@node9/policy-engine 2.13.0 → 2.14.0

package/dist/index.mjs

@@ -717,13 +717,32 @@ var DLP_PATTERNS_GLOBAL = DLP_PATTERNS.map(
   })
 );
 var SENSITIVE_PATH_PATTERNS = [
-  /[/\\]\.ssh[/\\]/i,
-  /[/\\]\.aws[/\\]/i,
+  /[/\\]\.ssh([/\\]|$)/i,
+  /[/\\]\.aws([/\\]|$)/i,
   /[/\\]\.config[/\\]gcloud[/\\]/i,
   /[/\\]\.azure[/\\]/i,
   /[/\\]\.kube[/\\]config$/i,
-  /[/\\]\.env($|\.)/i,
-  // .env, .env.local, .env.production — not .envoy
+  // ⚠️ ONE SEMANTIC, FOUR COPIES. This is the AST tier's `.env` rule verbatim
+  // (shell/index.ts SENSITIVE_PATH_RULES), whose reasoning is documented there:
+  // structural suffix chain rather than a hand-written list, `example|sample|
+  // template` exempt because a fixture stays a fixture whatever follows, and
+  // `.test` anchored because `test` names an ENVIRONMENT -- `.env.test` is the
+  // committed template, `.env.test.local` is gitignored and holds real values.
+  //
+  // It was previously `[/\\]\.env($|\.)` with NO exemptions, so `Read .env.example`
+  // blocked while `cat .env.example` allowed: the same file, opposite verdicts,
+  // decided only by which tool asked. See src/__tests__/jail-both-doors.test.ts,
+  // which is the contract that now holds these copies in step, and stage 5 of
+  // doc/credential-jail-architecture.md, which replaces them with one generated
+  // source.
+  // ⚠️ The `.local` branch comes FIRST and takes no exemption. A fixture stays a
+  // fixture whatever follows it -- `.env.example.md` is documentation -- but
+  // `.env.example.local` is gitignored by the `.env*.local` convention and holds
+  // real values, exactly the reasoning that anchors `(?!\.test$)` rather than
+  // using `\b`. Without this branch the fixture exemption also bought a two-step
+  // bypass: `cp .env .env.sample`, then read the copy.
+  /[/\\]\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env + any suffix chain; fixtures exempt unless .local
   /[/\\]\.git-credentials$/i,
   /[/\\]\.npmrc$/i,
   /[/\\]\.docker[/\\]config\.json$/i,
@@ -1282,6 +1301,10 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "od",
   "xxd",
   "hexdump",
+  // Emits the file's bytes, re-encoded, so it is a read by the set's own test
+  // ("does it emit file contents"). Absent until 2026-09-10, which is why
+  // `base64 ~/.ssh/id_rsa` printed a private key with no verdict.
+  "base64",
   "strings",
   "sort",
   "uniq",
@@ -1289,8 +1312,56 @@ var FS_READ_TOOLS = /* @__PURE__ */ new Set([
   "nl",
   "dd"
 ]);
+var SCP_VALUE_FLAGS = ["i", "F", "o", "c", "S", "P", "J", "D", "W", "l"];
+var RSYNC_SKIP = [
+  "e",
+  "--rsh",
+  "--exclude",
+  "--exclude-from",
+  "--include",
+  "--include-from",
+  "--files-from",
+  "f",
+  "--filter"
+];
+var COPY_VERBS = {
+  cp: { source: "allButLast", targetDirFlag: true },
+  mv: { source: "allButLast", targetDirFlag: true },
+  install: { source: "allButLast", targetDirFlag: true },
+  ln: { source: "first", targetDirFlag: true },
+  scp: { source: "allButLast", skipFlags: SCP_VALUE_FLAGS },
+  rsync: { source: "allButLast", skipFlags: RSYNC_SKIP },
+  tar: {
+    source: "archive",
+    archive: "tar",
+    skipFlags: ["f", "X", "T", "--file", "--exclude", "--exclude-from", "--files-from"]
+  },
+  zip: { source: "archive", archive: "zip", skipFlags: ["x", "i", "--exclude", "--include"] },
+  ar: { source: "archive", archive: "ar" },
+  "7z": { source: "archive", archive: "7z", skipFlags: ["x", "--exclude"] },
+  gzip: { source: "all" },
+  bzip2: { source: "all" },
+  xz: { source: "all" },
+  "docker cp": { source: "allButLast" },
+  "kubectl cp": { source: "allButLast" },
+  "gsutil cp": { source: "allButLast" },
+  "gsutil rsync": { source: "allButLast" },
+  "rclone copy": { source: "allButLast" },
+  "rclone sync": { source: "allButLast" },
+  "aws s3 cp": { source: "allButLast" },
+  "aws s3 mv": { source: "allButLast" },
+  "aws s3 sync": { source: "allButLast" },
+  "gcloud storage cp": { source: "allButLast" },
+  "az storage blob upload": { source: "flagOperand", sourceFlags: ["f", "--file"] }
+};
+var TAR_MODE_WORD = /^[a-zA-Z]+$/;
+var COPY_VERB_HEADS = new Set(Object.keys(COPY_VERBS).map((k) => k.split(" ")[0]));
 var FS_OP_PRESCREEN_RE = new RegExp(
-  `(?:^|[\\s|;&(\`\\n])(?:rm|${[...FS_READ_TOOLS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b`
+  // A quote is a separator too: `eval "cat X"` and `sh -c 'cat X'` put the
+  // reader right after `"` / `'`, and without these two characters the
+  // prescreen rejected every string-wrapped read before the parser ran.
+  // Found 2026-09-11 by instrumenting the walk -- no CallExpr was ever visited.
+  `(?:^|[\\s|;&("'\`\\n/])(?:rm|${[...FS_READ_TOOLS, ...COPY_VERB_HEADS].map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b|(?<!<)<(?!<)`
 );
 var HOME_CACHE_ALLOWLIST = [
   ".cache",
@@ -1311,12 +1382,12 @@ var SENSITIVE_PATH_RULES = [
   {
     rule: "shield:project-jail:block-read-ssh",
     reason: "Reading SSH private keys is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.ssh[\\/]/i.test(p)
+    match: (p) => /([\\/]\.ssh[\\/]|^\.ssh[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.ssh$)/i.test(p)
   },
   {
     rule: "shield:project-jail:block-read-aws",
     reason: "Reading AWS credentials is blocked by project-jail shield",
-    match: (p) => /(^|[\\/])\.aws[\\/]/i.test(p)
+    match: (p) => /([\\/]\.aws[\\/]|^\.aws[\\/]|^(?:[~/]|[A-Za-z]:).*[\\/]\.aws$)/i.test(p)
   },
   {
     // Mirrors the JSON shield's `.env` pattern (project-jail.json's
@@ -1360,7 +1431,9 @@ var SENSITIVE_PATH_RULES = [
     //     symmetry — silently exempts every `.env.test.*` file.
     //
     // shields.test.ts:983-995 is the canonical contract; keep both in step.
-    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$/i.test(p)
+    match: (p) => /(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i.test(
+      p
+    )
   },
   {
     // verdict: 'review' (not 'block') is a deliberate design choice
@@ -1571,15 +1644,14 @@ function listOps() {
   return _listOps;
 }
 var WRAPPER_TAKES_TARGET = /* @__PURE__ */ new Set(["chroot"]);
+var FIND_EXEC_FLAGS = /* @__PURE__ */ new Set(["-exec", "-execdir", "-ok", "-okdir"]);
 var INTERP_LEADING_TARGET = /* @__PURE__ */ new Set(["su"]);
 function unwrapCommandHead(words) {
   let i = 0;
   while (i < words.length) {
     const head = (words[i] ?? "").toLowerCase().split("/").pop() ?? "";
     if (head === "find") {
-      const x = words.findIndex(
-        (w, k) => k > i && (w === "-exec" || w === "-execdir" || w === "-ok")
-      );
+      const x = words.findIndex((w, k) => k > i && w !== null && FIND_EXEC_FLAGS.has(w));
       if (x < 0) break;
       i = x + 1;
       continue;
@@ -1601,7 +1673,11 @@ function unwrapCommandHead(words) {
       if (t.startsWith("-")) {
         i++;
         const nxt = words[i];
-        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()))
+        if (nxt != null && !nxt.startsWith("-") && !INLINE_INTERPRETER.test(nxt.split("/").pop() ?? "") && !COMMAND_WRAPPERS.has(nxt.toLowerCase()) && !RUNNER_WRAPPERS.has(nxt.toLowerCase()) && // A reader is a command, never a flag's operand: `env - cat X`,
+        // `stdbuf -o0 cat X`, `ionice -c3 cat X`. Without this the head was
+        // swallowed and the jail needed a looser fallback whose cost was a
+        // false positive on `sudo echo cat X`.
+        !FS_READ_TOOLS.has(nxt.split("/").pop()?.toLowerCase() ?? ""))
           i++;
         continue;
       }
@@ -1720,38 +1796,43 @@ function isProtectedHomePath(rawPath) {
   }
   return true;
 }
-function extractLiteralArgs(callExpr) {
-  const args = callExpr.Args || [];
-  if (args.length === 0) return { name: "", flags: [], paths: [] };
-  const litFromWord = (w) => {
-    const parts = w?.Parts || [];
-    let s = "";
-    for (const p of parts) {
-      const t = syntax.NodeType(p);
-      if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
-      else if (t === "SglQuoted") s += p.Value ?? "";
-      else if (t === "DblQuoted") {
-        const inner = p.Parts || [];
-        if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
-        s += inner.map((ip) => ip.Value ?? "").join("");
-      } else {
-        return null;
-      }
+function positionedArgs(words, from = 1, to = words.length) {
+  const out = [];
+  let afterFlag = null;
+  for (let i = from; i < to; i++) {
+    const v = words[i];
+    if (v === null) {
+      afterFlag = null;
+      continue;
     }
-    return s;
-  };
-  const name = (litFromWord(args[0]) || "").toLowerCase();
-  const flags = [];
-  const paths = [];
-  for (let i = 1; i < args.length; i++) {
-    const v = litFromWord(args[i]);
-    if (v === null) continue;
-    if (v.startsWith("-")) flags.push(v);
-    else paths.push(v);
+    if (v.startsWith("-")) {
+      afterFlag = v;
+      continue;
+    }
+    out.push({ value: v, index: out.length, argv: i, afterFlag });
+    afterFlag = null;
   }
-  return { name, flags, paths };
+  return out;
 }
-var NET_BINARIES = /* @__PURE__ */ new Set(["curl", "wget", "scp", "ssh", "nc", "ncat", "netcat"]);
+function extractLiteralArgs(callExpr) {
+  const rawArgs = callExpr.Args || [];
+  if (rawArgs.length === 0) return { name: "", flags: [], paths: [], words: [], args: [] };
+  const words = rawArgs.map((a) => resolveWordLiteral(a));
+  const name = baseWord(words[0]);
+  const flags = words.slice(1).filter((w) => w !== null && w.startsWith("-"));
+  const args = positionedArgs(words);
+  return { name, flags, paths: args.map((a) => a.value), words, args };
+}
+var NET_BINARIES = /* @__PURE__ */ new Set([
+  "curl",
+  "wget",
+  "scp",
+  "ssh",
+  "nc",
+  "ncat",
+  "netcat",
+  "rsync"
+]);
 var VALUE_FLAGS = {
   curl: /* @__PURE__ */ new Set([
     "-d",
@@ -2036,6 +2117,9 @@ function deriveRedirOp(sample) {
   }
 }
 var REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
+var REDIR_FILE_IN_OPS = new Set(
+  [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+);
 var REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
   deriveRedirOp("cat <<X\nX"),
   deriveRedirOp("cat <<-X\nX")
@@ -2100,16 +2184,21 @@ function isRmCreatedInCommandCleanup(command) {
   }
   return sawRm && ok;
 }
-function analyzeFsOperationImpl(command) {
+function analyzeFsOperationImpl(command, depth = 0) {
   const f = parseShared(command);
   if (f === PARSE_FAIL) return null;
   let result = null;
   try {
     syntax.Walk(f, (node) => {
-      if (!node || result) return false;
+      if (!node || result?.verdict === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
-      const { name, flags, paths } = extractLiteralArgs(n);
+      const nodeType = syntax.NodeType(n);
+      if (nodeType === "Stmt") {
+        result = stricter(result, jailedRedirectRead(n));
+        return result?.verdict !== "block";
+      }
+      if (nodeType !== "CallExpr") return true;
+      const { name, flags, paths, words } = extractLiteralArgs(n);
       if (!name) return true;
       if (name === "rm") {
         const flagStr = flags.join("").toLowerCase();
@@ -2138,21 +2227,27 @@ function analyzeFsOperationImpl(command) {
           }
         }
       }
-      if (FS_READ_TOOLS.has(name)) {
-        for (const p of paths) {
-          for (const sp of SENSITIVE_PATH_RULES) {
-            if (sp.match(p)) {
-              result = {
-                ruleName: sp.rule,
-                verdict: sp.verdict ?? "block",
-                reason: sp.reason,
-                path: p
-              };
-              return false;
-            }
+      if (depth < 1) {
+        const payload = literalShellPayload(words, name);
+        if (payload !== null) {
+          const inner = analyzeFsOperationImpl(payload, depth + 1);
+          if (inner) {
+            result = inner;
+            return false;
           }
+          return true;
+        }
+      }
+      const readPaths = FS_READ_TOOLS.has(name) ? paths : wrappedReadPaths(words, name);
+      if (readPaths) {
+        for (const p of readPaths) {
+          result = stricter(result, matchSensitivePath2(p));
+          if (result?.verdict === "block") return false;
         }
       }
+      for (const p of copySourcePaths(words)) {
+        result = stricter(result, copyVerdictOf(matchSensitivePath2(p)));
+      }
       return true;
     });
     return result;
@@ -2160,6 +2255,209 @@ function analyzeFsOperationImpl(command) {
     return null;
   }
 }
+function stricter(a, b) {
+  if (!a) return b;
+  if (!b) return a;
+  return b.verdict === "block" && a.verdict !== "block" ? b : a;
+}
+function flagInfo(w) {
+  if (w.startsWith("--")) {
+    const eq = w.indexOf("=");
+    return eq < 0 ? { letter: null, long: w, attached: null } : { letter: null, long: w.slice(0, eq), attached: w.slice(eq + 1) };
+  }
+  const m = /^-([a-zA-Z]+)(.*)$/.exec(w);
+  if (!m) return { letter: null, long: null, attached: null };
+  return { letter: m[1][m[1].length - 1], long: null, attached: m[2] === "" ? null : m[2] };
+}
+function flagIs(w, names) {
+  if (w === null) return false;
+  const f = flagInfo(w);
+  return names.some((n) => n.startsWith("--") ? f.long === n : f.letter === n);
+}
+function operandOf(a, names) {
+  if (!names || a.afterFlag === null) return false;
+  return flagIs(a.afterFlag, names) && flagInfo(a.afterFlag).attached === null;
+}
+function resolveCopyShape(words, h) {
+  const verb = baseWord(words[h]);
+  if (!verb) return null;
+  const direct = COPY_VERBS[verb];
+  if (direct) return { shape: direct, last: h };
+  const slots = positionedArgs(words, h + 1);
+  for (let i = 0; i < slots.length; i++) {
+    for (let n = 3; n >= 1; n--) {
+      const part = slots.slice(i, i + n);
+      if (part.length < n) continue;
+      const key = [verb, ...part.map((a) => a.value.toLowerCase())].join(" ");
+      const shape = COPY_VERBS[key];
+      if (shape) return { shape, last: part[n - 1].argv };
+    }
+    if (slots[i].afterFlag === null) return null;
+  }
+  return null;
+}
+var FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
+function findStartPoints(words, h) {
+  const k = words.findIndex((w, i) => i > h && w !== null && FIND_EXEC_FLAGS.has(w));
+  if (k < 0) return { k, starts: [] };
+  const firstPredicate = words.findIndex(
+    (w, i) => i > h && w !== null && w.startsWith("-") && !FIND_OPTIONS.has(w)
+  );
+  const end = firstPredicate > h ? firstPredicate : k;
+  return { k, starts: positionalAfter(words, h + 1, end) };
+}
+function copySourcePaths(words) {
+  const h = unwrapCommandHead(words);
+  const fi = words.findIndex((w, i) => i <= h && baseWord(w) === "find");
+  if (fi >= 0) {
+    const { k, starts } = findStartPoints(words, fi);
+    if (k < 0) return [];
+    const action = unwrapCommandHead(words.slice(k + 1));
+    return resolveCopyShape(words.slice(k + 1), action) ? starts : [];
+  }
+  if (!COPY_VERB_HEADS.has(baseWord(words[h]))) return [];
+  const r = resolveCopyShape(words, h);
+  if (!r) return [];
+  const { shape, last } = r;
+  const args = positionedArgs(words, last + 1);
+  const tail = words.slice(last + 1);
+  const skipped = (a) => operandOf(a, shape.skipFlags);
+  const targetDir = shape.targetDirFlag === true && tail.some((w) => w !== null && w.startsWith("-") && flagIs(w, ["t", "--target-directory"]));
+  const targetOperand = (a) => targetDir && operandOf(a, ["t", "--target-directory"]);
+  const lastOperand = [...tail].reverse().find((w) => w === null || !w.startsWith("-"));
+  const dynamicDest = lastOperand === null;
+  const destIsLastOperand = (shape.source === "allButLast" || shape.source === "first") && !targetDir && !dynamicDest;
+  if (destIsLastOperand && typeof lastOperand === "string" && matchSensitivePath2(lastOperand))
+    return [];
+  let src;
+  switch (shape.source) {
+    case "all":
+      src = args;
+      break;
+    case "first":
+      src = targetDir ? args : args.slice(0, 1);
+      break;
+    case "flagOperand": {
+      const inline = tail.filter((w) => w !== null && w.startsWith("--")).map((w) => flagInfo(w)).filter((f) => f.attached !== null && (shape.sourceFlags ?? []).includes(f.long ?? "")).map((f) => f.attached);
+      return [
+        ...args.filter(
+          (a) => flagIs(a.afterFlag, shape.sourceFlags ?? []) && flagInfo(a.afterFlag).attached === null
+        ).map((a) => a.value),
+        ...inline
+      ];
+    }
+    case "archive":
+      src = archiveInputs(shape.archive, args, tail);
+      break;
+    case "allButLast":
+      src = targetDir || dynamicDest ? args : args.slice(0, -1);
+      break;
+  }
+  return src.filter((a) => !skipped(a) && !targetOperand(a)).map((a) => a.value);
+}
+function archiveInputs(kind, args, tail) {
+  const first = args[0];
+  const bareKey = first && first.afterFlag === null && TAR_MODE_WORD.test(first.value);
+  if (kind === "tar") {
+    const flagsText = tail.filter((w) => w !== null && w.startsWith("-")).join(" ");
+    const mode = (bareKey ? first.value : "") + flagsText;
+    const extracting = /x|t/.test(bareKey ? first.value.replace(/f/g, "") : "") || /(^|\s)-[a-zA-Z]*[xt]|--extract|--list|--get/.test(flagsText);
+    const writing = /[cruA]/.test(bareKey ? first.value : "") || /(^|\s)-[a-zA-Z]*[cruA]|--create|--append|--update|--concatenate/.test(flagsText);
+    if (extracting && !writing) return [];
+    void mode;
+    let i = 0;
+    if (bareKey) {
+      i = 1;
+      const next = args[1];
+      if (first.value.includes("f") && next && next.afterFlag === null) i = 2;
+    }
+    return args.slice(i);
+  }
+  if (kind === "zip") return first && first.afterFlag === "-" ? args : args.slice(1);
+  if (kind === "ar") return bareKey ? args.slice(2) : args.slice(1);
+  return args.slice(2);
+}
+function sampleCopyCommand(verb, src) {
+  const shape = COPY_VERBS[verb];
+  if (!shape) throw new Error(`not a copy verb: ${verb}`);
+  const remote = /^(scp|rsync|aws |gsutil|gcloud|rclone|docker|kubectl)/.test(verb);
+  switch (shape.source) {
+    case "first":
+      return `${verb} -s ${src} /tmp/n9-link`;
+    case "all":
+      return `${verb} -c ${src} > /tmp/n9-out`;
+    case "flagOperand":
+      return `${verb} -f ${src} -c n9`;
+    case "archive":
+      return shape.archive === "tar" ? `tar czf /tmp/n9-out.tgz ${src}` : shape.archive === "zip" ? `zip -r /tmp/n9-out.zip ${src}` : shape.archive === "ar" ? `ar rc /tmp/n9-out.a ${src}` : `7z a /tmp/n9-out.7z ${src}`;
+    case "allButLast":
+      return `${verb} ${src} ${remote ? verb.startsWith("scp") || verb === "rsync" ? "user@host.invalid:/tmp/" : verb.startsWith("docker") || verb.startsWith("kubectl") ? "ctr:/tmp/" : "remote:/n9/" : "/tmp/n9-copy"}`;
+  }
+}
+var COPY_RULE_OF = {
+  "shield:project-jail:block-read-ssh": "shield:project-jail:review-copy-ssh",
+  "shield:project-jail:block-read-aws": "shield:project-jail:review-copy-aws",
+  "shield:project-jail:block-read-env": "shield:project-jail:review-copy-env",
+  "shield:project-jail:review-read-credentials": "shield:project-jail:review-copy-credentials"
+};
+function copyVerdictOf(hit) {
+  if (!hit) return null;
+  const ruleName = COPY_RULE_OF[hit.ruleName];
+  if (!ruleName) return null;
+  return {
+    ruleName,
+    verdict: "review",
+    reason: `Copying ${hit.path} moves a credential out of its jail (project-jail shield)`,
+    path: hit.path
+  };
+}
+function matchSensitivePath2(p) {
+  for (const sp of SENSITIVE_PATH_RULES) {
+    if (sp.match(p))
+      return { ruleName: sp.rule, verdict: sp.verdict ?? "block", reason: sp.reason, path: p };
+  }
+  return null;
+}
+function baseWord(w) {
+  return (w ?? "").split("/").pop()?.toLowerCase() ?? "";
+}
+var isReaderWord = (w) => w !== null && FS_READ_TOOLS.has(baseWord(w));
+var positionalAfter = (words, from, to = words.length) => positionedArgs(words, from, to).map((a) => a.value);
+function wrappedReadPaths(words, name) {
+  if (name === "find") {
+    const { k, starts } = findStartPoints(words, 0);
+    return k > 0 && isReaderWord(words[k + 1] ?? null) ? starts : null;
+  }
+  if (!COMMAND_WRAPPERS.has(name) && !RUNNER_WRAPPERS.has(name)) return null;
+  const h = unwrapCommandHead(words);
+  return h > 0 && isReaderWord(words[h] ?? null) ? positionalAfter(words, h + 1) : null;
+}
+function literalShellPayload(words, name) {
+  const h = COMMAND_WRAPPERS.has(name) || RUNNER_WRAPPERS.has(name) ? unwrapCommandHead(words) : 0;
+  const head = (words[h] ?? "").split("/").pop()?.toLowerCase() ?? "";
+  if (head === "eval") {
+    const rest = words.slice(h + 1);
+    if (rest.length === 0 || rest.some((w) => w === null)) return null;
+    return rest.join(" ");
+  }
+  if (SHELL_INTERPRETERS.has(head)) {
+    const c = words.findIndex((w, i) => i > h && w !== null && isInlineCodeFlag(head, w));
+    if (c < 0) return null;
+    return words[c + 1] ?? null;
+  }
+  return null;
+}
+function jailedRedirectRead(stmt) {
+  const redirs = stmt.Redirs || [];
+  for (const r of redirs) {
+    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    const p = resolveWordLiteral(r.Word);
+    if (p === null || p === "") continue;
+    const hit = matchSensitivePath2(p);
+    if (hit) return hit;
+  }
+  return null;
+}
 function analyzeShellCommand(command) {
   const actions = [];
   const paths = [];
@@ -2296,21 +2594,7 @@ function evaluateEgress(dests, policy) {
 }
 
 // src/policy/pipe-chain.ts
-var SOURCE_COMMANDS = /* @__PURE__ */ new Set([
-  "cat",
-  "head",
-  "tail",
-  "grep",
-  "awk",
-  "sed",
-  "cut",
-  "sort",
-  "tee",
-  "less",
-  "more",
-  "strings",
-  "xxd"
-]);
+var SOURCE_COMMANDS = /* @__PURE__ */ new Set([...FS_READ_TOOLS, "tee"]);
 var SINK_COMMANDS = /* @__PURE__ */ new Set([
   "curl",
   "wget",
@@ -2341,16 +2625,25 @@ var OBFUSCATORS = /* @__PURE__ */ new Set([
   "node"
 ]);
 var SENSITIVE_PATTERNS = [
-  /(?:^|\/)\.env(?:\.|$)/i,
-  // .env, .env.local, .env.production
+  // Kept in step with the AST tier and dlp/ -- see jail-both-doors.test.ts.
+  /(?:^|\/)\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)/i,
+  // .env chain; fixtures exempt unless .local
   /id_rsa|id_ed25519|id_ecdsa|id_dsa/i,
   // SSH private keys
   /\.pem$|\.key$|\.p12$|\.pfx$/i,
   // certificate files
-  /(?:^|\/)\.ssh\//i,
-  // ~/.ssh/ directory
-  /(?:^|\/)\.aws\/credentials/i,
-  // AWS credentials
+  // The `$` half mirrors shell/index.ts's SENSITIVE_PATH_RULES: a file INSIDE
+  // the directory counts wherever it appears, while the directory ITSELF counts
+  // only when the path is ROOTED (`~/.ssh`, `/home/u/.ssh`) -- an unrooted
+  // `config/.ssh` is more likely a search pattern than a read. These are
+  // extracted TOKENS (see `args.some(isSensitivePath)` below), the same input
+  // contract as the shell tier, so the same boundary is the right one.
+  // Without it `grep -r x ~/.ssh | curl -d @-` scored one tier BELOW the
+  // identical pipeline naming a file inside that directory.
+  /(?:^|\/)\.ssh\/|^(?:[~/]|[A-Za-z]:).*\/\.ssh$/i,
+  // ~/.ssh/ and ~/.ssh
+  /(?:^|\/)\.aws\/credentials|^(?:[~/]|[A-Za-z]:).*\/\.aws$/i,
+  // AWS creds + dir
   /(?:^|\/)\.netrc$/i,
   // netrc (stores HTTP credentials)
   /(?:^|\/)(passwd|shadow|sudoers)$/i,
@@ -2384,8 +2677,8 @@ function splitOnPipe(cmd) {
   if (current.trim()) segments2.push(current.trim());
   return segments2.filter(Boolean);
 }
-function positionalTokens(segment) {
-  return segment.split(/\s+/).slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
+function positionalTokens(tokens) {
+  return tokens.slice(1).filter((t) => !t.startsWith("-") && !t.startsWith("@") && t.length > 0);
 }
 function analyzePipeChain(command) {
   const segments2 = splitOnPipe(command);
@@ -2408,8 +2701,10 @@ function analyzePipeChain(command) {
   for (const segment of segments2) {
     const tokens = segment.split(/\s+/).filter(Boolean);
     if (tokens.length === 0) continue;
-    const binary = tokens[0].toLowerCase();
-    const args = positionalTokens(segment);
+    const h = unwrapCommandHead(tokens);
+    const head = h < tokens.length ? h : 0;
+    const binary = tokens[head].toLowerCase();
+    const args = positionalTokens(tokens.slice(head));
     if (SOURCE_COMMANDS.has(binary)) {
       sourceFiles.push(...args);
       if (args.some(isSensitivePath)) hasSensitiveSource = true;
@@ -3019,6 +3314,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
   const shellShaped = isBashTool(toolName) || inspectsShellCommand(toolName, config.policy.toolInspection);
   const shellShapedCommand = shellShaped ? isBashTool(toolName) && args && typeof args === "object" ? typeof args.command === "string" ? args.command : null : extractShellCommand(toolName, args, config.policy.toolInspection) : null;
   const bashCommand = agent !== "Terminal" ? shellShapedCommand : null;
+  let pendingAstReview;
   if (bashCommand !== null) {
     const pipeVerdict = pipeChainVerdict(
       bashCommand,
@@ -3030,7 +3326,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     if (fsVerdict) {
       const isShieldRule = fsVerdict.ruleName.startsWith("shield:");
       const labelPrefix = isShieldRule ? "project-jail (AST)" : "Node9 (AST)";
-      return {
+      const astVerdict = {
         decision: fsVerdict.verdict,
         blockedByLabel: `${labelPrefix}: ${fsVerdict.ruleName}`,
         reason: fsVerdict.reason,
@@ -3038,6 +3334,8 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
         ruleName: fsVerdict.ruleName,
         ruleDescription: fsVerdict.reason
       };
+      if (fsVerdict.verdict === "block") return astVerdict;
+      pendingAstReview = astVerdict;
     }
     const sqlAction = resolveCheck(config.policy.commandChecks?.sqlDdl);
     const sqlVerdict = sqlAction === "off" ? null : analyzeSqlDestructive(bashCommand);
@@ -3080,7 +3378,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     const matchedRule = resolvePinned(matches);
     if (matchedRule) {
       if (matchedRule.verdict === "allow")
-        return { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
+        return pendingAstReview ?? { decision: "allow", ruleName: matchedRule.name ?? matchedRule.tool };
       return {
         decision: matchedRule.verdict,
         blockedByLabel: `Smart Rule: ${matchedRule.name ?? matchedRule.tool}`,
@@ -3107,6 +3405,7 @@ async function evaluatePolicy(config, toolName, args, context = {}, hooks = {})
     allTokens = analyzed.allTokens;
     pathTokens = analyzed.paths;
     const candidates = [];
+    if (pendingAstReview) candidates.push(pendingAstReview);
     const evalVerdict = detectDangerousShellExec(shellCommand);
     if (evalVerdict === "block") {
       return {
@@ -3852,7 +4151,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.ssh[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -3866,7 +4165,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.aws[\\/\\\\]",
           flags: "i"
         }
       ],
@@ -3880,7 +4179,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*?\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?(?=\\s|$|[;&|>)<])",
           flags: "i"
         }
       ],
@@ -3894,7 +4193,7 @@ var project_jail_default = {
         {
           field: "command",
           op: "matches",
-          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
+          value: "(cat|less|head|tail|bat|more|open|print|nano|vim|vi|emacs|code|type|grep|egrep|fgrep|rg|ag|ack|awk|gawk|sed|cut|tr|jq|yq|od|xxd|hexdump|strings|base64|sort|uniq|tac|nl|dd)\\s+.*(credentials\\.json|\\.netrc|\\.npmrc|\\.docker[\\/\\\\]config\\.json|gcloud[\\/\\\\]credentials)",
           flags: "i"
         }
       ],
@@ -3908,7 +4207,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.ssh[\\/\\\\]",
+          value: "([\\/\\\\]\\.ssh([\\/\\\\]|$)|^\\.ssh[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -3922,7 +4221,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.aws[\\/\\\\]",
+          value: "([\\/\\\\]\\.aws([\\/\\\\]|$)|^\\.aws[\\/\\\\])",
           flags: "i"
         }
       ],
@@ -3936,7 +4235,7 @@ var project_jail_default = {
         {
           field: "file_path",
           op: "matches",
-          value: "(^|[\\/\\\\])\\.env(\\.(local|production|staging|development|production\\.local|staging\\.local|development\\.local))?$",
+          value: "(^|[\\/\\\\])\\.env(?![\\w-])(?:[\\w.-]*\\.local$|(?!\\.(example|sample|template)\\b)(?!\\.test$)[\\w.-]*$)",
           flags: "i"
         }
       ],
@@ -4213,6 +4512,12 @@ function classifyRuleSeverity(name, verdict) {
     "read-ssh",
     "read-gcp",
     "read-cred",
+    // Stage 4 (2026-09-11): a copy of a credential file scores like a READ of it --
+    // read-ssh/aws/cred are critical, so copy-ssh/aws/cred are; read-env is high
+    // (below), so copy-env joins the high list, not this one (/code-review).
+    "copy-ssh",
+    "copy-aws",
+    "copy-cred",
     "delete-repo",
     "helm-uninstall",
     "drop-table",
@@ -4225,6 +4530,7 @@ function classifyRuleSeverity(name, verdict) {
   ];
   if (criticalPatterns.some((p) => n.includes(p))) return "critical";
   const highPatterns = [
+    "copy-env",
     "force-push",
     "force_push",
     "git-destructive",
@@ -4242,6 +4548,11 @@ function narrativeRuleLabel(name) {
   const map = {
     "read-aws": "AWS credentials read",
     "read-ssh": "SSH private key read",
+    // Stage 4 copy twins, so `scan --narrative` prints a label, not a raw slug.
+    "copy-ssh": "SSH private key copied out",
+    "copy-aws": "AWS credentials copied out",
+    "copy-env": ".env file copied out",
+    "copy-cred": "credential file copied out",
     "read-gcp": "GCP credentials read",
     "read-cred": "credential file read",
     "delete-repo": "GitHub repository deletion",
@@ -4379,7 +4690,7 @@ function summarizeBlast(result, opts = {}) {
 // src/scan/destructive-regex.ts
 var DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
 var PRIVILEGE_ESCALATION_RE = /\bchmod\s+(0?777|\+x)\b|\bchown\s+root\b/i;
-var SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
+var SENSITIVE_PATH_RE = /[\\/]\.aws(?:[\\/]|$)|^\.aws[\\/]|[\\/]\.ssh(?:[\\/]|$)|^\.ssh[\\/]|(?:^|[\\/])\.env(?![\w-])(?:[\w.-]*\.local$|(?!\.(?:example|sample|template)\b)(?!\.test$)[\w.-]*$)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
 var FILE_TOOLS = /* @__PURE__ */ new Set([
   "read",
   "read_file",
@@ -4639,8 +4950,8 @@ function matchCanaryArgs(args, values) {
 
 // src/scan/canonical.ts
 var LONG_OUTPUT_THRESHOLD_BYTES = 100 * 1024;
-var CANONICAL_EXTRACTOR_VERSION = "canonical-v10";
-var CANONICAL_EXTRACTOR_HASH = "c4edee9dc99eb69a";
+var CANONICAL_EXTRACTOR_VERSION = "canonical-v14";
+var CANONICAL_EXTRACTOR_HASH = "8b5729fe236a195b";
 var DEDUPE_PREVIEW_LEN = 120;
 function extractCanonicalFindings(call, ctx) {
   const out = [];
@@ -5015,6 +5326,8 @@ export {
   CANARY_MIN_LENGTH,
   CANONICAL_EXTRACTOR_HASH,
   CANONICAL_EXTRACTOR_VERSION,
+  COMMAND_WRAPPERS,
+  COPY_VERBS,
   COST_PER_LOOP_ITER_USD,
   DEFAULT_EGRESS_ALLOWLIST,
   DESTINATION_ARGS,
@@ -5028,6 +5341,7 @@ export {
   LONG_OUTPUT_THRESHOLD_BYTES,
   LOOP_MAX_RECORDS,
   LOOP_THRESHOLD_FOR_WASTE,
+  NET_BINARIES,
   PRIVILEGE_ESCALATION_RE,
   REALTIME_PII_PATTERNS,
   SCAN_SIGNAL_WEIGHTS,
@@ -5083,9 +5397,11 @@ export {
   normalizeIpLiteral,
   parseAllSshHostsFromCommand,
   parseDestHost,
+  positionedArgs,
   previewArgs,
   redactText,
   resolvePinned,
+  sampleCopyCommand,
   scanArgs,
   scanInjection,
   scanText,
@@ -5098,6 +5414,7 @@ export {
   toScanFinding,
   toolMatchesRule,
   truncateBlastPath,
+  unwrapCommandHead,
   validateOverrides,
   validateRegex,
   validateShieldDefinition