: string;
 }
+declare const NET_BINARIES: Set<string>;
 /**
  * Parse a destination host out of a single token. Handles scheme URLs
  * (`https://h/p`), scheme-less curl targets (`evil.com/p`), `user@host:path`
@@ -1196,7 +1203,7 @@ declare const LONG_OUTPUT_THRESHOLD_BYTES: number;
  * and fails CI when the hash drifts without a version bump — forgetting
  * is loud, not silent.
  */
-declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
+declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v13";
 /**
  * SHA-256 prefix of the detector-source files
  * (canonical.ts + pii.ts + destructive-regex.ts).
@@ -1207,7 +1214,7 @@ declare const CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
  * files changed, this hash must change too, and you must consciously
  * decide whether to bump CANONICAL_EXTRACTOR_VERSION."
  */
-declare const CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+declare const CANONICAL_EXTRACTOR_HASH = "4622a2f41696af04";
 declare function extractCanonicalFindings(call: ToolCallEntry, ctx: ExtractContext): CanonicalFinding[];
 declare function extractSessionLevelFindings(calls: ReadonlyArray<SessionToolCall>, ctx: SessionExtractContext): CanonicalFinding[];
 /**
@@ -1327,4 +1334,4 @@ declare function ssrfDestinationFloor(toolName: string, args: unknown, opts?: {
 /** Engine version stamped on audit entries for future drift detection. */
 declare const ENGINE_VERSION = "1.4.0";
 
-export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, validateOverrides, validateRegex, validateShieldDefinition };
+export { AST_FS_REGEX_RULES, type AuditEntryForClassify, BASH_TOOL_NAMES, BUILTIN_SHIELDS, type BlastEnvFinding, type BlastFinding, type BlastResult, type BlastSummary, CANARY_MIN_LENGTH, CANONICAL_EXTRACTOR_HASH, CANONICAL_EXTRACTOR_VERSION, COMMAND_WRAPPERS, COST_PER_LOOP_ITER_USD, type CanaryHit, type CanaryValue, type CanaryView, type CanonicalAgent, type CanonicalFinding, type CanonicalFindingType, type CanonicalSourceType, DEFAULT_EGRESS_ALLOWLIST, DESTINATION_ARGS, DESTRUCTIVE_OP_RE, DLP_PATTERNS, DLP_SCAN_LIMITS, type DlpMatch, ENGINE_VERSION, type EgressPolicy, type EgressVerdict, type ExtractContext, FILE_TOOLS, FLAGS_WITH_VALUES, FS_READ_TOOLS, type FsOpVerdict, type InjectionConfidence, type InjectionContext, type InjectionMatch, LONG_OUTPUT_THRESHOLD_BYTES, LOOP_MAX_RECORDS, LOOP_THRESHOLD_FOR_WASTE, type LoopWindowEvaluation, NET_BINARIES, PRIVILEGE_ESCALATION_RE, type PiiPattern, type PipeChainAnalysis, type PolicyConfig, type PolicyContext, type PolicyHostHooks, type PolicyVerdict, type ProvenanceLookup, type ProvenanceTrust, REALTIME_PII_PATTERNS, type RiskMetadata, SCAN_SIGNAL_WEIGHTS, SENSITIVE_PATH_RE, SENSITIVE_PATH_REGEXES, SSRF_MAX_HOST, type ScanFinding, type ScanSignals, type ScanSummary, type ScoreTier, type SessionExtractContext, type SessionToolCall, type Severity, type ShellCommandAnalysis, type ShellDestToken, type ShellDestination, type ShieldDefinition, type ShieldOverrides, type ShieldVerdict, type SmartCondition, type SmartRule, type SsrfFloorOptions, type SsrfMatch, type SsrfTier, type SsrfVerdict, type ToolCallEntry, type ToolCallRecord, analyzeFsOperation, analyzePipeChain, analyzeShellCommand, checkDangerousSql, classifyAuditEntry, classifyRuleSeverity, classifyScanSignal, classifySsrf, computeAgentDeviceScore, computeArgsHash, computeBlendedSecurityScore, computeScanScore, computeSecurityScore, dedupeCanonicalFindings, detectArgsPii, detectDangerousEval, detectDangerousShellExec, detectInlineExec, detectPii, evaluateEgress, evaluateLoopWindow, evaluatePolicy, evaluateSmartConditions, extractAllSshHosts, extractCanonicalFindings, extractNetworkTargets, extractPositionalArgs, extractSessionLevelFindings, extractShellDestTokens, extractShellDestinations, getCompiledRegex, getNestedValue, hostMatches, isBashTool, isIgnoredTool, isPrivateHost, isProtectedHomePath, isShellShapedTool, isShieldVerdict, isStrictGatedTier, matchCanary, matchCanaryArgs, matchSensitivePath, matchesPattern, narrativeRuleLabel, normalizeCommandForPolicy, normalizeIpLiteral, parseAllSshHostsFromCommand, parseDestHost, previewArgs, redactText, resolvePinned, scanArgs, scanInjection, scanText, sensitivePathMatch, ssrfDestinationFloor, ssrfFloor, ssrfReason, summarizeBlast, summarizeScan, toScanFinding, toolMatchesRule, truncateBlastPath, unwrapCommandHead, validateOverrides, validateRegex, validateShieldDefinition };

package/dist/index.js

@@ -36,6 +36,7 @@ __export(src_exports, {
   CANARY_MIN_LENGTH: () => CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH: () => CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION: () => CANONICAL_EXTRACTOR_VERSION,
+  COMMAND_WRAPPERS: () => COMMAND_WRAPPERS,
   COST_PER_LOOP_ITER_USD: () => COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST: () => DEFAULT_EGRESS_ALLOWLIST,
   DESTINATION_ARGS: () => DESTINATION_ARGS,
@@ -49,6 +50,7 @@ __export(src_exports, {
   LONG_OUTPUT_THRESHOLD_BYTES: () => LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS: () => LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE: () => LOOP_THRESHOLD_FOR_WASTE,
+  NET_BINARIES: () => NET_BINARIES,
   PRIVILEGE_ESCALATION_RE: () => PRIVILEGE_ESCALATION_RE,
   REALTIME_PII_PATTERNS: () => REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS: () => SCAN_SIGNAL_WEIGHTS,
@@ -119,6 +121,7 @@ __export(src_exports, {
   toScanFinding: () => toScanFinding,
   toolMatchesRule: () => toolMatchesRule,
   truncateBlastPath: () => truncateBlastPath,
+  unwrapCommandHead: () => unwrapCommandHead,
   validateOverrides: () => validateOverrides,
   validateRegex: () => validateRegex,
   validateShieldDefinition: () => validateShieldDefinition
@@ -844,13 +847,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -1409,6 +1431,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -1417,7 +1443,11 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "dd"
 ]);
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -1438,12 +1468,12 @@ var SENSITIVE_PATH_RULES = [
   {
     rule: "shield:project-jail:block-read-ssh",
     reason: "Reading SSH private keys is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.ssh[\\/]/i.test(p)
+    match: (p) => /([\\/]\.ssh[\\/]|^\.ssh[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.ssh$)/i.test(p)
   },
   {
     rule: "shield:project-jail:block-read-aws",
     reason: "Reading AWS credentials is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.aws[\\/]/i.test(p)
+    match: (p) => /([\\/]\.aws[\\/]|^\.aws[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.aws$)/i.test(p)
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
@@ -1487,7 +1517,9 @@ var SENSITIVE_PATH_RULES = [
     //     symmetry — silently exempts every `.env.test.*` file.
     //
     // shields.test.ts:983-995 is the canonical contract; keep both in step.
-    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i.test(
+      p
+    )
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1698,15 +1730,14 @@ function listOps() {
   return _listOps;
 }
 var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
 function unwrapCommandHead(words) {
   let i = 0;
   while (i < words.length) {
     const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
     if (head === "find") {
-      const x = words.findIndex(
-        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
-      );
+      const x = words.findIndex((w, k) => k > i && w !== null && FIND_EXEC_FLAGS.has(w));
       if (x < 0) break;
       i = x + 1;
       continue;
@@ -1728,7 +1759,11 @@ function unwrapCommandHead(words) {
       if (t.startsWith("-")) {
         i++;
         const nxt = words[i];
-        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()) && // A reader is a command, never a flag's operand: `env - cat X`,
+        // `stdbuf -o0 cat X`, `ionice -c3 cat X`. Without this the head was
+        // swallowed and the jail needed a looser fallback whose cost was a
+        // false positive on `sudo echo cat X`.
+        !FS_READ_TOOLS.has(nxt.split("/").pop()?.toLowerCase() ?? ""))
           i++;
         continue;
       }
@@ -1849,36 +1884,29 @@ function isProtectedHomePath(rawPath) {
 }
 function extractLiteralArgs(callExpr) {
   const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [] };
-  const litFromWord = (w) => {
-    const parts = w?.Parts || [];
-    let s = "";
-    for (const p of parts) {
-      const t = syntax.NodeType(p);
-      if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-      else if (t === "SglQuoted") s += p.Value ?? "";
-      else if (t === "DblQuoted") {
-        const inner = p.Parts || [];
-        if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-        s += inner.map((ip) => ip.Value ?? "").join("");
-      } else {
-        return null;
-      }
-    }
-    return s;
-  };
-  const name = (litFromWord(args[0]) || "").toLowerCase();
+  if (args.length === 0) return { name: "", flags: [], paths: [], words: [] };
+  const words = args.map((a) => resolveWordLiteral(a));
+  const name = (words[0] ?? "").toLowerCase();
   const flags = [];
   const paths = [];
-  for (let i = 1; i < args.length; i++) {
-    const v = litFromWord(args[i]);
+  for (let i = 1; i < words.length; i++) {
+    const v = words[i];
     if (v === null) continue;
     if (v.startsWith("-")) flags.push(v);
     else paths.push(v);
   }
-  return { name, flags, paths };
+  return { name, flags, paths, words };
 }
-var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+var NET_BINARIES = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "scp",
+  "ssh",
+  "nc",
+  "ncat",
+  "netcat",
+  "rsync"
+]);
 var VALUE_FLAGS = {
   curl: /* @__PURE__ */ new Set([
     "-d",
@@ -2163,6 +2191,9 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
@@ -2227,16 +2258,21 @@ function isRmCreatedInCommandCleanup(command) {
   }
   return sawRm && ok;
 }
-function analyzeFsOperationImpl(command) {
+function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
   try {
     syntax.Walk(f, (node) => {
-      if (!node || result) return false;
+      if (!node || result?.verdict === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const { name, flags, paths } = extractLiteralArgs(n);
+      const nodeType = syntax.NodeType(n);
+      if (nodeType === "Stmt") {
+        result = stricter(result, jailedRedirectRead(n));
+        return result?.verdict !== "block";
+      }
+      if (nodeType !== "CallExpr") return true;
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2265,19 +2301,22 @@ function analyzeFsOperationImpl(command) {
           }
         }
       }
-      if (FS_READ_TOOLS.has(name)) {
-        for (const p of paths) {
-          for (const sp of SENSITIVE_PATH_RULES) {
-            if (sp.match(p)) {
-              result = {
-                ruleName: sp.rule,
-                verdict: sp.verdict ?? "block",
-                reason: sp.reason,
-                path: p
-              };
-              return false;
-            }
+      if (depth < 1) {
+        const payload = literalShellPayload(words, name);
+        if (payload !== null) {
+          const inner = analyzeFsOperationImpl(payload, depth + 1);
+          if (inner) {
+            result = inner;
+            return false;
           }
+          return true;
+        }
+      }
+      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      if (readPaths) {
+        for (const p of readPaths) {
+          result = stricter(result, matchSensitivePath2(p));
+          if (result?.verdict === "block") return false;
         }
       }
       return true;
@@ -2287,6 +2326,57 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function stricter(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return b.verdict === "block" && a.verdict !== "block" ? b : a;
+}
+function matchSensitivePath2(p) {
+  for (const sp of SENSITIVE_PATH_RULES) {
+    if (sp.match(p))
+      return { ruleName: sp.rule, verdict: sp.verdict ?? "block", reason: sp.reason, path: p };
+  }
+  return null;
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(w.split("/").pop()?.toLowerCase() ?? "");
+var positionalAfter = (words, from, to = words.length) => words.slice(from, to).filter((w) => w !== null && !w.startsWith("-"));
+function wrappedReadPaths(words, name) {
+  if (name === "find") {
+    const k = words.findIndex((w) => w !== null && FIND_EXEC_FLAGS.has(w));
+    if (k < 1 || !isReaderWord(words[k + 1] ?? null)) return null;
+    const firstPredicate = words.findIndex((w, i) => i > 0 && w !== null && w.startsWith("-"));
+    return positionalAfter(words, 1, firstPredicate > 0 ? firstPredicate : k);
+  }
+  if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
+  const h = unwrapCommandHead(words);
+  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+}
+function literalShellPayload(words, name) {
+  const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
+  const head = (words[h] ?? "").split("/").pop()?.toLowerCase() ?? "";
+  if (head === "eval") {
+    const rest = words.slice(h + 1);
+    if (rest.length === 0 || rest.some((w) => w === null)) return null;
+    return rest.join(" ");
+  }
+  if (SHELL_INTERPRETERS.has(head)) {
+    const c = words.findIndex((w, i) => i > h && w !== null && isInlineCodeFlag(head, w));
+    if (c < 0) return null;
+    return words[c + 1] ?? null;
+  }
+  return null;
+}
+function jailedRedirectRead(stmt) {
+  const redirs = stmt.Redirs || [];
+  for (const r of redirs) {
+    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    const p = resolveWordLiteral(r.Word);
+    if (p === null || p === "") continue;
+    const hit = matchSensitivePath2(p);
+    if (hit) return hit;
+  }
+  return null;
+}
 function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -2423,21 +2513,7 @@ function evaluateEgress(dests, policy) {
 }
 
 // src/policy/pipe-chain.ts
-var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
-  "cat",
-  "head",
-  "tail",
-  "grep",
-  "awk",
-  "sed",
-  "cut",
-  "sort",
-  "tee",
-  "less",
-  "more",
-  "strings",
-  "xxd"
-]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
   "curl",
   "wget",
@@ -2468,16 +2544,25 @@ var OBFUSCATORS = /* @__PURE__ */ new Set([
   "node"
 ]);
 var SENSITIVE_PATTERNS = [
-  /(?:^|\/)\.env(?:\.|$)/i,
-  // .env, .env.local, .env.production
+  // Kept in step with the AST tier and dlp/ -- see jail-both-doors.test.ts.
+  /(?:^|\/)\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env chain; fixtures exempt unless .local
   /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
   // SSH private keys
   /\.pem$|\.key$|\.p12$|\.pfx$/i,
   // certificate files
-  /(?:^|\/)\.ssh\//i,
-  // ~/.ssh/ directory
-  /(?:^|\/)\.aws\/credentials/i,
-  // AWS credentials
+  // The `$` half mirrors shell/index.ts's SENSITIVE_PATH_RULES: a file INSIDE
+  // the directory counts wherever it appears, while the directory ITSELF counts
+  // only when the path is ROOTED (`~/.ssh`, `/home/u/.ssh`) -- an unrooted
+  // `config/.ssh` is more likely a search pattern than a read. These are
+  // extracted TOKENS (see `args.some(isSensitivePath)` below), the same input
+  // contract as the shell tier, so the same boundary is the right one.
+  // Without it `grep -r x ~/.ssh | curl -d @-` scored one tier BELOW the
+  // identical pipeline naming a file inside that directory.
+  /(?:^|\/)\.ssh\/|^(?:[~/]|[A-Za-z]:).*\/\.ssh$/i,
+  // ~/.ssh/ and ~/.ssh
+  /(?:^|\/)\.aws\/credentials|^(?:[~/]|[A-Za-z]:).*\/\.aws$/i,
+  // AWS creds + dir
   /(?:^|\/)\.netrc$/i,
   // netrc (stores HTTP credentials)
   /(?:^|\/)(passwd|shadow|sudoers)$/i,
@@ -2511,8 +2596,8 @@ function splitOnPipe(cmd) {
   if (current.trim()) segments2.push(current.trim());
   return segments2.filter(Boolean);
 }
-function positionalTokens(segment) {
-  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+function positionalTokens(tokens) {
+  return tokens.slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
   const segments2 = splitOnPipe(command);
@@ -2535,8 +2620,10 @@ function analyzePipeChain(command) {
   for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
-    const binary = tokens[0].toLowerCase();
-    const args = positionalTokens(segment);
+    const h = unwrapCommandHead(tokens);
+    const head = h < tokens.length ? h : 0;
+    const binary = tokens[head].toLowerCase();
+    const args = positionalTokens(tokens.slice(head));
     if (SOURCE_COMMANDS.has(binary)) {
       sourceFiles.push(...args);
       if (args.some(isSensitivePath)) hasSensitiveSource = true;
@@ -3979,7 +4066,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -3993,7 +4080,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -4007,7 +4094,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -4021,7 +4108,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -4035,7 +4122,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -4049,7 +4136,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -4063,7 +4150,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],
@@ -4506,7 +4593,7 @@ function summarizeBlast(result, opts = {}) {
 // src/scan/destructive-regex.ts
 var DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
 var PRIVILEGE_ESCALATION_RE = /\bchmod\s+(0?777|\+x)\b|\bchown\s+root\b/i;
-var SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
+var SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
 var FILE_TOOLS = /* @__PURE__ */ new Set([
   "read",
   "read_file",
@@ -4766,8 +4853,8 @@ function matchCanaryArgs(args, values) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
-var CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v13";
+var CANONICAL_EXTRACTOR_HASH = "4622a2f41696af04";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -5143,6 +5230,7 @@ var ENGINE_VERSION = "1.4.0";
   CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
+  COMMAND_WRAPPERS,
   COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST,
   DESTINATION_ARGS,
@@ -5156,6 +5244,7 @@ var ENGINE_VERSION = "1.4.0";
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
+  NET_BINARIES,
   PRIVILEGE_ESCALATION_RE,
   REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS,
@@ -5226,6 +5315,7 @@ var ENGINE_VERSION = "1.4.0";
   toScanFinding,
   toolMatchesRule,
   truncateBlastPath,
+  unwrapCommandHead,
   validateOverrides,
   validateRegex,
   validateShieldDefinition

package/dist/index.mjs

@@ -717,13 +717,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -1282,6 +1301,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -1290,7 +1313,11 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "dd"
 ]);
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -1311,12 +1338,12 @@ var SENSITIVE_PATH_RULES = [
   {
     rule: "shield:project-jail:block-read-ssh",
     reason: "Reading SSH private keys is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.ssh[\\/]/i.test(p)
+    match: (p) => /([\\/]\.ssh[\\/]|^\.ssh[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.ssh$)/i.test(p)
   },
   {
     rule: "shield:project-jail:block-read-aws",
     reason: "Reading AWS credentials is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.aws[\\/]/i.test(p)
+    match: (p) => /([\\/]\.aws[\\/]|^\.aws[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.aws$)/i.test(p)
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
@@ -1360,7 +1387,9 @@ var SENSITIVE_PATH_RULES = [
     //     symmetry — silently exempts every `.env.test.*` file.
     //
     // shields.test.ts:983-995 is the canonical contract; keep both in step.
-    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i.test(
+      p
+    )
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1571,15 +1600,14 @@ function listOps() {
   return _listOps;
 }
 var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
 function unwrapCommandHead(words) {
   let i = 0;
   while (i < words.length) {
     const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
     if (head === "find") {
-      const x = words.findIndex(
-        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
-      );
+      const x = words.findIndex((w, k) => k > i && w !== null && FIND_EXEC_FLAGS.has(w));
       if (x < 0) break;
       i = x + 1;
       continue;
@@ -1601,7 +1629,11 @@ function unwrapCommandHead(words) {
       if (t.startsWith("-")) {
         i++;
         const nxt = words[i];
-        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()) && // A reader is a command, never a flag's operand: `env - cat X`,
+        // `stdbuf -o0 cat X`, `ionice -c3 cat X`. Without this the head was
+        // swallowed and the jail needed a looser fallback whose cost was a
+        // false positive on `sudo echo cat X`.
+        !FS_READ_TOOLS.has(nxt.split("/").pop()?.toLowerCase() ?? ""))
           i++;
         continue;
       }
@@ -1722,36 +1754,29 @@ function isProtectedHomePath(rawPath) {
 }
 function extractLiteralArgs(callExpr) {
   const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [] };
-  const litFromWord = (w) => {
-    const parts = w?.Parts || [];
-    let s = "";
-    for (const p of parts) {
-      const t = syntax.NodeType(p);
-      if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-      else if (t === "SglQuoted") s += p.Value ?? "";
-      else if (t === "DblQuoted") {
-        const inner = p.Parts || [];
-        if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-        s += inner.map((ip) => ip.Value ?? "").join("");
-      } else {
-        return null;
-      }
-    }
-    return s;
-  };
-  const name = (litFromWord(args[0]) || "").toLowerCase();
+  if (args.length === 0) return { name: "", flags: [], paths: [], words: [] };
+  const words = args.map((a) => resolveWordLiteral(a));
+  const name = (words[0] ?? "").toLowerCase();
   const flags = [];
   const paths = [];
-  for (let i = 1; i < args.length; i++) {
-    const v = litFromWord(args[i]);
+  for (let i = 1; i < words.length; i++) {
+    const v = words[i];
     if (v === null) continue;
     if (v.startsWith("-")) flags.push(v);
     else paths.push(v);
   }
-  return { name, flags, paths };
+  return { name, flags, paths, words };
 }
-var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+var NET_BINARIES = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "scp",
+  "ssh",
+  "nc",
+  "ncat",
+  "netcat",
+  "rsync"
+]);
 var VALUE_FLAGS = {
   curl: /* @__PURE__ */ new Set([
     "-d",
@@ -2036,6 +2061,9 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
@@ -2100,16 +2128,21 @@ function isRmCreatedInCommandCleanup(command) {
   }
   return sawRm && ok;
 }
-function analyzeFsOperationImpl(command) {
+function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
   try {
     syntax.Walk(f, (node) => {
-      if (!node || result) return false;
+      if (!node || result?.verdict === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const { name, flags, paths } = extractLiteralArgs(n);
+      const nodeType = syntax.NodeType(n);
+      if (nodeType === "Stmt") {
+        result = stricter(result, jailedRedirectRead(n));
+        return result?.verdict !== "block";
+      }
+      if (nodeType !== "CallExpr") return true;
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2138,19 +2171,22 @@ function analyzeFsOperationImpl(command) {
           }
         }
       }
-      if (FS_READ_TOOLS.has(name)) {
-        for (const p of paths) {
-          for (const sp of SENSITIVE_PATH_RULES) {
-            if (sp.match(p)) {
-              result = {
-                ruleName: sp.rule,
-                verdict: sp.verdict ?? "block",
-                reason: sp.reason,
-                path: p
-              };
-              return false;
-            }
+      if (depth < 1) {
+        const payload = literalShellPayload(words, name);
+        if (payload !== null) {
+          const inner = analyzeFsOperationImpl(payload, depth + 1);
+          if (inner) {
+            result = inner;
+            return false;
           }
+          return true;
+        }
+      }
+      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      if (readPaths) {
+        for (const p of readPaths) {
+          result = stricter(result, matchSensitivePath2(p));
+          if (result?.verdict === "block") return false;
         }
       }
       return true;
@@ -2160,6 +2196,57 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function stricter(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return b.verdict === "block" && a.verdict !== "block" ? b : a;
+}
+function matchSensitivePath2(p) {
+  for (const sp of SENSITIVE_PATH_RULES) {
+    if (sp.match(p))
+      return { ruleName: sp.rule, verdict: sp.verdict ?? "block", reason: sp.reason, path: p };
+  }
+  return null;
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(w.split("/").pop()?.toLowerCase() ?? "");
+var positionalAfter = (words, from, to = words.length) => words.slice(from, to).filter((w) => w !== null && !w.startsWith("-"));
+function wrappedReadPaths(words, name) {
+  if (name === "find") {
+    const k = words.findIndex((w) => w !== null && FIND_EXEC_FLAGS.has(w));
+    if (k < 1 || !isReaderWord(words[k + 1] ?? null)) return null;
+    const firstPredicate = words.findIndex((w, i) => i > 0 && w !== null && w.startsWith("-"));
+    return positionalAfter(words, 1, firstPredicate > 0 ? firstPredicate : k);
+  }
+  if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
+  const h = unwrapCommandHead(words);
+  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+}
+function literalShellPayload(words, name) {
+  const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
+  const head = (words[h] ?? "").split("/").pop()?.toLowerCase() ?? "";
+  if (head === "eval") {
+    const rest = words.slice(h + 1);
+    if (rest.length === 0 || rest.some((w) => w === null)) return null;
+    return rest.join(" ");
+  }
+  if (SHELL_INTERPRETERS.has(head)) {
+    const c = words.findIndex((w, i) => i > h && w !== null && isInlineCodeFlag(head, w));
+    if (c < 0) return null;
+    return words[c + 1] ?? null;
+  }
+  return null;
+}
+function jailedRedirectRead(stmt) {
+  const redirs = stmt.Redirs || [];
+  for (const r of redirs) {
+    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    const p = resolveWordLiteral(r.Word);
+    if (p === null || p === "") continue;
+    const hit = matchSensitivePath2(p);
+    if (hit) return hit;
+  }
+  return null;
+}
 function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -2296,21 +2383,7 @@ function evaluateEgress(dests, policy) {
 }
 
 // src/policy/pipe-chain.ts
-var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
-  "cat",
-  "head",
-  "tail",
-  "grep",
-  "awk",
-  "sed",
-  "cut",
-  "sort",
-  "tee",
-  "less",
-  "more",
-  "strings",
-  "xxd"
-]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
   "curl",
   "wget",
@@ -2341,16 +2414,25 @@ var OBFUSCATORS = /* @__PURE__ */ new Set([
   "node"
 ]);
 var SENSITIVE_PATTERNS = [
-  /(?:^|\/)\.env(?:\.|$)/i,
-  // .env, .env.local, .env.production
+  // Kept in step with the AST tier and dlp/ -- see jail-both-doors.test.ts.
+  /(?:^|\/)\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env chain; fixtures exempt unless .local
   /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
   // SSH private keys
   /\.pem$|\.key$|\.p12$|\.pfx$/i,
   // certificate files
-  /(?:^|\/)\.ssh\//i,
-  // ~/.ssh/ directory
-  /(?:^|\/)\.aws\/credentials/i,
-  // AWS credentials
+  // The `$` half mirrors shell/index.ts's SENSITIVE_PATH_RULES: a file INSIDE
+  // the directory counts wherever it appears, while the directory ITSELF counts
+  // only when the path is ROOTED (`~/.ssh`, `/home/u/.ssh`) -- an unrooted
+  // `config/.ssh` is more likely a search pattern than a read. These are
+  // extracted TOKENS (see `args.some(isSensitivePath)` below), the same input
+  // contract as the shell tier, so the same boundary is the right one.
+  // Without it `grep -r x ~/.ssh | curl -d @-` scored one tier BELOW the
+  // identical pipeline naming a file inside that directory.
+  /(?:^|\/)\.ssh\/|^(?:[~/]|[A-Za-z]:).*\/\.ssh$/i,
+  // ~/.ssh/ and ~/.ssh
+  /(?:^|\/)\.aws\/credentials|^(?:[~/]|[A-Za-z]:).*\/\.aws$/i,
+  // AWS creds + dir
   /(?:^|\/)\.netrc$/i,
   // netrc (stores HTTP credentials)
   /(?:^|\/)(passwd|shadow|sudoers)$/i,
@@ -2384,8 +2466,8 @@ function splitOnPipe(cmd) {
   if (current.trim()) segments2.push(current.trim());
   return segments2.filter(Boolean);
 }
-function positionalTokens(segment) {
-  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+function positionalTokens(tokens) {
+  return tokens.slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
   const segments2 = splitOnPipe(command);
@@ -2408,8 +2490,10 @@ function analyzePipeChain(command) {
   for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
-    const binary = tokens[0].toLowerCase();
-    const args = positionalTokens(segment);
+    const h = unwrapCommandHead(tokens);
+    const head = h < tokens.length ? h : 0;
+    const binary = tokens[head].toLowerCase();
+    const args = positionalTokens(tokens.slice(head));
     if (SOURCE_COMMANDS.has(binary)) {
       sourceFiles.push(...args);
       if (args.some(isSensitivePath)) hasSensitiveSource = true;
@@ -3852,7 +3936,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -3866,7 +3950,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -3880,7 +3964,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -3894,7 +3978,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -3908,7 +3992,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -3922,7 +4006,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -3936,7 +4020,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],
@@ -4379,7 +4463,7 @@ function summarizeBlast(result, opts = {}) {
 // src/scan/destructive-regex.ts
 var DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
 var PRIVILEGE_ESCALATION_RE = /\bchmod\s+(0?777|\+x)\b|\bchown\s+root\b/i;
-var SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
+var SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
 var FILE_TOOLS = /* @__PURE__ */ new Set([
   "read",
   "read_file",
@@ -4639,8 +4723,8 @@ function matchCanaryArgs(args, values) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
-var CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v13";
+var CANONICAL_EXTRACTOR_HASH = "4622a2f41696af04";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -5015,6 +5099,7 @@ export {
   CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
+  COMMAND_WRAPPERS,
   COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST,
   DESTINATION_ARGS,
@@ -5028,6 +5113,7 @@ export {
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
+  NET_BINARIES,
   PRIVILEGE_ESCALATION_RE,
   REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS,
@@ -5098,6 +5184,7 @@ export {
   toScanFinding,
   toolMatchesRule,
   truncateBlastPath,
+  unwrapCommandHead,
   validateOverrides,
   validateRegex,
   validateShieldDefinition

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/policy-engine",
-  "version": "2.12.0",
+  "version": "2.13.1",
   "description": "Shared policy evaluation engine for node9 — DLP, smart rules, AST shell parsing, shields, loop detection. Pure functions, no I/O. Used by both node9-proxy and the node9 SaaS firewall.",
   "license": "Apache-2.0",
   "homepage": "https://node9.ai",